REPORTState of Application
Security 2024

Table of contents

Table of Contents

3

Executive Summary

4

Key app security findings

5
6

Scope and report methodology
Trends in mitigated traffic

17

Data snapshot: Third-party scripts and cookie usage
18
19

7

Data snapshot: Mitigated traffic over time

20

8

Business considerations and recommendations

21

9
10
11

Zero-day trends
Business considerations and recommendations
DDoS attack trends

12

Data snapshot: Largest HTTP DDoS attacks

13

Business considerations and recommendations

15

Client-side risks
Business considerations and recommendations
Shadow API risks
Business considerations and recommendations
Conclusion

22

How Cloudflare can help

23

Learn More24

Appendices
Glossary of key Cloudflare terms

25

Endnotes

Bot traffic trends
Data snapshot: Industries with high bot traffic

16

Business considerations and recommendations

Cloudflare | State of Application Security 20242

Table of contents

Executive Summary

Web applications are central to modern life. For
governments, they are an important channel
to communicate information to the public andprovide essential services. For businesses,
they serve as a source of revenue, efficiency,
and customer insights.

For instance, the increasing speed and volume of
DDoS attacks indicates that botnets are becoming
more common and more efficient at launching DDoS
attacks — the No. 1 attack type against web apps. Is
your team equipped to detect and stop traffic frommalicious botnets comprising hundreds of thousands— or even millions of machines?

However, the apps and application programming
interfaces (APIs) that move critical data, processes,
and infrastructure also represent an expanding attack
surface. Exploited, unprotected apps can lead tobusiness disruptions, financial losses, and criticalinfrastructure collapses.

Additionally, certain industries face a bigger share of
bot traffic. Other industries find themselves targetedby a high volume of DDoS attacks. How quickly can
you respond to those threats to avoid financial losses
and reputation damage?

The demand for developers to quickly deliver new
features — such as capabilities driven by large
language models (LLMs) and generative AI —magnifies this problem.
Powered by one of the world’s largest networks,
Cloudflare on average serves over 57 million HTTP
requests per second, and blocks 209 billion cyberthreats each day as of Q1 2024. The volume, velocity,and variety of this traffic informs the insights exploredin this State of Application Security 2024 report.

Cloudflare | State of Application Security 2024

However your organization approaches app security,
we hope this report can guide where to prioritize
future app security controls — without stifling digital
innovation.

Cloudflare also found that enterprise organizations
use an average of 47.1 third-party scripts, as of May
2024. Is your organization inadvertently exposing yourend users to supply chain risks?
As new app risks exceed the resources of dedicatedapp security teams, more organizations recognize
the need for a different approach. Gartner® predicts
that, “By 2027, 30% of cybersecurity functions
will redesign application security to be consumed
directly by non-cyber experts and owned byapplication owners.”

3

Table of contents

Key app security findings
Data collection period: Unless otherwise stated in the endnotes, the time frame evaluated in this reportis the 12-month period from April 1, 2023 through March 31, 2024 inclusive.

#1 attack type
Distributed denial-of-service(DDoS) attacks remain oneof the most common attack
types against web applications,comprising 37.1% of all app-layer
traffic mitigated by Cloudflare.1

Outdated approaches
to API security
Traditional web application
firewall (WAF) rules are mostoften used to protect API traffic5;
however, traditional WAF negative
security model approaches are
not sufficient to protect against
modern API threats.

Cloudflare | State of Application Security 2024

Rapid CVE
weaponization

Trust in thirdparty code

93% of bots arepotentially malicious

Cloudflare observed an
attempted exploitation of a
new zero-day vulnerability just
22 minutes after its proof-ofconcept (PoC) was published.2

Enterprise organizations use on
average 47.1 third-party scripts —and their web applications makean average of 49.6 outboundconnections to third-party resources.3

One-third (31.2%) of all trafficstems from bots—the majority(93%) of which are unverified andpotentially malicious.4

Cookie consent risksEnterprise websites use an averageof 11.5 HTTP cookies and a medianof 5 cookies.6 These HTTP cookies
may expose end-users to privacy
risks that application owners are
responsible for monitoring andminimizing.

4

Table of contents

KEY APP SECURITY FINDINGS

Scope and report methodology
At a broad level, Cloudflare mitigated 6.8% of all web application traffic
during the data collection period.7 “Mitigated” traffic is defined as any trafficthat is blocked or is served a challenge by Cloudflare (see the Glossary forthe full technical definition). The specific threat type and relevant mitigation
technique depends on many factors, such as the application’s potential
security gaps, the nature of the victim’s business, and the attacker’s goals.
Some examples of attacks on web applications and APIs in 2023-2024
included:•••

The Anonymous Sudan group launched politically motivated DDoS attacks
against banks, universities, hospitals, airports, social media platforms,
government agencies, and others worldwide.
Cloudflare observed a record-breaking DDoS attack exploiting avulnerability in the HTTP/2 protocol, launched by a botnet of only 20,000
machines that rotated IPs to avoid mitigation.
T-Mobile disclosed in early 2023 that it experienced a data breach of 37
million customer accounts via an exploited API.

