A Clean Scan Does Not Mean Your App Is Safe

If you’re shipping software this quarter, there’s a good chance a customer, an investor or an auditor is going to ask whether it has been tested. Here is what we found across a year of web application tests, and why a clean scan isn’t a full picture of your security posture.

Which web application findings actually get exploited?

The rare ones. Every single time we reported broken access control, a tampered record ID, a forged login token or a prompt injection, our testers had used it to get in. The common findings were the opposite: missing security headers showed up in 62% of applications and an outdated JavaScript library in 35%. Fix them; it’s quick work. But across every test we ran last year, web, internal and external, not one missing header, old library, cookie flag or caching rule appeared on an attack path. Not one.

What is the most common way a web app gives up data?

It checks that the user is logged in and never checks whether that user is allowed to see what they asked for. One application in six gave up access or data, and of those, almost half failed exactly that way. A member of a public retirement system logged into the portal, our tester changed one number in the request, and got back a stranger’s record, home address and phone number included. The portal did exactly what it was written to do. No scanner on earth would flag it, because a scanner checks settings; it can’t tell whether one customer can open another customer’s invoice.

SQL injection: zero. Ten years ago injection topped the OWASP list. Last year it didn’t work in a single application we tested. Modern frameworks make the safe query the easy query, and we give them the credit. That’s good news, and it tells you where risk moves next.

Are AI features in web apps vulnerable to prompt injection?

Yes, and most teams aren’t testing for it yet. AI features are arriving in every product: chat assistants, summarizers, content generators. They pass whatever the user types straight into the model’s instructions, and most teams haven’t yet learned to treat that text as hostile. On an education platform we tested, our tester asked the AI feature to treat its task as an exercise in self-reflection. It recited its confidential system prompt one sentence at a time, and with those instructions in hand the tester made it produce exactly the harmful answers it was built to refuse, in front of students. Our 2025 data has one working prompt injection. We expect many more in 2026. It will follow the SQL injection arc, peaking before the industry agrees on how to stop it, and your app is in the window now.

What should a web application penetration test include?

Two things most tests skip. First, the tester logs in as at least two different users and tries to cross between them; that’s how the retirement-portal flaw shows up. Second, every AI feature is in scope for prompt injection: can a user talk it out of its instructions? If your current test, or your vendor’s, doesn’t include both, it’s closer to a scan than a test.

If you built it fast, test it before someone else does. A fixed-scope web application test takes about two weeks and produces a report your customers’ security teams and your investors’ diligence counsel will accept. We can deliver before year end for the next few apps that book, and we’re holding the first two weeks of January after that. Contact us to reserve a slot.

From Patched and Still Breached, LMG Security’s 2026 Penetration Testing Report. Section 5 covers the web application findings in full.

Want the full story? Join Tom Pohl and Sherri Davidoff for a live walkthrough of the report on Thursday, Nov 12, at 2 PM ET. Register here.

Questions people ask

Does a clean vulnerability scan mean an application is secure?
No. A scanner checks settings and library versions. In our tests, not one missing header, old library, cookie flag or caching rule appeared on an attack path; what worked was a person asking whether this user should be able to see that record.

How long does a web application penetration test take?
A fixed-scope test of one application takes about two weeks of testing and produces a report that customers’ security teams and investors’ diligence counsel will accept.

What is prompt injection?
Text a user types into an AI feature that the model treats as instructions, so the right words make it ignore its guardrails. One worked in our 2025 tests; we expect many more in 2026.