Every organization has a boundary between what is private and what is public. Internet-facing applications sit right on that line: accessible to users, accessible to customers, and accessible to anyone else who decides to look. That last part is the problem.
Attackers are not waiting for a perfect opportunity. They are running automated scans, probing exposed endpoints, and cataloging vulnerabilities across thousands of targets at once. Attacks targeting website vulnerabilities reached 6.29 billion in 2025, up 56% from the previous year. And in most organizations, the very assets getting the most external attention are the ones getting the least internal care.
This is not just a global problem. In the Philippines, over 80% of organizations experienced an average of three cybersecurity breaches in 2024 alone. Across ASEAN, the average cost of a single data breach reached USD 3.2 million in 2024, a 6% year-over-year increase that shows no sign of slowing down.
This post breaks down why that gap exists, what it costs, and what it takes to close it.
What "Internet-Facing" Actually Means
The term gets used loosely, so it is worth being precise. An internet-facing application is any system reachable from the public internet without requiring a VPN, internal network access, or other access controls to initiate a connection.
That includes:
- Customer-facing web applications and portals
- Public-facing APIs, including those labeled "internal" but exposed without authentication
- Admin panels and management dashboards accessible via public URLs
- Login pages for SaaS tools, HR platforms, or cloud environments
- Third-party integrations that expose endpoints to the web
The defining characteristic is not just visibility. It is reachability. If a system responds to a request from an unknown IP address without first requiring the requester to authenticate or connect through a private channel, it is internet-facing, regardless of whether it was intended to be public.
Why Attackers Always Start Here
From an attacker's perspective, internet-facing applications are the most logical starting point, not because they are necessarily the weakest, but because they require the least effort to reach.
There is no need to social engineer an employee, compromise a device, or gain a foothold inside the network. The target is already accessible. All an attacker needs to do is connect.
Tools like Shodan, Censys, and FOFA continuously index the internet, cataloging open ports, service banners, software versions, and SSL certificate metadata. An attacker can query these platforms and retrieve a detailed map of an organization's externally exposed infrastructure in minutes, without sending a single packet to the target directly.
The data reflects this. According to the IBM X-Force Threat Intelligence Index 2026, exploitation of public-facing applications rose 44% in 2025, accounting for 40% of all observed incidents and overtaking credential abuse as the primary initial access method for the first time in two years. Exploiting public-facing applications (tracked by MITRE ATT&CK as T1190) was also observed in 73% of actively exploited vulnerabilities in recent reporting periods, making it the single most frequent attacker technique recorded. Vulnerability exploitation has also become an initial access vector in 1 in 5 breaches globally, a figure that rose 34% in a single year.
This is not the work of sophisticated nation-state actors. Commodity attack tooling has lowered the skill threshold significantly. Opportunistic attackers, ransomware groups, and credential harvesters all operate this way at scale.
The math is straightforward: if your internet-facing application has a vulnerability, it will be found.
The only question is whether you find it first.
Philippine Organizations Are Already in the Crosshairs
The global trend has a direct local parallel. CYFIRMA's 2025 threat landscape research found that web applications have been the dominant target surface in the Philippines for three consecutive years. In 2025, the National Intelligence Coordinating Agency disclosed that 234 data breaches had been recorded across high-level government agencies, with 32 agencies already having sensitive data surfaced on the dark web and 91 sets of credentials compromised.
The incidents are specific. In 2024, the Deathnote Hackers International group broke into the Bureau of Customs and extracted 4.5 gigabytes of data, including personal information belonging to more than 2,200 employees and roughly 80,000 customers. The same group later compromised the Senate of the Philippines' Legislative Information System, accessing employee accounts and legislative records. Separately, a threat actor claimed to have exfiltrated regional records, contact details, and cell site data from National Telecommunications Commission systems.
None of these required exceptional technical sophistication. Each succeeded because a public-facing system had an exploitable weakness that was not closed before someone found it.
Patches Move at a Very Different Speed
If attackers can exploit a vulnerability within hours of disclosure, the natural question is: why does remediation take so much longer?
The data from Edgescan's 2025 Vulnerability Statistics Report gives a precise answer. The mean time to remediate critical vulnerabilities in internet-facing applications is 35 days. For internet-facing host and cloud environments, that number rises to 61 days. For application and API vulnerabilities rated high or critical, the average is 54.81 days.