In other words: the varied nature of such attacks makes web application
security a broad discipline that nonetheless requires specialized tools to stop
specialized attacks.

To cover such a wide scope, this report is based on aggregated traffic
patterns (observed from April 1, 2023 - March 31, 2024) across the Cloudflareglobal network, including services that:
•

•

•

•

•

•

Filter HTTP traffic between a web application and the Internet to stop a wide
range of real-time attacks using a variety of security measures(Web Application Firewall)
Mitigate DDoS attacks targeting Domain Name System (DNS) servers(Advanced DDoS Protection)
Act as an intermediary to accept, transform, route, and manage all API calls(API Gateway)
Monitor third-party dependencies in a web application that loads in the client
browser and exposes the end user to risk
(Page Shield)
Identify bot activity, bot reputation, bot origin, and other bot behaviors(Bot Management)
Block users, bots, or applications from over-using or abusing a web property(Rate Limiting)This data and threat intelligencefrom Cloudflare’s network has
been complemented by thirdparty sources, which readers
can access using the inline links.
Cloudflare | State of Application Security 20245

Table of contents

Trends in mitigated traffic
Compared to the prior 12-month period, Cloudflare mitigated a higher
percentage of application layer traffic and layer 7 (L7) DDoS attacks(6.8% vs. 6%) between Q2 2023 and Q1 2024.8
WAF product mitigations also took over as the No. 1 mitigation technique —a spot that DDoS protections previously held.
This change in mitigation rankings may be due to more enterprises using WAF
rules to block brute-force attacks or credential stuffing and prevent sensitive datafrom being exfiltrated from apps, or using Cloudflare’s machine learning to blockzero-day vulnerability exploit attempts before disclosure.
WAF rules also include custom rules, which help enforce organizational policy
and perform other custom mitigations.
Some common use cases for custom rules include:•

Allowing traffic from search engine bots•

Allowing traffic from specific countries only•

Challenging bad bots•

Configuring token authentication•

Requiring a specific cookie

Figure 1: Mitigated traffic by Cloudflare product group9

53.9%

0.1%

(includes identification of
volumetric attacks, credential
stuffing, uploaded malware,sensitive data exfiltration,and more)

1.7%

WAF and Bot mitigations

37.1%

HTTP DDoS rules

Other

Access rules

7.2%

IP Reputation

Definitions of these mitigation types
can be found in the glossary section.
Cloudflare | State of Application Security 2024

6

Table of contents

TRENDS IN MITIGATED TRAFFIC

Data snapshot: Mitigated traffic over time
Cloudflare observed an overall increase in mitigated traffic (and by extension, attacks) in the 12-month period leading up to March 31, 2024.
We also saw a spike in attack traffic in January of 2024 this year, and a lower spike during the winter holidays than expected.

Figure 2: Percent of mitigated HTTP traffic on Cloudflare’s global network between Q2 2023 - Q1 202410
11

Percentage

10
9
8
7
6
5
May 2023

Jul 2023

Sep 2023

Nov 2023

Jan 2024

Mar 2024

Time

Cloudflare | State of Application Security 2024

7

Table of contents

MITIGATION METHODSBusiness considerations and recommendations

App traffic shows no signs of decelerating as businesses continue tomodernize legacy apps or release new apps:•

To improve application performance for globally distributed data and users•

To migrate legacy apps to the cloud, hybrid, or multi-cloud environments•••

To augment the user experience with AI-driven insights, recommendations,and information
To modernize back-office processes and functions
To build development pipelines from a variety of different tools so thatdevelopers can focus on coding

Recommendations
To help reduce costs associated with scaling infrastructure to serve
application growth, organizations should consider serving application
content and mitigating attacks at the edge. (A group of Cloudflarecustomers self-reported that they saved an average of about 30% on
infrastructure costs by serving and mitigating traffic at the edge).11

Business-driven app development cannot slow down; therefore, the need toblock, challenge, and throttle (i.e., mitigate) malicious or unwanted web app
traffic will likely grow.

Cloudflare | State of Application Security 20248

Table of contents

Zero-day trends

Zero-day exploits (also called zero-day threats) are increasing, as is the speedof weaponization of disclosed CVEs.
•

97 zero-days were exploited in the wild in 2023•

The number of disclosed CVEs between 2022 and 2023 increased by 15%•

More than 5,000 critical vulnerabilities were disclosed in 2023, yet the meantime to release a patch for a critical severity web application vulnerability is
35 days

Looking at CVE exploitation attempts against customers, Cloudflare mostly
observed scanning activity, followed by command injections, and some
exploitation attempts of vulnerabilities that had PoCs available online (e.g.,
Apache, Coldfusion, MobileIron).12
This trend in CVE exploitation attempt activity indicates that attackers aregoing for the easiest targets first, and likely having success in some instances
given the continued activity around old vulnerabilities.
The speed of exploitation of disclosed CVEs is often quicker than the speed
at which humans can create WAF rules or create and deploy patches tomitigate attacks.

