Analysis Finds 64% of Third-Occasion Apps Entry Delicate Information

Boston, MA, USA, January twenty first, 2026, CyberNewsWire

Reflectiz at this time introduced the discharge of its 2026 State of Internet Publicity Analysis, revealing a pointy escalation in consumer‑facet threat throughout international web sites, pushed primarily by third‑get together purposes, advertising instruments, and unmanaged digital integrations.

In line with the brand new evaluation of 4,700 main web sites, 64% of third‑get together purposes now entry delicate information with out official enterprise justification, up from 51% final 12 months — a 25% 12 months‑over‑12 months spike highlighting a widening governance hole.

The report additionally exposes a dramatic surge in malicious net exercise throughout crucial public‑sector infrastructure. Authorities web sites noticed malicious exercise rise from 2% to 12.9%, whereas 1 in 7 Training web sites now present energetic compromise, quadrupling 12 months‑over‑12 months.

Finances constraints and restricted manpower have been cited as main obstacles by public‑sector safety leaders.

The analysis identifies a number of broadly used third‑get together instruments as prime drivers of unjustified delicate‑information publicity, together with Google Tag Supervisor (8%), Shopify (5%), and Fb Pixel (4%), which have been regularly discovered to be over‑permissioned or deployed with out satisfactory scoping.

“Organizations are granting delicate‑information entry by default reasonably than exception — and attackers are exploiting that hole,” stated VP of Product at Reflectiz, Simon Arazi.

“This 12 months’s information exhibits that advertising groups proceed to introduce nearly all of third‑get together threat, whereas IT lacks visibility into what’s really operating on the web site.”

Key findings embrace:

• 64% of apps accessing delicate information haven’t any legitimate justification.
• 47% of purposes operating in fee frames (checkout environments) are unjustified.
• Compromised websites connect with 2.7× extra exterior domains, load 2× extra trackers, and use not too long ago registered domains 3.8× extra typically than clear websites.
• Advertising and Digital departments account for 43% of all third‑get together threat

The report additionally introduces up to date Safety Management Benchmarks, highlighting the very small group of organizations assembly all eight standards. Just one web site — ticketweb.uk — achieved an ideal rating throughout the framework.

The 2026 report consists of:

• Sector‑by‑sector breakdowns of net publicity threat
• Full checklist of excessive‑threat third‑get together purposes
• Yr‑over‑12 months trade developments
• Technical indicators of compromise
• Finest‑follow controls for safety and digital groups

The entire 43‑web page evaluation is on the market for obtain:
https://www.reflectiz.com/learning-hub/web-exposure-2026-research/

About Reflectiz

Reflectiz empowers organizations to safe their web sites and digital belongings towards fashionable net threats. Its award-winning, agentless platform offers steady visibility into all client-side exercise, detecting and prioritizing safety, privateness and compliance dangers.

Reflectiz is trusted by international enterprises throughout monetary companies, e-commerce, and healthcare to guard their information, customers, and model popularity.

Contact

VP Advertising

Daniel Sharabi

Reflectiz

[email protected]