Software development processes such as DevSecOps have helped to improve the security of developers' code. However, these same development processes also emphasize speed and efficiency to keep up with business demands. As a result, developers are relying on components that borrow features and functions from existing projects and libraries. The study shows that 83 percent of respondents use either commercial or open source components, with an average of 73 components per application.

These components increase the efficiency of developers and their use is considered best practice. However, they are also associated with inherent security risks. On average, 71 vulnerabilities were identified per application that can be traced back to such components. Nevertheless, only 23 percent of respondents stated that they test components for vulnerabilities with every release. This may be due to the fact that only 71 percent of companies have a formal application security (AppSec) program in place.

In addition, only 53 percent of organizations maintain an inventory of all components in their applications. And according to the 2017 State of Software Security Report (SoSS), less than 28 percent of organizations perform regular composition analysis to track components.

"We know that developers care about writing not only good code, but secure code," says Pete Chestna, Director of Developer Engagement, CA Veracode. "But they can't do that without the right tools. When we provide them with these tools, they can integrate the security of the components they use directly into their development process. As a result, we see a significant improvement in secure software development."

The study also shows that development (44 percent) or security teams (31 percent) are most likely to be responsible for maintaining third-party commercial and open source components. This suggests that responsibility is increasingly being transferred to the development team. As awareness of open source risk continues to grow, providing solutions, training and transparency to mitigate risk is becoming an important component of the Modern Software Factory development approach.

The full study, produced in collaboration with Vanson Bourne, can be found here.