Cloudflare | State of Application Security 2024

For instance, when Cloudflare observed exploitation attempts of CVE-2024-27198
at 19:45 UTC on March 4, it had taken attackers just 22 minutes after proof-ofconcept code was published.

CVE-2024-27198 Vulnerability Timeline | March 4th
14:00 UTC
Jetbrains releases
Teamcities 2023.11.4 update

19:23 UTC
Rapid7 shares a blog, including
proof-of-concept exploitation

14:59 UTC
Jetbrains publicly discloses
CVE-2024-27198

19:45 UTC
Cloudflare observesattempted exploitation

9

Table of contents

ZERO-DAY VULNERABILITIESBusiness considerations and recommendations

By definition a zero-day is a vulnerability for which there is not a patch in place.
A race occurs after disclosure between security professionals trying to defend
applications and attackers trying to exploit applications.
The faster novel attack vectors can be detected and mitigated before theycause an issue, the more time internal teams have to patch and remediate theunderlying vulnerability. However, sometimes CVE patches are not available forhours (or days or months).

Recommendations
Resource-strapped organizations should prioritize high-risk and activelyexploited vulnerabilities first, while also using a WAF deployment thatprovides automatic rule updates to cover applications that cannot bepatched quickly enough.
WAF machine learning (ML) models make it easier to block some zero-day
exploits before they are made public and vulnerabilities disclosed.
For example, certain Sitecore CVEs initially disclosed in June 2023 were
not initially identified by Cloudflare Managed Rules — but they werecorrectly detected and classified in ‘zero time’ by our machine learningbased classifiers. Cloudflare also blocked the Ivanti Connect Securevulnerability before the vulnerability had even been publicly disclosed.

Cloudflare | State of Application Security 202410

Table of contents

DDoS attack trends
Figure 3: Volume of application DDoS attacks over time13
Worldwide - Data ranges from 2023-04-01 to 2024-03-31

Daily Requests

250B
200B
150B
100B
50B
May 2023

Jul 2023

Sep 2023

Nov 2023

Jan 2024

Mar 2024

Time

DDoS attacks remain the most common attack type against web applications,with DDoS comprising 37.1% of all mitigated application traffic (see Figure 1).9

Specifically, application layer HTTP DDoS attacks increased by 93% YoY and 51%
quarter-over-quarter (QoQ).14

We saw a large increase in volumetric attacks in February and March of 2024.13
In this first quarter of 2024 alone, Cloudflare’s automated defenses mitigated
4.5 million DDoS attacks — an amount equivalent to 32% of all the DDoS attacks
Cloudflare mitigated in 2023.

As an example, Cloudflare observed a 466% increase in DDoS attacks on Sweden
after its acceptance to the NATO alliance on March 7, 2024. This mirrored the
DDoS pattern observed during Finland’s NATO acceptance in 2023.15 The size of
DDoS attacks themselves are also increasing, as illustrated on the next page.

Cloudflare | State of Application Security 202411

Table of contents

DDOS ATTACKS

Data snapshot: Largest HTTP DDoS attacks

In 2023, Cloudflare mitigated a hyper-volumetric DDoS attack that peaked at
201 million requests per second (rps) – three times larger than any previouslyobserved attack.16

Figure 4: Largest HTTP DDoS attacks as seen by Cloudflare, by year

In the “HTTP/2 Rapid Reset” attack, threat actors exploited a zero-day
vulnerability in the HTTP/2 protocol, which is critical to how the Internet and all
websites work.

Year

The vulnerability exploit’s potential to incapacitate nearly any server or application
supporting HTTP/2 underscored how menacing DDoS vulnerabilities are forunprotected organizations.

2019

3M rps2020

8M rps

2021
2022

17M rps
26M rps2023
0M rps201M rps
50M rps

100M rps

150M rps

200M rps

Million requests per second

Source: Cloudflare’s DDoS threat report for 2023 Q417

Cloudflare | State of Application Security 202412

Table of contents

DDOS ATTACKSBusiness considerations and recommendations
HTTP/2 Rapid Reset and other large DDoS attacks illustrate that DDoS attacks
are being launched more efficiently by botnets.
For example, cyber crime groups on the dark web offer DDoS-as-a-service forinexpensive prices, even offering “subscribe and save” bundles and support
tiers.
Many sites offering DDoS-as-a-service charge as little as $10 USD for a DDoS
attack that lasts an hour as of 2023, or $35-170 USD for a full day use of theirbotnets.
Given how simple it has become for attackers to launch DDoS campaigns,
businesses in the following industries should be particularly vigilant aboutmaintaining advanced DDoS protections.

