Only 3% of public sector applications are free of flaws.

Recently, Veracode analyzed the security debt and application risk management in the public sector. The report found that security debt, defined as flaws that remain unfixed for over a year, exists in 59% of applications in the public sector, compared to the overall rate of 42%.

Public sector organizations tend to accumulate more security debt, with 68% of them having it, in comparison to 71% in other industries. Only three percent of applications are flaw-free in the public sector, while six percent are across other industries. Additionally, 40% of public sector entities have persistent, high-severity flaws that qualify as ‘critical’ security debt.

The report highlights that security debt in the public sector mainly impacts first-party code (93%), but a significant portion of critical security debt comes from third-party dependencies (55.5%).

For more information, you can read the report here.