Published by Gbaf News
Posted on March 13, 2017
7 min readLast updated: January 21, 2026
Global CRASH Report from CAST uncovers applications in Financial Services can be exploited to steal confidential information
CAST, a leader in software analysis and measurement, announced findings from its latest CRASH Report, the largest objective study of software ‘health factors’ such as Reliability and Security. Health factors indicate the volume and severity of structural software flaws in business applications.
The report, which analysed 1.03 billion lines of code across 1,850 applications submitted by over 329 organisations in 8 different countries, exposes the overall quality of too many mission critical functions across the globe is POOR. Security scores varied widely with some of the highest and worst scores observed for any Health Factor. The lowest security scores of some applications indicate there is a significant amount of unsecured code out there.
This represents a big gamble for organisations whose business operations rest on poor code. Financial Services were specifically found to be particularly susceptible to security risk. Retail and Telco scored marginally better than Financial Services. For an industry carrying large amounts of sensitive data, Financial Services organisations are at risk of severe regulatory fines.
“Lack of security architecture combined with porous code in legacy systems produce easy targets for hackers. This is especially concerning in Financial Services applications,” said Dr. Bill Curtis, SVP and Chief Scientist at CAST Research Labs. “Despite the push to ‘go digital’ our CRASH Report findings indicate there is a significant amount of bad code lingering in enterprise systems. The takeaway for IT is clear: poor software quality is exposing many businesses to excessive risk.”
Key findings of the study include:
Security is lagging behind
Smaller is better
Maturity must be improved to avoid gambling
A hybrid method is the way to go
A copy of the CRASH Executive summary and the full report can be downloaded here.
Methodology
CAST Research on Application Software Health (CRASH) is a biennial report on global trends in the structural quality of business applications. It reports scores on Health factors which represent attributes of the engineering soundness of the architecture and code of software systems. The technology that generated the data in CRASH Reports measures the number and severity of violations of good architectural and coding practice. These are the defects most likely to cause operational problems such as outages, performance degradation, unauthorised access, or data corruption. The health factors measured in the report look at five traits: Robustness, Security, Performance Efficiency, Changeability and Transferability. Scores are computed on a scale of 1 (high risk) to 4 (low risk).
Global CRASH Report from CAST uncovers applications in Financial Services can be exploited to steal confidential information
CAST, a leader in software analysis and measurement, announced findings from its latest CRASH Report, the largest objective study of software ‘health factors’ such as Reliability and Security. Health factors indicate the volume and severity of structural software flaws in business applications.
The report, which analysed 1.03 billion lines of code across 1,850 applications submitted by over 329 organisations in 8 different countries, exposes the overall quality of too many mission critical functions across the globe is POOR. Security scores varied widely with some of the highest and worst scores observed for any Health Factor. The lowest security scores of some applications indicate there is a significant amount of unsecured code out there.
This represents a big gamble for organisations whose business operations rest on poor code. Financial Services were specifically found to be particularly susceptible to security risk. Retail and Telco scored marginally better than Financial Services. For an industry carrying large amounts of sensitive data, Financial Services organisations are at risk of severe regulatory fines.
“Lack of security architecture combined with porous code in legacy systems produce easy targets for hackers. This is especially concerning in Financial Services applications,” said Dr. Bill Curtis, SVP and Chief Scientist at CAST Research Labs. “Despite the push to ‘go digital’ our CRASH Report findings indicate there is a significant amount of bad code lingering in enterprise systems. The takeaway for IT is clear: poor software quality is exposing many businesses to excessive risk.”
Key findings of the study include:
Security is lagging behind
Smaller is better
Maturity must be improved to avoid gambling
A hybrid method is the way to go
A copy of the CRASH Executive summary and the full report can be downloaded here.
Methodology
CAST Research on Application Software Health (CRASH) is a biennial report on global trends in the structural quality of business applications. It reports scores on Health factors which represent attributes of the engineering soundness of the architecture and code of software systems. The technology that generated the data in CRASH Reports measures the number and severity of violations of good architectural and coding practice. These are the defects most likely to cause operational problems such as outages, performance degradation, unauthorised access, or data corruption. The health factors measured in the report look at five traits: Robustness, Security, Performance Efficiency, Changeability and Transferability. Scores are computed on a scale of 1 (high risk) to 4 (low risk).
Explore more articles in the Business category