Cloudflare | State of Application Security 2024

Figure 5: Top industries experiencing L7 DDoS attacks
as a share of all Internet traffic18

1

Gaming and gambling2

IT and Internet

3

Cryptocurrency

4Computer Software

5

Marketing and Advertising

6

Telecommunications

7

Retail8Adult Entertainment

9Banking, Financial Services, and Insurance

10

Manufacturing

13

Table of contents

DDOS ATTACKSBusiness considerations and recommendations(continued)

For DDoS protection provided by a public cloud, a cloud provider typicallysits in front of an organization’s applications and infrastructure and diverts all
traffic to a scrubbing center to be “cleaned.” Only legitimate traffic is sent backto the customer.
This motion can be activated either ‘on-demand’ or ‘always-on.’ However, there
are usually limitations:••On-demand cloud scrubbing relies on human intervention, adding time tothe mitigation response. Providers may also charge per byte of attack traffic,
which is costlier over time.
Many always-on DDoS vendors rely on distant scrubbing centers that can
introduce latency and noticeable delays.

Recommendations
To realize the full benefits of cloud-based DDoS defense, look for ascalable, “always-on” service with these capabilities:• Automatic absorbing of malicious traffic as close as possible to theattack origin, to reduce end-user latency and business downtime• Unmetered, unlimited DDoS attack mitigations, without charging
penalties for spikes in attack traffic• Centralized autonomous protections against all DDoS attack types

Cloudflare | State of Application Security 2024

14

Table of contents

Bot traffic trends
On average, bots comprise one-third (31.2%) of all application traffic processedby Cloudflare.19 This percentage has stayed relatively consistent (hovering at about30%) over the past three years.

••

Business disruption: Bots can scrape or download content from a website,
rapidly spread spam content, or hoard your online inventory
Data theft and account takeover: Bots can steal credit card data, login
credentials, and take over accounts

The term bot traffic may carry a negative connotation, but in reality bot traffic is
not necessarily good or bad; it all depends on the purpose of the bots. Some are“good” and perform a needed service — such as customer service chatbots andauthorized search engine crawlers. But some bots misuse an online product orservice and need to be blocked.

Data snapshot: Industries with high bot traffic

Different application owners may have different criteria for what they deem a“bad” bot. For example, some organizations may want to block a content scraping
bot that is being deployed by a competitor to undercut on prices, whereas anorganization that does not sell products or services may not be as concerned with
content scraping. Known, good bots are classified by Cloudflare as “verified bots.”

Figure 6: Industries with the highest median daily share of bot traffic21

Attackers leveraging bots focus most on industries that could bring themhigh financial gains.

Manufacturing/Consumer Goods
Cryptocurrency

However, the vast majority (93%) of bots we identified were unverified bots, andpotentially malicious.20

Bad bots — if left unchecked — can cause massive problems:•Performance impact: Too much bot traffic can put a heavy load on web servers,
slowing or denying service to legitimate users.

Cloudflare | State of Application Security 2024

64.8%

Security and Investigations

52.2%

Computer and Network Security
Industry

Unverified bots are often created for disruptive and harmful purposes, such as
hoarding inventory, launching DDoS attacks, or attempting to takeover an accountvia brute force or credential stuffing. (Verified bots are those that are known to besafe, such as search engine crawlers).

68.5%

48.2%

US Federal Government

45.9%

Pharmaceuticals

43.4%
41.2%

Research
Music

39.1%

Oil and Energy

36.9%

Leisure, Travel and Tourism

35.7%
0%

20%

40%

60%

70%

Median daily share of bot traffic to websites

15

Table of contents

BOT TRAFFICBusiness considerations and recommendations

As shown in the prior graph, when we analyzed which industries have thebiggest bot problem, we found manufacturing and consumer goods deal with astaggering 68.5% of all traffic to their websites originating from bots.21
Our findings reinforce what has also been observed by retailers in the consumer
goods industry (for example, inventory hoarding bots buying up shoes or gaming
consoles before humans get a chance to put the items in their carts), damaging
brand trust. On the other hand, industries that sell fewer physical goods online,
such as insurance or hospitality, deal with a bot percentage closer to the Internet
average of 31.2%.21

Recommendations
If your industry tends to experience more bot traffic, consider boosting
investments in bot management to preemptively stop credential
stuffing, content scraping, content spam, inventory hoarding, and otherthreats from bad bots.
Look for a bot management service that:• Accurately identifies bots at scale by applying behavioral analysis,
machine learning, and fingerprinting to a diverse and vast volume ofdata• Integrates easily with your other web application security andperformance services (e.g., WAF, CDN, DDoS)• Allows good bots, such as those belonging to search engines, to keep
reaching your site while preventing malicious traffic

Cloudflare | State of Application Security 202416

Table of contents

Client-side risks
Most organizations’ web apps rely on separate programs or pieces of codefrom third-party providers (usually in JavaScript). The use of third-party scripts
accelerates modern web app development and allows organizations to shipfeatures to market faster, without having to build all new app features in-house.

