Beyond Security Tools: Where Does 90% of the Total Cost of Web Application Security Come From?

Uncovering the Hidden 90% of Your Application Security Cost

Security leaders are often confronted by an alluring myth: purchasing advanced tools, for example Web Application Firewalls, is promoted as solving the bulk of their application security challenges. In reality, focusing primarily on tools misses a fundamental truth - tools alone represent only a small fraction of the cost and complexity inherent in effectively securing web applications.

The Hidden Costs of Tools and DIY Security Approaches

When organizations take a "DIY" approach, their security investment quickly escalates far beyond the licensing fees for the tools they use. Analysis shows that tools such as WAFs typically constitute around 10% of the total cost of comprehensive application security. The remaining 90% is consumed by:

• Building and implementing security processes: Effective application security requires mature processes for managing vulnerabilities, performing regular security audits, maintaining accurate security documentation, ensuring compliance, and governance. Developing these processes to a mature state (CMMI Level 3+) often takes several years, and large investment.  Beyond that, retaining sufficiently trained experts to conduct the processes is a continual challenge, and ongoing cost.
• Managing security tools and infrastructure: Tools need continuous tuning to balance security effectiveness and minimize disruption. Even small misconfigurations can lead to costly business disruptions, false positives, or worse - undetected breaches.  To do this well requires a level of expertise that is challenging to develop, and to retain.

   

  In addition, there is both the direct cost and the opportunity cost of developers working to remediate vulnerabilities.  Security tools primarily target technical vulnerabilities but fall short in addressing complex logic flaws that often require developer intervention on the application itself. Developers, already stretched thin by business-critical initiatives, are forced into the time-consuming, costly work of code remediation.

Real-World Cost Comparison

According to RedShield’s analysis, an organization managing security for ten web applications could spend approximately $3,700 per application per month just on threat protection, and an additional $6,200 per month on application vulnerability management and remediation tasks - most of which involves manual labour and extensive expertise, including developer time.

In comparison, RedShield’s comprehensive application security service - providing threat blocking, app-specific vulnerability remediation through RedShield-developed in-flight security patches, and mature incident response processes - often reduces these costs by around 80%.