Worrisome Web Vulnerability Trends in the Race to Innovation
summary
Aggregated Invicta scan data cover 23 billion checks from ~1,000 customers and report 280,000 direct-impact vulnerabilities, with a confirmed false positive rate of about 1 in 5,000. Automated scanners run in CI/CD pipelines and prioritize high-severity findings; results show severe flaws are not falling—RCE climbs ~3% year over year, SSRF appears in ~15% of orgs in 2021, and SQLi still hits education/government at ~35%/32%—practical evidence, not anecdotes.
AI-written summary · about
chapters (10)
- 0:00Start
- 5:09Report overview
- 6:48Methodology
- 11:02Vulnerabilities at a glance
- 13:31Remote code execution (RCE)
- 15:22Server-side request forgery (SSRF)
- 23:22Local file inclusion (LFI)
- 25:53OS command injection
- 27:46Cross-site scripting (XSS)
- 30:27Cross-site request forgery (CSRF)
related talks
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
39mThe AI Arms Race in Vulnerability Management, Who’s Winning?
34mThe State of Web Security
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate