X
December 11, 2024
Attackers targeted applications and application programming interfaces (APIs) with an average of 50 confirmed attacks per app in the month of November 2024. That’s down from the previous month, but an alarming number of attacks continue to circumvent other defenses, and are only caught by Contrast Application Detection and Response (ADR). Every 30 days, Contrast Security publishes data about the detection and response of real-world application and API attacks with ADR.
First, some context to explain how we use the word “attack.” We are talking only about attacks that are confirmed to reach their intended vulnerability and are about to launch the exploit, not “the noise of the internet” type attacks that would never have turned into a noteworthy breach. Contrast tunes out the noise clarity, filtering out the false positives.
When we talk about “probes,” we mean active reconnaissance by attackers who are doorknob rattling in a search for weakness, misconfigurations and vulnerabilities open to exploit. While the probe may have made it past the web application firewall (WAF), many of the resulting attacks are obvious, get caught by a WAF and don’t result in a serious threat.
Contrast’s attack data is measured directly from real world running applications and APIs. Our attacks aren’t measured in millions, billions or even trillions, because that’s part of the problem: too much noise. Because Contrast Security instruments the code, we’re not reporting on signatures or theoretical attacks, only what’s actually a dangerous anomaly.
False positives are exhausting. Here’s how to shut them up.
The November numbers for probes and attacks are in the charts below. As you can see, there were over 4K probes and more than 50 real attacks per app/API. That means that real attacks were about 1% as frequent as probes.
The important message for November is that the average app/API was hit with over 50 attacks that were able to navigate the maze of code and find their way to the exact kind of vulnerability they targeted.
Since we publish data monthly, we’ll be keeping an eye on trends. Attackers know that there are a lot of vacations in December. We will be keeping an eye on attack volume, which typically goes up at this time of year. If the pattern holds, we will see criminals continue to shift toward the types of attacks that bypass WAFs and endpoint detection and response (EDR) tools.
Most organizations using data from perimeter tools are surprised when they see how many dangerous attacks are making it through to their applications and APIs. Contact Contrast Security if you’d like to see what’s really happening in your application layer.
Read more:
