Gartner Hype Cycle for Application Security 2023

Gartner Hype Cycle for 2023 assesses the levels of maturity, adoption, and societal effects associated with emerging technologies in the field of Application Security. 

The 2023 report serves as a valuable resource for organizations seeking insights into the influence of security technologies on their applications. It also highlights the market leaders in the respective fields – Appknox being this year’s leading vendor in mobile application security testing.

Appknox has consistently featured among notable vendors for Gartner, with a recent recognition in DevSecops tools for secure software delivery.

This blog will focus on the essential takeaways from the 2023 Gartner Hype Cycle report, specifically concerning Application Security Testing (AST) – a critical technology trend. 

Let’s begin by introducing the 2023 Gartner Hype Cycle for AST.

What is Gartner Hype Cycle?

Gartner Hype Cycle is a graphical representation and methodology developed by the research and advisory firm Gartner Inc. It provides a way to track and understand the adoption and maturity of emerging technologies and trends over time. The Hype Cycle highlights the typical stages that technologies or concepts go through as they evolve from early inception to mainstream adoption and sometimes decline.

The key stages in Gartner Hype Cycle are as follows:

1. Innovation Trigger: This is the starting point of the cycle. It represents the point at which a new technology or trend is introduced or discovered, generating initial excitement and interest.

2. Peak of Inflated Expectations: As the technology gains attention and hype, expectations about its potential benefits tend to skyrocket. During this phase, media coverage and marketing hype are at their peak, and there may be an overestimation of the technology’s potential impact.

3. Trough of Disillusionment: As reality sets in and the initial promises face challenges and limitations, the technology often enters a period of disillusionment. This phase is characterized by a decrease in interest and sometimes skepticism about the technology’s practicality and viability.

4. Slope of Enlightenment: Some technologies find more practical and productive applications after passing through the Trough of Disillusionment. Learning from initial failures, the technology begins to mature, and organizations gain a better understanding of its true value.

5. Plateau of Productivity: In this final phase, the technology reaches a state of widespread adoption and becomes integrated into mainstream practices. Its benefits are well-understood, and it becomes a stable and reliable solution.

Gartner Hype Cycle is not only applicable to technological innovations but can also be used to analyze the maturity and adoption trends of various other concepts or trends, such as emerging business models, societal changes, and more. It is a valuable tool for organizations, businesses, and decision-makers to identify and understand where a technology or trend stands in terms of its lifecycle and potential impact.

Key Highlights From the 2023 Gartner Application Security Hype Cycle

Application security, driven by the mature and widely adopted DevSecOps discipline, continues to face challenges in various organizations. However, promising innovations are emerging to tackle these issues. 

For instance, application security posture management (ASPM) enables the implementation of DevSecOps policies. A recent innovation, policy as code (PaC), empowers security teams to enforce security policies and auditing controls effectively. Another notable development is the recognition of secure code training as a standalone discipline, emphasizing the importance of skill development.

As businesses transition their applications to the cloud, they require comprehensive tools that span development to runtime, covering both application and infrastructural aspects. 

Cloud-native application protection platform (CNAPP) tools exemplify this by offering integrated container and infrastructure as code scanning, cloud security posture management (CSPM), and runtime workload protection. The focus on API threat protection addresses the architectural aspect of modern applications, which heavily rely on APIs.

The increasing prevalence of software supply chain attacks highlights the need for software supply chain security (SSCS). This evolving discipline encompasses various concepts, including securing development environments, software composition analysis (SCA), and software bills of materials (SBOMs).

Appknox Recommended Reading: Benefits of SBOM in Software Supply Chain Security

Generative AI poses a dual role in application security. While it facilitates attacks by malicious actors, it also aids organizations in enhancing security through innovations like secure code assistants and generative cybersecurity AI. These technologies automate tasks such as identifying and remedying application vulnerabilities.

Securing not just homegrown applications but also third-party and SaaS applications is becoming a pressing concern. To address this, SaaS security posture management (SSPM) solutions offer robust security posture and identity controls. As the application security landscape evolves, these innovations play a vital role in safeguarding digital assets from potential threats.

What are the Transformational Innovations in Gartner Hype Cycle 2023?

In this year’s Application Security Hype Cycle by Gartner, there are seven transformational innovations. Among these, three have garnered significant hype and are now being adopted by organizations benefiting from their implementation and striving to adapt them to their specific contexts.

Security Service Edge (SSE): SSE is responsible for securing user access to web services, cloud services, and private applications. It offers adaptive access control, data security, and enhanced visibility.

Application Security Posture Management (ASPM) Tools: ASPM tools help manage application risk by collecting, analyzing, and prioritizing security issues. They enable the enforcement of security policies and facilitate the remediation of identified vulnerabilities.