Data snapshot: Third-party scripts and cookie usage
In fact, Cloudflare’s typical enterprise customer uses an average of 47.1 thirdparty scripts, and a median of 20.0 third-party scripts.22 The average is muchhigher than the median due to SaaS providers, who often have thousands of
subdomains. Here are some of the top third-party scripts Cloudflare customers
commonly use:23
Google (Tag Manager,
Analytics, Ads, Translate,reCAPTCHA, YouTube)• Meta (Facebook Pixel,
Instagram)• Cloudflare (Web Analytics)•

jsDelivr• New Relic• Appcues• Microsoft (Clarity, Bing,
LinkedIn)• jQuery•

WordPress• Pinterest• UNPKG• TikTok• Hotjar•

While useful, third-party software dependencies are often loaded directly by theend-user’s browser (i.e. they are loaded client-side) — placing organizations andtheir customers at risk given that organizations have no direct control over theirsecurity measures. For example, in the retail sector, 18% of all data breaches
originate from Magecart style attacks, according to Verizon’s 2024 Data Breach
Investigations Report.

Cloudflare | State of Application Security 2024

On average, each website has 49.6 connections to JavaScript functions andtheir destinations, and a median of 15.0.24 Each of those connections also posesa potential client-side security risk.
Here are some of the top third-party connections Cloudflare customers
commonly use:25
Google (Analytics, Ads)
• Microsoft (Clarity, Bing,
LinkedIn)• Meta (Facebook Pixel)•

Hotjar• Kaspersky• Sentry• Criteo•tawk.to• OneTrust• New Relic• PayPal•On average, our customers’ websites used 11.5 cookies and a median of fivecookies. One organization alone used 131 cookies.26 Similar to third-party scripts
and connections loaded in the browser, cookies also come with both client-siderisks and compliance risks. Specifically, cookies can expose website visitors tosecurity risks such as cookie tampering, in which an attacker modifies clientside cookies to perform attacks such as session hijacking in pursuit of accounttakeover or fraud.
While third-party scripts and cookies are here to stay, web application
owners are increasingly responsible for the risk these scripts can expose
their end users to — not to mention the complianceand liability implications.

17

Table of contents

CLIENT-SIDE RISKSBusiness considerations and recommendations

Attackers can gain access to modify the code of JavaScript components
used in websites in a variety of ways, such as using stolen accountcredentials or exploiting zero-day or unpatched vulnerabilities. Then, they
use this privileged access to launch a downstream attack on every website
using that JavaScript code.
According to new mandates from PCI DSS 4.0, which will take effect in March
2025, organizations with a payment page are required to monitor third-party
script attacks and protect their end-users from browser supply chain attacks.
Cookies also come with client-side and compliance risks (such as cookie
tampering, as noted earlier) – if an organization fails to meet user privacy
expectations.

Recommendations
As with client-side scripts, website administrators, developers, orcompliance team members do not always know what cookies are being
used by their website.
Therefore, look for a service that automatically neutralizes third-party
script risks, and provides a full, single dashboard view of all the first-party
cookies being used by your websites.

The GDPR’s ePrivacy Directive, for example, mandates that website owners
clearly specify what cookies are being used and for what purposes (and, insome cases, to obtain a user’s consent before storing those cookies in theuser’s browser).

Cloudflare | State of Application Security 202418

Shadow API risks

Consumers and end users expect dynamic web and mobile experiences— powered by APIs. For businesses, APIs fuel competitive advantages —greater business intelligence, swifter cloud deployments, integration of new AI
capabilities, and more.
However, APIs — which now comprise more than half (58%) of the dynamic
Internet traffic27 processed by Cloudflare — introduce new risks by allowing
outside parties to access an application.
Yet, for many, API security has fallen behind the fast pace of API deployment:
bot operators can directly attack the APIs behind workflows such as accountcreation, form fills, and payments to steal credentials and more; and AI models’
APIs are vulnerable to attacks.

Table of contents

Using our proprietary machine learning model that scans not just known API calls,
but all HTTP requests (identifying API traffic that may be going unaccountedfor), we found that organizations had 33% more public-facing API endpoints
than they knew about. (This number was the median, and it was calculated bycomparing the number of API endpoints detected through machine learningbased discovery vs. customer-provided session identifiers.)28
This suggests that nearly a third of APIs are “shadow APIs” — and may not beproperly inventoried and secured

But you cannot protect what you cannot see. And, many organizations lackaccurate API inventories, even when they believe they can correctly identify
API traffic.

