SAN FRANCISCO, CA--(Marketwired - Jun 13, 2017) - tCell, creators of the application immune system for cloud-first organizations, today announced expanded product functionality and platform support, as well as a new report, "The State of Security for In-Production Web Applications," which delivers unprecedented insights into actual application vulnerabilities and attacks in progress. The early evidence comes directly from tCell's experience and analysis of security dynamics across a sample of more than 30 major enterprise applications in production.

The 2017 Verizon Data Breach Investigations Report again places web application attacks as the primary threat vector (nearly 30 percent) of successful breaches. While security practices and oversight have improved, the rate of development, and innovations in designing and deploying apps have far outpaced the ability to secure. The speed of DevOps and Agile development keep application security testing during development penned in, and trends such as microservices with mesh-style communication patterns cause major difficulties for network-based security mechanisms at the other end of the ecosystem. tCell targets the problem at the most critical juncture, embedding non-intrusive protection in the application itself at runtime for production deployment in the cloud, enabling it to self-defend.

"Care for our patients is our mission -- care for their data is part of that," said David Hoffman, Director, Product Engineering at John Muir Health. "At John Muir Health, that focus includes taking application security seriously, and we use tCell to give us insight and efficiency in our AppSec efforts."

Since beginning broad customer deployments last year, tCell has gathered rich insights from securing production applications. It has provided a few surprises about the types of risks that face web applications, but also contradicts some long-held beliefs regarding vulnerability. The findings also underscore the variety of vectors and attacks that threaten applications -- exceeding those identified on the OWASP Top 10. The most notable findings include:

• More than 90 percent of companies have orphan application routes, and more than one quarter had in excess of 100 orphan routes in their applications. This represents a potential attack surface that has no business benefit. Much like unused network or firewall ports left open, these are API endpoints forgotten by developers that are still open.
  
  
• In a brief 30-day sample period, more than 40 percent of companies suffer account takeover attacks that require no software flaws to exploit, and more than 85 percent of those attacks result in successful user compromise. These are typically automated "attacks" using large user ID/password databases from large breaches, such as Yahoo, against a victim's app.
  
  
• Seen as the bane of application security, in half a million attacks over a 30-day period, only .001 percent of Cross-Site Scripting (XSS) actually progress and require a security response.

Download the full report to learn more: The State of Security for In-Production Web Applications

"Many enterprise organizations start out thinking they have to replicate the traditional data center security stack for cloud environments," said Michael Feiertag, tCell CEO. "The reality is that it's a different, far more dynamic world, with a lot of effort from the cloud provider on securing that infrastructure. Organizations need to focus on protecting what's theirs, the application, which enables all of the goodness that is cloud without weighing it down."

The power of tCell is that it secures applications at runtime and in production, enabling organizations to understand, monitor, and protect their applications without code or network changes. Using in-application (both browser- and server-side) instrumentation and cloud-based analytics, it provides unmatched coverage of application attack surface, monitors attack attempts and successful breaches, and defends applications with active protections -- all with minimal tuning and false positives. With the latest release, tCell adds:

• Support for enterprise .NET applications, expanding an already comprehensive list that includes support for Ruby, Java, Node.JS, and Python.
  
  
• Point-of-attack instrumentation to detect and confirm if command injection attempts have been successful at breaching the app. This adds to existing instrumentation in the browser (XSS, clickjacking), database (SQL injection), and login framework (account takeover) enabling customers to not only see attempted attacks but when those attacks progress.
  
  
• Field-level encryption for increased data integrity in highly regulated industries, such as healthcare or financial services.

About tCell
tCell moves application security out of the network for cloud-first organizations. Using in-application instrumentation and cloud-based analytics, tCell secures production applications, enabling organizations to assess, monitor, and defend their applications -- without code or network changes. Funded by Menlo Ventures, A Capital, Allegis Capital, Webb Investment Network, CrunchFund, and SV Angel, tCell boasts an impressive team from innovators that include Splunk, Okta, Blue Coat/Symantec, Palo Alto Networks, and SkyHigh Networks. Learn more at tcell.io.

All product and company names herein may be trademarks of their respective owners.