Software Supply Chain Security (SSCS): SSCS refers to the set of processes and tools used to curate, create, and consume software in ways that mitigate attacks against software and prevent it from becoming an attack vector.

Two recently emerged innovations are rapidly evolving:

Code Security Assistants: These utilize artificial intelligence to aid developers in identifying and resolving security vulnerabilities present in their code.

Generative Cybersecurity AI: This innovation streamlines and accelerates various cybersecurity tasks, such as reporting and code remediation, through the application of AI technologies.

What Innovations Are Off the Hype Cycle This Year?

Several innovations have been excluded from this year’s Hype Cycle. Some, like web application firewall appliances, have already achieved full maturity. Others, such as enterprise app stores, DevOps test data management, externalized authorization management (EAM), privacy by design, and digital product analytics, are still in the process of maturing and are featured in different Hype Cycles. 

Nevertheless, due to the revised scope of the Hype Cycle for Application Security and the introduction of new innovations this year, they have been omitted from this particular Hype Cycle.

Mobile Application Security Testing: Still a Long Way To Go

According to this year’s Hype Cycle report, with only 20-50% market penetration and a lot of scope ahead, mobile application security testing is still a very high-priority innovation in the application security landscape. Gartner’s Dionisio Zumerle further highlights that being in the early mainstream maturity stage, mobile application security testing still has a long way to go.

Mobile applications play a crucial role in a company’s digital transformation. It is imperative to ensure that these apps are free from vulnerabilities that could be exploited, as this is vital for facilitating the transformative journey. Mobile Application Security Testing (AST) largely employs techniques similar to traditional AST but is tailored for the mobile device environment and its agile development processes.

What Are the Key Business Impacts Associated With Mobile Application Security Testing?

Mobile Application Security Testing (AST) is utilized by various stakeholders within an organization, depending on its structure. This includes security and application development teams; in some cases, it may also be directly employed by line-of-business departments. 

While security testing is crucial for any organization delivering mobile applications, industries subject to regulations and high-security requirements, such as financial services, healthcare, and online retail, have a greater sense of urgency to embrace mobile AST.

What Are the Key Drivers and Obstacles for Mobile Application Security Testing?

Key Drivers:

• Organizations that employ mobile applications necessitate Mobile Application Security Testing (AST) specifically tailored for mobile environments. Mobile AST tools must be capable of supporting mobile-specific programming languages and frameworks. Additionally, they should be able to identify both traditional application vulnerabilities and mobile-specific ones, such as unsecured storage and hard-coded credentials.
• Many organizations already implementing AST for their web applications seek a faster, more cost-efficient alternative specifically designed for mobile AST.
• The OWASP Mobile Application Security Verification Standard (MASVS) has introduced a comprehensive set of requirements for mobile application security testing, aiding both mobile AST vendors and practitioners in better understanding mobile AST needs.
• Conducting mobile AST can streamline the approval and publication of apps in commercial app stores. For example, through the App Defense Alliance (ADA) Mobile Application Security Assessment (MASA), Google recognizes mobile apps that have undergone independent security testing against MASVS Level 1 requirements.
• With the frequent use of open-source software (OSS) components and software development kits (SDKs) in mobile applications, vulnerabilities often arise from third-party code. As the usage of software bill of materials (SBOMs) gains traction, the ability of mobile AST to assess third-party code becomes increasingly crucial.
• While mobile AST products are primarily used for homegrown apps, some enterprises utilize them for application vetting. This allows organizations to identify leaky or malicious apps. Such use cases are also often addressed by mobile threat defense product offerings.

Key Obstacles:

• The methods used in mobile AST are the same ones that have been used for years to test web-based applications: static AST (SAST), dynamic AST (DAST), software composition analysis (SCA), and interactive AST (IAST).
• But when testing is done on mobile apps, it needs to be modified and adapted to find bugs in the client-side code. Even though mobile platforms are changing more slowly than they used to, they are still changing. Because of this, mobile AST has not yet hit full maturity.
• Many companies have under-developed application security programs and don’t yet test code for mobile apps. In many cases, the main source of risk is in the back end. Including mobile app code in the application security program makes it even more critical.

Appknox Has Been Named a Vendor in Mobile Application Security Testing in Gartner 2023 Hype Cycle for Application Security

Appknox offers one of the most advanced plug-and-play mobile application security testing solutions embedded with innovative vulnerability assessment and penetration testing tools which help security experts and developers build the safest mobile applications. 

Experience the power of our industry-leading Vulnerability Assessment (VA) tools, expertly enhanced by our skilled pentesters. Discover and address security vulnerabilities and software defects at the earliest stages of development. With our advanced security test cases, rest assured that your application software is resilient, trustworthy, and meets all necessary compliance standards.

Eager to get started? Book our free trial to understand why Gartner recommends Appknox and enhance your journey in the mobile app security curve.

