New Research Reveals Alarming Findings: 64% of Third-Party Apps Access Sensitive Data Without Authorization

Jan 21
2 min read

Key Findings

64% of third-party applications access sensitive data without legitimate business justification, up from 51% last year - a 25% year-over-year spike.
Malicious web activity across critical public-sector infrastructure surged dramatically, with government websites seeing a rise from 2% to 12.9%, and 1 in 7 Education websites now showing active compromise, quadrupling year-over-year.
Widely used third-party tools like Google Tag Manager (8%), Shopify (5%), and Facebook Pixel (4%) were frequently found to be over-permissioned or deployed without adequate scoping.
47% of applications running in payment frames (checkout environments) are unjustified.
Compromised sites connect to 2.7× more external domains, load 2× more trackers, and use recently registered domains 3.8× more often than clean sites.
Marketing and Digital departments account for 43% of all third-party risk.

Background

The report, titled "2026 State of Web Exposure Research," was released by Reflectiz, a leading cybersecurity firm. The research analyzed 4,700 leading websites and revealed a sharp escalation in client-side risk, driven primarily by third-party applications, marketing tools, and unmanaged digital integrations.

Sensitive Data Exposure

The report found that 64% of third-party applications now access sensitive data without legitimate business justification, up from 51% the previous year. This 25% year-over-year spike highlights a widening governance gap, as organizations grant sensitive data access by default rather than by exception.

Surge in Malicious Activity

The research also exposed a dramatic surge in malicious web activity across critical public-sector infrastructure. Government websites saw malicious activity rise from 2% to 12.9%, while 1 in 7 Education websites now show active compromise, quadrupling year-over-year. Budget constraints and limited manpower were cited as primary obstacles by public-sector security leaders.

High-Risk Third-Party Tools

The research identified several widely used third-party tools as top drivers of unjustified sensitive-data exposure, including Google Tag Manager (8%), Shopify (5%), and Facebook Pixel (4%). These tools were frequently found to be over-permissioned or deployed without adequate scoping.

Payment Frame Risk

The report revealed that 47% of applications running in payment frames (checkout environments) are unjustified, posing a significant risk to sensitive financial data.

Indicators of Compromise

Compromised sites were found to connect to 2.7× more external domains, load 2× more trackers, and use recently registered domains 3.8× more often than clean sites, highlighting key technical indicators of compromise.

Third-Party Risk Ownership

The research found that Marketing and Digital departments account for 43% of all third-party risk, underscoring the need for cross-functional collaboration and visibility between security and business teams.

Security Leadership Benchmarks

The report introduces updated Security Leadership Benchmarks, highlighting the very small group of organizations meeting all eight criteria. Only one website — ticketweb.uk — achieved a perfect score across the framework.

Sources

https://securityonline.info/new-research-exposes-critical-gap-64-of-third-party-applications-access-sensitive-data-without-authorization/
https://hackread.com/new-research-exposes-critical-gap-64-of-third-party-applications-access-sensitive-data-without-authorization/