To lay the foundation for the research, the team first examined the volume of languages in the field, and found, unsurprisingly, that .Net, Java and ASP are the most widely used programming languages at 28.1%, 25% and 16% respectively. Legacy programming languages that have been around for decades, PHP (11%), ColdFusion (6%), and Perl (3%) rounded out the remaining field.
The popularity and complexity of .Net, Java and ASP, mean that the potential attack surfaces for each language is larger; as such, 31% of vulnerabilities were observed in .Net, 28% were found in Java and 15% were found in ASP.