Final Thoughts: Empowering Mobile App Owners to Stay Ahead in the Evolving Threat Landscape

Alongside the possibilities and potential risks, each technological breakthrough is often surrounded by a wave of hype. 

Throughout the various stages of the hype cycle, making informed decisions can enable the effective adoption of the technology when it aligns with your unique use case and business needs. Given the ever-evolving threat landscape, informed decision-making becomes even more critical for mobile application security. 

Gartner also suggests the following best practices for mobile app owners:

• Begin by conducting mobile Application Security Testing (AST) for your workforce- and consumer-facing mobile apps. Prioritize testing for critical applications, particularly those operating in untrusted environments, employing software logic on the client side, and containing transactional or valuable intellectual property (IP).
• Evaluate whether your current AST vendor offers adequate mobile AST capabilities, either directly or through partnerships. Traditional AST selection criteria still apply, but specifically for mobile, you can refer to the OWASP Mobile Application Security Verification Standard (MASVS) as a practical guide to assess a solution’s technical capabilities and coverage.
• If your current AST vendor lacks mobile AST capabilities or needs a specialized, lightweight, and faster product, explore offerings from dedicated mobile AST vendors. This will ensure comprehensive testing and security assessment for your mobile applications.

Unlock the power of best practices for your applications with Appknox security experts – consult today!

Frequently Asked Questions (FAQs)

1. What Are the 5 Phases of the Gartner Hype Cycle?

The five phases of the Gartner Hype Cycle are as follows:

• Innovation Trigger: This is the starting point of the cycle. It represents introducing or discovering a new technology or trend that generates initial excitement and interest.
• Peak of Inflated Expectations: In this phase, the technology or trend gains significant attention, and expectations about its potential benefits soar to unrealistic levels. There is often a lot of media coverage and hype during this stage.
• Trough of Disillusionment: Reality sets in as the initial hype subsides, and the technology faces challenges and limitations. During this phase, there might be a decline in interest and skepticism about the technology’s practicality.
• Slope of Enlightenment: After passing through the Trough of Disillusionment, some technologies find more practical and productive applications. Organizations better understand the technology’s true value and its benefits become clearer.
• Plateau of Productivity: In this final phase, the technology reaches a state of widespread adoption and becomes integrated into mainstream practices. It becomes a stable, reliable solution with well-established best practices and use cases.

2. What Is Gartner Hype Cycle Used For?

The key uses of the Gartner Hype Cycle are:

• Technology Assessment: The Hype Cycle helps organizations assess the potential benefits and risks of adopting specific technologies. It provides a framework for understanding where technology stands in terms of its maturity and market acceptance.
• Strategic Planning: Businesses can use the Hype Cycle to develop strategic plans and roadmaps for adopting new technologies. It helps them identify which technologies are relevant to their industry and business objectives.
• Risk Management: Understanding the Hype Cycle allows organizations to evaluate the potential risks associated with the early adoption of technologies that may still be in the “Peak of Inflated Expectations” phase.
• Innovation Management: The Hype Cycle allows companies to keep track of emerging innovations and trends, helping them stay ahead of competitors and capitalize on new opportunities.
• Investment Decision-making: By understanding the Hype Cycle, investors and venture capitalists can make more informed decisions about funding startups and projects related to emerging technologies.
• Market Research: The Hype Cycle is a valuable methodology for market researchers and analysts to assess the potential growth and demand for specific technologies in different industries.

3. How Is Gartner Hype Cycle Critical for Mobile Application Security Testing?

The Gartner Hype Cycle is critical for mobile application security testing (AST) as it provides valuable insights and guidance for organizations looking to adopt and implement effective security measures for their mobile apps. Here’s how the Hype Cycle is essential for mobile application security testing:

• Technology Evaluation: The Hype Cycle allows organizations to assess various mobile AST technologies, tools, and vendors available in the market. It helps them understand the maturity and potential of these solutions, making it easier to choose the most suitable ones for their specific needs.
• Identifying Trends: The Hype Cycle highlights emerging trends and innovations in mobile AST. It informs organizations about the latest advancements, allowing them to stay ahead of security threats and adopt cutting-edge practices.
• Strategic Planning: The Hype Cycle helps develop strategic plans for mobile AST adoption. It allows organizations to time their investments and implementations effectively, ensuring they are prepared to address security challenges and threats proactively.
• Vendor Selection: The Hype Cycle assists in evaluating mobile AST vendors and their offerings. Organizations can use this information to choose reliable and trustworthy vendors at the forefront of mobile application security technology.
• Market Insights: Understanding the Hype Cycle gives organizations a broader understanding of the mobile AST market. They can identify market leaders, track emerging technologies, and make data-driven decisions about their security initiatives.