Topic starter
01/08/2026 8:55 pm
TL;DR: A 1 hour and 56 minute gap to first hostile contact is the exposure pattern Arxan Technologies identifies for enterprise software. Runtime governance has to start before and after publication, because secrets, APIs, and revocation can no longer wait for release-time review.
Editorial analysis by NHI Mgmt Group, based on content published by Arxan Technologies: “2026 Application Security Threat Report”.
By the numbers:
- Since 2022, the attack rate on enterprise applications has risen from 55% to 87%.
- In 2026, connected-vehicle apps are attacked at the same rate as banking apps, at 91% each.
Key questions
Q: Why do AI-assisted attacks increase application risk so quickly?
A: AI-assisted tooling reduces the effort required to find exposed endpoints, vary payloads, and test credentials at scale.
Q: How do security teams know if business application controls are working?
A: Look for three signals: fewer standing exceptions, cleaner SoD outcomes after role combination tests, and access review results that consistently remove unused permissions.
Q: What breaks when application security assumes release-time review is enough?
A: Release-time review breaks when attackers can inspect, reverse-engineer, and probe a new app within minutes of publication.
Practitioner guidance
- Harden publication as a security event Treat app store release, package publishing, and update rollout as the start of an active attack window.
- Move runtime telemetry ahead of manual review Instrument applications so hostile probing, tampering, and anomalous API use are visible immediately after publication.
- Inventory and revoke embedded credentials Identify tokens, API keys, certificates, and delegated access paths that ship with the application or are invoked on first run.
Bottom line: Application attack risk is no longer a niche or deferred concern, because hostile contact can begin almost as soon as software is published.
Glossary terms: Runtime Application Governance, Attacker Preparation Cycle, Embedded Credential, Exposure Window
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 58 minutes ago by NHI Mgmt Group
01/08/2026 9:03 pm
Application exposure is now a runtime governance problem, not a release problem: once hostile contact arrives within minutes of publication, security teams can no longer treat pre-release assurance as the primary control plane. The report shows that attacker economics have shifted faster than many delivery pipelines. Practitioners need to govern exposure continuously from publication onward, not assume the build stage buys safety.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations prioritise embedded secret removal over more app hardening?
A: They should prioritise both, but embedded secret removal usually comes first because exposed credentials collapse other controls. Hardening helps only if the application’s tokens, keys, and delegated access paths are not already extractable from the package or runtime environment. When secrets are present, attackers can bypass many other safeguards.
👉 Read our full editorial: Application attack rates surged to 87% as AI compresses attacker costs