Update: New Research: 64% Of 3rd-party Applications Access Sensitive Data...

A critical disconnect emerges in the 2026 research: While 81% of security leaders call web attacks a top priority, only 39% have deployed solutions to stop the bleeding.

Last year's research found 51% unjustified access. This year it's 64% — and accelerating into public infrastructure.

Gartner coined 'Web Exposure Management' to describe security risks from third-party applications: analytics, marketing pixels, CDNs, and payment tools. Each connection expands your attack surface; a single vendor compromise can trigger a massive data breach by injecting code to harvest credentials or skim payments.

This risk is fueled by a governance gap, where marketing or digital teams deploy apps without IT oversight. The result is chronic misconfiguration, where over-permissioned applications are granted access to sensitive data fields they don't functionally need.

This research analyzes exactly what data these third-party apps touch and whether they have a legitimate business justification.

Over 12 months (ending Nov. 2025), Reflectiz analyzed 4,700 leading websites using its proprietary Exposure Rating system. It analyzes the huge number of data points it gathers from scanning millions of websites by considering each risk factor in context, adds them together to create an overall level of risk, and expresses this as a simple grade, from A to F. Findings were supplemented by a survey of 120+ security leaders in the healthcare, finance, and retail sectors.

The report highlights a growing governance gap termed "unjustified access": instances where third-party tools are granted access to sensitive data without a demonstrable business need.

Access is flagged when a third-party script meets any of these criteria:

"Organizations are granting sensitive data access by default rather than exception." This trend is most acute in Entertainment and Online Retail, where marketing pressures often override security reviews.

The study identifies specific tools driving this exposure:

Source: The Hacker News