The results of an external penetration test for a software development company show a small number of applications account for the largest number of findings. While analyzing the content and purpose…

A WAF provides OWASP Top 10 protection - including SQLi, XSS, and injection defenses - for web-facing applications, satisfying compliance mandates such as PCI-DSS Requirement 6.4 that require application-layer controls for systems handling sensitive data, directly reducing immediate legal exposure.

Moving Application 3 to a secure VLAN with jump server access improves access control posture but targets an application that the penetration test matrix does not rank as the highest immediate compliance or legal risk priority.

Applying OS and software patches to the server hosting Application 4 reduces vulnerability severity but patch remediation is typically classified as a medium-term remediation rather than the most immediate compliance or legal risk reducer relative to unprotected public-facing applications.

Network segmentation and ACLs enforce access control boundaries around Application 5, satisfying compliance framework requirements for least-privilege network access and limiting the legal risk associated with unauthorized or overly broad access to sensitive application resources identified in the pentest findings.

An IDS/IPS on the same segment as Application 3 provides detection and inline blocking capability but does not enforce the access control or application-layer protections required by compliance frameworks to reduce legal liability.

A FIM on the server hosting Application 4 detects unauthorized file modifications for audit purposes but does not address application-layer vulnerabilities or access control gaps that drive the highest compliance and legal risk findings in the matrix.