Software is at the heart of business operations across most industries, which means application security has never been more critical. However, as organizations embrace cloud-native architectures, microservices, and open source components, the attack surface continues to expand. The result: an ever-growing number of vulnerable and malicious dependencies that adversaries are eager to exploit.

In 2025, security teams will contend with an evolving threat landscape driven by increasingly sophisticated cyberattacks, AI-powered exploits, and software supply chain compromises. This article explores the key trends shaping application security, from the growing role of AI in threat detection to the increasing adoption of software bills of materials (SBOMs).

The State of Application Security

Developers and security professionals face application security challenges of unprecedented complexity in 2025. According to Sonatype’s 2024 State of the Software Supply Chain report, open source downloads reached 6.6 trillion last year, with up to 90% of modern applications now built on open source components.

Open source software provides the foundation for innovative applications, but the growth in open source dependencies comes with a cost. The number of malicious open source packages skyrocketed by 156% year-over-year, with over 512,847 malicious packages discovered in the year to November 2024. That number will grow significantly in 2025.

Attackers increasingly target software supply chains through dependency confusion, typosquatting, and open source repository takeovers. The 2024 Open Source Malware Report found that 50% of unprotected repositories already contain cached open source malware, and shadow downloads that bypass security controls have increased by 32.8% over the past year.

Beyond targeted attacks, the persistence of outdated dependencies remains a critical issue: 80% of application dependencies have remained unpatched for over a year despite safer versions being available. Meanwhile, three years after the infamous Log4Shell exploit, 13% of Log4j downloads are still vulnerable.

Accelerating DevSecOps: Cultural (Read more...)