Application Attack Surface

Your Applications Are Your Biggest Exposure

Web applications and APIs are the front door to your business — and the most targeted entry point for attackers. The 2025 Verizon DBIR confirms it: 88% of basic web application attacks involve stolen credentials, and vulnerability exploitation as an initial access vector rose 20% year-over-year, now rivaling credential theft.

But it's not just the applications you know about. The average enterprise runs over 2,000 applications, with more than half unsanctioned. Each one — whether it's a customer-facing portal, an internal admin panel, a third-party integration, or a forgotten API endpoint — represents attack surface that needs to be discovered, tested, and monitored.

Guard treats your applications as a distinct attack surface, with purpose-built capabilities for discovering web applications, mapping their endpoints, testing for vulnerabilities, and validating that authentication actually works.

Why Applications Deserve Their Own Attack Surface

The testing gap is enormous

Only 43% of organizations test for vulnerabilities before release. Only 20% are confident they can detect a vulnerability pre-deployment. And 50% never test applications again after they go live. Meanwhile, the average time-to-exploit for a new vulnerability has dropped to just 5 days — while critical web vulnerabilities take 35-65 days to remediate. That's a 30-60 day window where attackers are faster than defenders.

APIs are the new perimeter

87% of organizations experienced an API-related security incident in the past year. API attacks have risen 113% year-over-year in daily volume. Yet only 13% of organizations can prevent the majority of API attacks. As applications shift to API-first architectures — microservices, SPAs, mobile backends — the attack surface shifts with them. Traditional web scanners that crawl HTML don't test API authorization logic, and that's where the most dangerous vulnerabilities live.

Application sprawl creates blind spots

The average enterprise has 975 unknown cloud services running alongside 108 they actually track. 97% of cloud applications in the typical enterprise are shadow IT. Each untracked application is an untested application — and untested applications are where breaches happen.

Supply chain risk is now OWASP Top 3

The 2025 OWASP Top 10 elevated Software Supply Chain Failures to the #3 position, validated by incidents like the September 2025 npm mass compromise that affected packages with 2.6 billion weekly downloads. Your applications inherit the vulnerabilities of every library and dependency they include.

What Guard Does About It

Guard addresses the application attack surface through a layered pipeline: discover applications, map their endpoints and content, test for vulnerabilities, and validate authentication and authorization.

Application Discovery

Before you can test an application, you need to find it. Guard automatically identifies web applications running on discovered HTTP/HTTPS services:

Vespasian uses seven discovery methods running concurrently: specification parsing (OpenAPI, WSDL), protocol introspection (GraphQL, gRPC), WebSocket detection, HTML crawling, and JavaScript analysis that extracts API calls from fetch(), axios, and XMLHttpRequest patterns in client-side code.

Content Discovery and Crawling

Once applications are identified, Guard maps their complete content:

Web crawling supports multiple modes: standard crawling, directory brute-forcing for hidden paths, login page discovery, and automatic combined crawling. Crawl sessions run for up to 9 hours to ensure comprehensive coverage of large applications.

Vulnerability Testing

With the application surface mapped, Guard tests for real security issues across multiple dimensions:

Dynamic Application Security Testing (DAST)

Enterprise DAST scanning provides deep application testing with automated crawling, session management, and vulnerability verification — the kind of testing that traditionally required a dedicated security engineer.

API Security Testing

API authorization testing covers 7 of the OWASP API Security Top 10 categories:

• Broken Object Level Authorization (BOLA) — Can User A access User B's resources? Tested across read, write, and delete operations

• Broken Authentication — Are endpoints properly enforcing authentication?

• Broken Object Property Level Authorization — Can users modify properties they shouldn't have access to?

• Broken Function Level Authorization — Can lower-privilege users access admin functions?

• Unrestricted Resource Consumption — Can APIs be abused for denial of service? (GraphQL)

• Security Misconfiguration — Are APIs exposing debug endpoints, verbose errors, or unnecessary methods?

• Improper Inventory Management — Are deprecated or undocumented API versions still accessible?