Meanwhile, the median time to exploit a vulnerability is under 5 days. In 28% of cases in 2025, vulnerabilities were being exploited on the same day as disclosure, or before a patch was even available.
The math is unforgiving. Attackers move in days. Patches arrive in weeks, sometimes months. And the volume of vulnerabilities to manage is not shrinking: 131 new vulnerabilities were disclosed every single day in 2025, making it increasingly difficult for any team to keep pace with remediation across a growing digital footprint.
Edgescan also found that larger enterprises leave 45.4% of discovered vulnerabilities unresolved within a 12-month period, predominantly in the network and device layer. These are not forgotten vulnerabilities in obscure systems. They are known findings that have not yet made it through the remediation process.
Why Patching Falls Behind
Understanding the gap means understanding what remediation actually looks like inside most organizations.
Security findings do not land in a queue where they are processed in order of severity. They land in a backlog shared with feature requests, infrastructure work, compliance deadlines, and incident response. Engineering teams are managing active development cycles at the same time they are expected to address security debt. Prioritization decisions become complicated quickly, especially when the severity of a finding is disputed, when a temporary workaround is assumed to be sufficient, or when the team responsible for the fix is unavailable.
Patching an internet-facing application is also rarely as simple as updating a dependency. It often requires testing across environments, coordinating with multiple teams, managing deployment windows, and verifying that the fix does not break something else in production. For organizations running legacy systems or deeply integrated platforms, a single remediation can require weeks of preparation before any change goes live.
Then there is the false comfort of perimeter controls. Web Application Firewalls create a sense of protection that reduces urgency around patching. The reasoning goes: "We have a WAF in front of it, we can handle this next cycle." WAFs are a mitigation layer, not a fix. Sophisticated attackers know how to route around them. The result is predictable: a vulnerability is discovered, triaged, assigned a severity rating, and sits in a backlog while teams wait for the right moment to act. Attackers do not wait for the right moment.
What Attackers Actually Look For
Internet-facing applications are not breached through exotic zero-days in most cases. They are breached through well-documented, commonly exploited vulnerability classes that have existed for years.
Authentication is usually the first thing probed. Weak login flows, missing account lockout controls, predictable session tokens, and poorly implemented multi-factor authentication are consistently among the most exploited vulnerability types. An attacker who can authenticate as a legitimate user does not need to exploit anything else. Closely related are admin panels and management interfaces left running on default credentials. In the Philippines, over 4.1 million password-guessing attacks were recorded in 2024 alone, a figure that reflects just how systematically attackers probe for this.
APIs and software with known CVEs are next. APIs expose raw business logic and data directly, and endpoints that lack authentication or return excessive data are common findings. The 2024 cyberint threat landscape report flagged a notable rise in exposed cloud storage and misconfigured SSL/TLS configurations among Philippine clients specifically. On the software side, over 54% of critical vulnerabilities face active exploitation within the first week of public disclosure. Organizations that are slow to patch are operating against exploits already in the wild.
Then there are the configuration-level oversights: S3 buckets misconfigured for public read access, injection vulnerabilities (SQL, command, server-side template) that have appeared on the OWASP Top 10 for over a decade and still surface in production applications worldwide. They keep working because they keep being found.
The Cost of Getting It Wrong
A breach through an internet-facing application does not stay contained. The access an attacker gains at the perimeter becomes a platform for lateral movement, data exfiltration, and deeper compromise.
Web applications and APIs typically sit in front of databases containing customer records, transaction histories, PII, and proprietary business data. A vulnerability that grants unauthorized access to the application provides a direct path to that data. In the Philippines, the Data Privacy Act of 2012 requires organizations to implement reasonable security measures, and a breach traced back to an unpatched, publicly known vulnerability will be difficult to defend before the National Privacy Commission. For organizations operating under PCI DSS, ISO 27001, SOC 2 Type II, or HIPAA, the same principle applies: a finding like that is not just a technical failure in an audit. It is evidence of a process failure, and it gets treated accordingly.
The reputational damage is harder to quantify but just as real. A publicized breach of a customer-facing application tells everyone, including partners, clients, and prospects, exactly what kind of security culture the organization has. Enterprises and regulated industries that depend on vendors holding their data are increasingly scrutinizing security incidents before making commercial decisions. Trust, once broken this way, takes considerably longer to rebuild than the application itself.
