For almost all organizations, data is what matters most. Payment and financial data, patient health information, personally identifiable information (PII), and intellectual property all need to be identified and secured. Often, applications are the main assets that store, process, and transmit such data.

Modern applications rarely involve a single component. It is common for an application to encompass multiple components, such as an application server, a web server, and a database server. Securing an application means securing the full stack: all components must be identified and secured, especially those that are exposed to end users and therefore cannot be protected by means of network security controls.

Security assessments can be conducted on all types of applications and their components, including:

• Web applications
• Mobile apps
• Application Programming Interfaces (APIs)
• Databases
• Client-server applications
• Chatbots
• Voice assistants

By mapping the attack surface of applications, security assessments allow to identify vulnerabilities and exposures and ensure integration of best practice security controls for the protection of mission-critical data.