Zero-days are shifting. Web application security still sits at the centre.

Google's latest zero-day review tracked 90 exploits in the wild in 2025. Nearly half - 43 of 90 - targeted enterprise software and appliances. Browser exploitation dropped to less than 10%.

That might look like web application security is becoming less relevant. It's the opposite.

What the data shows is attackers moving across the full software stack, looking for the easiest route to access, privilege, and data. The browser is no longer the only front door. Admin paths, APIs, third-party components, build pipelines, and configuration choices are all in scope. Google's report makes the point directly: attackers pursue the most exposed and valuable assets, and they only need one point of failure.

The OWASP Top 10 for 2025 lines up with this. Broken Access Control is still number one. Security Misconfiguration has moved to number two. Software Supply Chain Failures is now number three. The most pressing application risks aren't just coding flaws anymore - they sit in how software is configured, assembled, and delivered.

This is why patching alone isn't enough. Patching matters, but it happens after exposure already exists. The stronger approach is to reduce exposure earlier and contain it faster. That means secure design, tighter access control, hardened configuration, visibility into dependencies, and protection at the application and API layer while permanent fixes are being worked through.

It's also where RedShield's model fits. We quickly apply tailored in-flight security patches to fix application-specific flaws in real time, without changing the application's code. Our team operates as an extension of the customer's security team, scanning, monitoring, and deploying protections as vulnerabilities appear. Development teams need time to remediate properly, but exposed applications can't wait for the next sprint.

For security leaders, the practical question is straightforward: are you treating your web applications and APIs as live business infrastructure? The weaknesses attackers chain together - access control failures, unsafe defaults, exposed services, insecure dependencies, gaps between discovery and remediation - are where the real risk accumulates.

Zero-days will keep coming. The more useful question is whether your web security model gives attackers time to use them.