Testing uses a three-phase mutation pattern for stateful vulnerabilities: setup (create a resource as the victim), attack (attempt to access or modify it as the attacker), verify (confirm whether the attack succeeded). This proves vulnerabilities rather than just detecting potential issues.

Hadrian supports REST APIs (via OpenAPI/Swagger specs), GraphQL APIs (via introspection or SDL schemas), and gRPC APIs (via Protocol Buffer definitions), with 30+ built-in security test templates and support for custom templates.

SQL Injection Testing

Autonomous Source Code Analysis

Secret and Credential Detection

Credential Testing

Guard validates whether your application's authentication is actually stopping unauthorized access:

24 supported protocols for authentication testing, including HTTP/HTTPS Basic Auth alongside SSH, RDP, SMB, database protocols, and more.

Key features:

• Default credential detection per protocol

• Rate-limited execution to avoid account lockouts

• Manual-only execution — triggered only by security operators

The Application Assessment Pipeline

Port Scanning ─→ HTTP/HTTPS services found
  │
  ├─→ Web Application Discovery ─→ Valid applications identified
  │     │
  │     ├─→ Vespasian API Enumeration ─→ Endpoints mapped
  │     │     ├─→ OpenAPI/Swagger specs parsed
  │     │     ├─→ GraphQL schemas introspected
  │     │     ├─→ WebSocket endpoints detected
  │     │     └─→ JavaScript API calls extracted
  │     │
  │     ├─→ Web Crawling ─→ Pages and directories discovered
  │     │     ├─→ Login Detection ─→ Auth mechanisms identified
  │     │     ├─→ Screenshot Capture ─→ Visual evidence collected
  │     │     └─→ Webpage Secrets ─→ Exposed credentials found
  │     │
  │     ├─→ Enterprise DAST Scanning ─→ Runtime vulnerabilities detected
  │     │
  │     ├─→ Template-Based Scanning ─→ Known CVEs and misconfigs found
  │     │
  │     ├─→ Hadrian API Testing ─→ BOLA, BFLA, auth bypasses found
  │     │
  │     └─→ SQL Injection Testing ─→ Injection vulnerabilities confirmed
  │
  └─→ Constantine Source Code Analysis ─→ Vulnerabilities proven with exploits + patches

Each phase feeds the next. Discovered applications are crawled. Crawled pages are scanned for secrets and login forms. Login forms inform authentication testing. Endpoints feed into DAST and API security testing. The result is comprehensive coverage that goes from "what's running?" to "is it secure?" automatically.

What Users See in the Platform

Web Application Inventory

Every discovered web application appears as an asset with:

• Primary URL and associated URLs

• Technology stack detection

• Authentication mechanism identification (SSO provider, basic auth, etc.)

• Screenshot for visual verification

• Associated API specification (if discovered)

Vulnerability Findings

Application security findings include:

• OWASP category — Which Top 10 category the vulnerability falls under

• Severity and confidence — How critical it is and how certain the detection is

• Full evidence — Complete HTTP request/response pairs proving the vulnerability

• Endpoint context — Which specific URL, method, and parameters are affected

• Remediation guidance — What to fix and how

Scan Management

Application scans provide:

• Real-time status tracking for long-running DAST scans

• On-demand scan triggers for specific applications

• Historical scan results with trend tracking

• Configurable scan intensity (discovery-only vs. full vulnerability testing)

Capability Summary

Guard's application attack surface coverage spans the full assessment lifecycle:

All findings flow into Guard's unified risk management system — prioritized by severity, tracked through remediation, and correlated with your external, internal, and cloud attack surface findings for a complete security picture.

Why This Matters Now

Applications are where your business logic lives, where your customers interact, and where your data flows. They're also where attackers focus their efforts — because application vulnerabilities provide direct access to the things that matter.

The organizations that discover their applications, map their APIs, and test their authorization logic continuously are the ones that find vulnerabilities before attackers do. The ones that rely on annual penetration tests and hope for the best are the ones that end up in breach reports.

Guard gives you continuous application security assessment across your entire portfolio — from discovery through testing through remediation — so your applications are as secure as your business depends on them being.