Cloudflare | State of Application Security 2024

19

Table of contents

API RISKS

Business considerations and recommendations
Web applications and APIs often work together (for example, an ecommerce website using an
API to process payments). However, APIs’ unique attributes present a unique attack surface:
Who interacts
with itData
formats

Request andresponse structure

Typicalthreats

Human tosystemFlexible (e.g.,
JavaScript,
HTML, CSS)

Flexible, and returns
views

DDoS, malicious
bots, OWASP Top
10 Web App Risks

System tosystem

Structured
and machinereadable (e.g.,
JSON)

Defined by API
schema, and returns
only data

Abuse, data
exfiltration,
malicious bots,
OWASP Top 10
API risks

Web apps

Modern APIs

Despite the fact that APIs present different security challenges compared to web apps,
we found that 66.6% of API traffic defended by some form of layer 7 security is primarily
protected with traditional negative security WAF rules rather than with specialized API rules
employing a positive security model.29
Traditional WAF negative security model approaches may be unable to detect all attack traffic
directed at APIs, especially API-specific attacks like endpoint enumeration or authenticationhijacking. Any WAF used to protect API endpoints should have modern API-specific capabilities
that can enforce a positive security model.

Cloudflare | State of Application Security 2024

Recommendations
As businesses expose more services via APIs, theyshould augment web app security tools (like WAFs andDDoS), with purpose-built API security and management.
Advanced API security, using unsupervised machinelearning, helps organizations:• Discover shadow APIs: Constantly scan for every public
API in your landscape, even those that are unmanaged
or unsecured• Prevent data exfiltration: Stop data leaks bycontinuously scanning response payloads for sensitive
data• Create a positive security model: Protect APIs by
only accepting traffic that confirms to your OpenAPI
schemas — while blocking malformed requests andHTTP anomalies

20

Conclusion

The data is clear: the complexity of securing an organization’s
applications and APIs from new risks continues to grow:
•

•

•

•

Application layer HTTP DDoS attacks are increasing by volume and size —and are launched more efficiently by botnets
The majority of bots are untrusted or unverified, which can negatively
impact the security and performance of web apps
Attackers are weaponizing disclosed CVEs faster; in one example, within just
22 minutes of PoC publication

Table of contents

Enterprises often have a disjointed patchwork of legacy and point products forsecurity that make it hard to connect and protect their SaaS apps, web apps,
and other IT infrastructure. The IT sprawl makes it easier for attackers to findand exploit vulnerabilities.
The broad nature of web application and API threats requires specialized
approaches to stop specialized attacks. However, a consolidated, best of
breed approach helps ensure better security, latency-free connectivity,and business growth.

Organizations with a higher reliance on third-party scripts and cookies
may be at higher risk for software supply chain attacks or privacy andcompliance violations

Cloudflare | State of Application Security 2024

21

Table of contents

How Cloudflare can help

Cloudflare’s connectivity cloud scales to protect people,
apps, and networks everywhere
To reduce complexity while protecting more of the growing
attack surface, Cloudflare unifies protections across users,
apps, APIs, and networks with a connectivity cloud.
A connectivity cloud places one unified security network infront of web apps and APIs. This:• Stops a wide range of attacks in real-time using powerfulrulesets, exposed credential checks, and other security
measures• Prevents attackers from discovering then exploiting IP

addresses, configurations, and IT assets• Shifts web browsing to the edge (rather than endpoints),

insulating users and devices from web-based threats• Detects browser-based attacks, including client-side

attacks that target vulnerable JavaScript dependencies
and other third-party scripts

Cloudflare | State of Application Security 2024

~20%of the web protectedby Cloudflare

320+ citiesin 120+countries

209B+

threats
blocked daily

22

Table of contents

Learn more
Built on the backbone of a massive network, our integrated application security portfolio helps
organizations take full control of their security posture.

Key services include:

Cloudflare Web Application
Firewall (WAF) provides fullsecurity visibility, delivers layered
protections against OWASP
attacks and emerging exploits,
detects evasions and new attacks
with machine learning, blocks
account takeover, detects data
loss, and more.

Cloudflare DDoS Web Protection
automates intelligent DDoS
mitigation from the edge of ourglobal network — mitigating most
attacks in three seconds. All plansoffer unlimited mitigation of DDoS
attacks, with no cost penalty for
attack-related traffic spikes.

Cloudflare Bot Management
using machine learning,
behavioral analysis, andfingerprinting to accurately
classify bots. Block credential
stuffing, content scraping,inventory hoarding, DDoS, andother malicious bot activity.

Cloudflare API Gateway
automatically discovers,
validates, and protects yourAPI endpoints. Stop common
API attacks, including zero-day
exploits, authentication abuse,data loss, DDoS, and otherbusiness logic attacks.

Learn more about Cloudflare’s application security and performance solutions.
Cloudflare | State of Application Security 202423

Table of contents

APPENDICES

Glossary of key Cloudflare terms
Note: the data in this report is calculated based only on traffic tracked across the Cloudflare network and does notnecessarily represent overall HTTP traffic patterns across the Internet.