The operational cost can be severe. Ransomware groups frequently use web application vulnerabilities as their initial access vector. In one documented case in Singapore, a law firm reportedly paid USD 18.9 million following a ransomware attack. Across Southeast Asia, the downstream cost of ransomware incidents, from system downtime to recovery operations to reputational fallout, consistently and significantly exceeds what a proper security assessment program would have cost in the first place.
How to Close the Gap
Closing the gap between attacker activity and organizational response requires both technical controls and operational discipline. Neither alone is sufficient.
Map your attack surface completely. You cannot protect what you do not know exists. A comprehensive inventory of internet-facing assets, including APIs, third-party integrations, cloud services, and legacy systems, must be maintained continuously, not compiled once and archived.
Test from the attacker's perspective. Automated scanners do not replicate the judgment and chained exploitation techniques of a skilled attacker. Regular penetration testing surfaces what tools miss. For organizations in the Philippines pursuing compliance with the DICT D-TAP Program, structured VAPT is a requirement, not an option.
Adopt continuous testing for high-risk assets. A point-in-time penetration test reflects the security posture of an application at a single moment. Applications that are updated frequently, that handle sensitive data, or that are high-profile targets benefit from continuous security testing through bug bounty programs, where vetted security researchers assess the application on an ongoing basis and report findings as they discover them.
Establish clear ownership and SLAs for remediation. Every identified vulnerability needs an owner, a priority, and a deadline. Severity-based SLAs, defining maximum acceptable time-to-remediation for critical, high, medium, and low severity findings, create the structure that prevents backlog accumulation. 32% of identified vulnerabilities remain unpatched for more than 180 days. Clear ownership and accountability are what change that number.
Verify that patches actually work. Deploying a fix does not guarantee the vulnerability is resolved. Regression testing and post-remediation verification, ideally conducted by the same team that identified the original finding, confirms that the fix was implemented correctly and did not introduce new issues.
Treat security as a continuous process, not a checkpoint. The threat landscape changes. Applications change. The combination of the two means that a security posture that was acceptable six months ago may not be acceptable today. Organizations that build security testing into their development and deployment cycles, rather than scheduling it as an annual event, maintain a much tighter feedback loop between vulnerability introduction and remediation.
Conclusion
Internet-facing applications are where organizations meet the world, and where attackers begin their work. The gap between how aggressively these assets are probed externally and how consistently they are assessed and maintained internally is one of the most persistent challenges in applied security, from global enterprises to local businesses across the Philippines and Southeast Asia.
Closing that gap does not require an entirely new security program. It requires clear asset visibility, regular testing that reflects real attacker behavior, defined remediation ownership, and the operational discipline to act on findings before someone else does.
Secuna helps organizations protect their internet-facing applications through penetration testing that combines automated tools with manual assessment, and through continuous bug bounty programs that keep security researchers engaged with your environment on an ongoing basis.
To learn more about how Secuna can support your external application security program, reach out to our team at [email protected] or explore our services at secuna.io.
Sources: 2025 Global Threat Landscape Report, FortiGuard Labs · Application Security Report 2024 Update, Cloudflare · X-Force Threat Intelligence Index 2026, IBM · 44% Surge in App Exploits as AI Speeds Up Cyber-Attacks, Infosecurity Magazine · Philippines Evolving Cyber Threat Landscape 2025-2026, CYFIRMA · NICA: 234 data breaches monitored in high-level gov't agencies, GMA News · Senate website hacked but no secret data lost, Inquirer · 2025 Vulnerability Statistics Report, Edgescan · Exposed and Unaware: The State of Enterprise Security in 2025, Help Net Security · From 48 Hours to Minutes: Why Time-to-Exploit Is Shrinking Faster Than Patch Cycles, Saptang Labs · Vulnerability Statistics 2025: Record CVEs and Exploitation, Deepstrike · 7 In-Depth Examples of Web Application Attacks, Jit · Major Cybersecurity Incidents of 2025 and Lessons Learned, Hornetsecurity · The Security Gaps That Caused 2025's Biggest Breaches, ManageEngine · Cost of a Data Breach Report 2025, IBM