It is known that security vulnerabilities are common on the web: many web sites are vulnerable. Is there any data on what fraction of web sites are vulnerable, and what fraction are secure?
Veracode released some data on the web applications they've analyzed. Here are some highlights.
On compliance with OWASP standards, which say that your application should not have any vulnerability in the OWASP top 10 (see Figure 24):
(Footnote: This is for the first submission of the application to their service.)
On compliance with SANS standards, which require that you don't have any vulnerability on the SANS top 25 list (see Figure 25):
The methodology is not clear from the web site. It is not clear how many of the non-compliant web applications are vulnerable (or, for that matter, how many of the compliant web apps are vulnerable).
They also report statistics on the prevalence of various vulnerabilities, in the web applications they have analyzed (see Table 7):
In short, it appears that something like at least 80% of web applications are vulnerable, according to their stats.
The most recent study I've seen was back in 2008 by the Web Application Security Consortium [webappsec.org]. The study was compiled from the results of eight separate security assessment projects and had a total sample size of 12186 web applications made up from various industries. The study makes for a very interesting read, but I'll summarize a few of the key points for you here:
Keep in mind these figures are about four years old, and four in internet years is a lifetime (in other words: take them with a grain of salt). That being said, I very much doubt any significant change was made to the percentage of vulnerable sites.
On a slightly related note, if you are interested in other security related statistics, there are two good sites that release reports on a slightly more frequent basis.
WhiteHat Security's 2011 annual report has some detailed statistics on the web sites they monitor, and what fraction of them are vulnerable.
Here are some highlights:
The report defines a serious vulnerability as one that would be classified as High, Critical, or Urgent severity by the PCI-DSS standard.
So it sounds like something in the ballpark of 80% of web sites are vulnerable to various attacks.