Custom rules: Allow you to control incoming traffic by filtering requests to azone. You can perform actions like Block or Managed Challenge on incoming
requests according to rules you define.
HTTP DDoS attack rules: A set of pre-configured rules used to match known
DDoS attack vectors at layer 7 (application layer) on the Cloudflare global
network. The rules match known attack patterns and tools, suspicious
patterns, protocol violations, requests causing large amounts of origin errors,
excessive traffic hitting the origin/cache, and additional attack vectors at theapplication layer.
Access rules: Use IP Access rules to allowlist, block, and challenge traffic
based on the visitor’s IP address, country, or Autonomous System Number(ASN). IP Access rules are commonly used to block or challenge suspected
malicious traffic. Another common use of IP Access rules is to allow services
that regularly access your site, such as APIs, crawlers, and payment providers.
IP reputation: This threat score measures IP reputation across Cloudflare
services. This score is calculated based on Project Honey Pot, external public
IP information, as well as internal threat intelligence from our WAF managed
rules and DDoS.
Managed rules: Allow you to deploy pre-configured managed rulesets thatprovide immediate protection against common attacks.

Cloudflare | State of Application Security 2024

Mitigated traffic: Refers to any eyeball HTTP or HTTPS request that had a“terminating” action applied to it by the Cloudflare platform. This includes thefollowing actions: BLOCK, CHALLENGE, JS_CHALLENGE, and MANAGED_CHALLENGE.
••

This does not include requests that had the following actions applied: LOG, SKIP,ALLOW. Starting in 2023, requests that had CONNECTION_CLOSE and FORCE_
CONNECTION_CLOSE actions applied by the Cloudflare DDoS mitigation
system were also excluded, as these only slow down connection initiation. They
accounted for a relatively small percentage of requests.
Cloudflare improved the calculation regarding the CHALLENGE type actions
to ensure that only unsolved challenges are counted as mitigated. A detailed
description of actions can be found in the Cloudflare developer documentation.

Rate limiting rules: Allow you to define rate limits for requests matching an
expression, and the action to perform when those rate limits are reached.
Uploaded content scanning: When enabled in the Cloudflare WAF, content
scanning attempts to detect content objects, such as uploaded files, and scansthem for malicious signatures like malware. The scan results, along with additional
metadata, are exposed as fields available in WAF custom rules, allowing you to
implement fine-grained mitigation rules.

24

Table of contents

APPENDICES

Endnotes
1.

2.

3.

4.

5.

6.

Looking at mitigated application traffic between April 1, 2023 - March 31, 2024, weanalyzed which application security rules were being used to mitigate traffic. WAF
was associated with the most mitigated traffic, but WAF rules block many different
types of attacks including volumetric attacks, credential stuffing attacks, malicious
content uploads, and more (detected by hundreds of different rules). The second
most common ruleset triggered for web applications was the DDoS ruleset, which
only identifies DDoS attacks.
Jetbrains disclosed CVE-2024-27198 on March 4th, 2024 at 14:59. Rapid7
published a proof-of-concept analysis of CVE-2024-2178 several hours later at
19:23 UTC. At 19:45 UTC, Cloudflare observed an attempted exploitation of thevulnerability.
We looked at aggregated customer website data pulled from the Page Shieldproduct as of May 2024 with hosts that contained the resource_type = ‘script’
and resource_type = ‘connection’ to determine the average number of third-party
scripts and connections on each of our customers’ hostnames. We eliminatedoutliers to this dataset, so the number of connections and scripts was found bylooking at 99.5% of the dataset.
We looked at HTTP traffic to all websites behind the Cloudflare reverse proxy forthe report collection period of April 1, 2023-March 31, 2024 and sorted it by humanand automated traffic to get the breakdown of bot vs human traffic. To get the
breakdown of verified vs unverified bot traffic, we compared the bot traffic against
the list that Cloudflare maintains of known “good” bots, also called “verified” bots.
To find this data, we looked at application security rules that were triggered for
public-facing API endpoints protected by Cloudflare during the collection period ofApril 1, 2023-March 31, 2024. We then grouped those triggered rules into broader
groups corresponding with their products. This helps us get a sense of what tactics
attackers are trying most frequently.
For the collection period of April 1, 2023-March 31, 2024, we analyzed data fromthe URL Scanner project, looking at the top 5,000 which received the highest
traffic volumes during the data collection period. We chose to analyze the cookies
for the top 5,000 domains rather than all URLs behind Cloudflare to show data thatis most reflective of the enterprise audience of this report.

Cloudflare | State of Application Security 2024

7.
8.
9.

10.

11.

12.

13.
14.
15.
16.

