While phishing and credential-based attacks often dominate breach reports, applications themselves are a significant target.