In your example, an eavesdropper (E) will need to have access to the communications between the application (A) and the server (B). This may be done by compromising routers in your network, or by masquerading as a legitimate WiFi router. It's not easy, but not impossible in most networks.
Note that if E managed to compromise your equipment, they might also compromise the server and manipulate the application. In short, at this point you have bigger security problems than securing the communication between A and B and you should focus your resources in ensuring the integrity of your network.
But let's say that E manages to get in the network and wants to stay stealthy by not touching A or B. E just wants to listen to the communications between A and B. A and B could communicate securely by either: having the certificate of each other (A has the certificate of B and trusts that it's legitimate), or having the certificate of your company's certification authority in order to verify A and B's certificates (A gets B's certificate over an untrusted channel but A verifies that it's legitimate using A's trust in the certification authority). These certificates can then be used to secure the communications using TLS (HTTPS).
In this threat model, without securing the communications between A and B, E could observe the communications. If E wants to go a step further, it might also temper the data transiting between A and B, depending on E's access to the network.
TL;DR: Defense in depth is a good thing (TM). However, you should take care to evaluate your threats in order to focus your resources in securing the vulnerabilities with the most ROI for the attacker. As each firm is different from another, you should request an audit of your firm to know if it's a good idea to spend resources in securing the communication between A and B.