We analyzed all HTTP requests to applications behind the Cloudflare proxy from April
1, 2023-March 31, 2024 and categorized based on mitigated or non-mitigated (see“Glossary” for definitions of mitigated traffic).
We compared the percent of mitigated application traffic from April 1, 2023-March 31,
2024 with data from our report The State of Application Security in 2023.
This chart looks at data aggregated during the April 1, 2023-March 31, 2024 period
from all applications for which Cloudflare serves as a reverse-proxy and deploys
at least one application security rule to identify which security rules are being
triggered most frequently. We then grouped those triggered rules into broader groups
corresponding with their products. This helps us get a sense of what tactics attackers
are trying most frequently.
This chart looks at data aggregated during the April 1, 2023-March 31, 2024 period
from all applications for which Cloudflare serves as a reverse-proxy and deploys atleast one application security rule to identify which security rules are being triggered
most frequently. This helps us get a sense of what tactics attackers are trying mostfrequently.
This data is derived from customer feedback during case study interviews, specificallypublic case studies from DTLR/Villa and Open Access College, as well as 23 survey
responses from a customer return on investment survey run by Cloudflare through the
TechValidate software.
We looked at attack attempt activity that resulted in a triggered WAF Managed Rule
(which is used to stop exploits against common and emerging vulnerabilities) within
30 days of each rule’s publication, in order to not overweight Managed Rules released
earlier in the year. We examined WAF Managed Rules released between April 1, 2023 March 31, 2024 and their associated exploit attempt activity.
This chart looks at mitigated HTTP traffic over the collection period April 1, 2023March 31, 2024, zooming in on the volume of mitigations associated with DDoS rules
plotted over the year.
Source: Cloudflare’s Q1 2024 DDoS Threat Report.
Source: Cloudflare’s Q1 2024 DDoS Threat Report.
This data is drawn from Cloudflare’s discovery and analysis of the HTTP/2 vulnerability
known as “Rapid Reset” and the subsequent wave of hyper volumetric attacks that
resulted.
25

Table of contents

APPENDICES

Endnotes
17.
18.
19.
20.
21.
22.

23.

24.

Source: Cloudflare’s Q3 2023 DDoS Threat Report.
This chart is derived by categorizing HTTP DDoS attacks by industries and then ranking
them by which have the biggest share of all DDoS traffic on the Internet during theperiod April 1, 2023-March 31, 2024.
We looked at HTTP traffic to all websites behind the Cloudflare reverse proxy for thereport collection period of April 1, 2023-March 31, 2024 and sorted it by human andautomated traffic to get the breakdown of bot vs human traffic.
To get the breakdown of verified vs unverified bot traffic, we compared bot traffic during
the period April 1, 2023 - March 31, 2024 against the list that Cloudflare maintains ofknown “good” bots, also called “verified” bots.
We looked at bot traffic for the period April 1, 2023- March 31, 2024 and categorized it
by industry, then compared the share of bot traffic to human traffic for each industry to
determine which industries had the highest percentage share of bot traffic.
We looked at aggregated customer website data pulled from the Page Shield product asof May 2024 with hosts that contained the resource_type = ‘script’ and resource_type =‘connection’ to determine the average number of third-party scripts and connections oneach of our customers’ hostnames. We eliminated outliers to this dataset, so the numberof connections and scripts was found by looking at 99.5% of the dataset.
Using the Radar Year in Review Report (January 1, 2023 - December 31, 2023) and datafrom the Cloudflare Page Shield product gathered during the reporting period (April 1,
2023 - March 31, 2024), we collected a list of commonly used third-party scripts that ourcustomers are implementing into their web applications.
We looked at aggregated customer website data pulled from the Page Shield product asof May 2024 with hosts that contained the resource_type = ‘script’ and resource_type =‘connection’ to determine the average number of third-party scripts and connections oneach of our customers’ hostnames. We eliminated outliers to this dataset, so the numberof connections and scripts was found by looking at 99.5% of the dataset.

Cloudflare | State of Application Security 2024

25.
26.

27.

28.
29.

Using data from the Cloudflare Page Shield product gathered during May 2024, wecollected a list of commonly used third-party connections that our customers are
implementing into their web applications.
Based on the top 5,000 domains from Cloudflare’s Radar Ranking at the end of 2023.
We chose to analyze the cookies for the top 5,000 domains rather than all URLs behind
Cloudflare to show data that is most reflective of the enterprise audience of this report.
The dataset of Radar’s Domain Rankings aims to identify the top most popular domains
based on how people use the Internet globally, without tracking individuals’ Internet use.
Between April 1, 2023 - March 31, 2024, API traffic with successful responses (200status code) represented a median 58% of Cloudflare’s dynamic HTTP traffic. Dynamic
content is content that changes based on factors specific to the user, such as time ofvisit, location, and device.
For REST API endpoints, Cloudflare’s API discovery tool from the API Gateway productfound on median 33% more endpoints through machine learning than we discovered via
customer-provided session identifiers across all customers’ domains/zones, per account.
We examined mitigated traffic to public-facing APIs between April 1, 2023 - March 31,
2024 and checked which products and rulesets were being implemented and triggered
most frequently.

26

Table of contents© 2024 Cloudflare Inc. All rights reserved.
The Cloudflare logo is a trademark of Cloudflare. All othercompany and product names may be trademarks of therespective companies with which they are associated.

Call: 1 888 99 FLARE
Email: enterprise@cloudflare.com
Visit:
cloudflare.com
Cloudflare| State of Application Security 2024

27
REV:BDES-5907.2024JUL01