CyCognito Discovers Alarming Volume of Personal Identifiable Information in Vulnerable Cloud and Web Applications

Research finds 74 percent of cloud and web applications with PII, including Social Security numbers and banking information, are vulnerable to exploits

Palo Alto, California – August 16, 2023

CyCognito, the leading External Attack Surface Management platform, today released its semi-annual "State of External Exposure Management," revealing a staggering number of vulnerable public cloud, mobile and web applications exposing sensitive data, including unsecured APIs and personal identifiable information (PII). Developed by CyCognito's research division, the report is based on the analysis of 3.5 million assets across its enterprise customer base, including a number of Fortune 500 companies.

"The latest MOVEit exploit is a cautionary tale for all CISOs that attackers remain many steps ahead of web application and cloud security," said Rob Gurzeev, CEO and co-founder, CyCognito. "The volume of exposed PII stemming from this disastrous breach supports our findings and underscores the critical need for full-scope visibility of all assets across an organization's attack surface. Businesses can no longer afford to neglect their digital shadow and the many unknown and unmanaged risks within their systems."

Click here to download the full report.

Key findings include:

• 74 percent of assets with PII are vulnerable to at least one known major exploit, and one in 10 have at least one easily exploitable issue.
• 70 percent of web applications have severe security gaps, like lacking WAF protection or an encrypted connection like HTTPS, while 25 percent of all web applications (web apps) lacked both.
• The typical global enterprise has over 12 thousand web apps, which include APIs, SaaS applications, servers, and databases, among others. At least 30 percent of these web apps—over 3,000 assets—have at least one exploitable or high risk vulnerability. Half of these potentially vulnerable web apps are hosted in the cloud.
• 98 percent of web apps are potentially GDPR non-compliant due to lack of opportunity for users to opt out of cookies.

Gurzeev continued, "The size of a company's attack surface fluctuates up and down by as much as 10 percent a month, making it a moving target rife with security gaps ready to be exploited. "Our latest research is not only a wake-up call that no business is immune to risk; it's also clear proof that unknown and undiscovered assets present a major threat to an organization."