One in nine UK organisations run websites that contain one or more vulnerabilities that could enable external users to gain unauthorised access or disrupt service availability, security experts warned today.

A further 33 per cent of websites contain critical vulnerabilities that are widely known and actively exploited by hackers, according to NTA Monitor's Annual Web Application Security Report 2007.

The report analysed data gathered from web application security tests undertaken on behalf of a variety of organisations during 2006, including financial institutions, legal practices, universities and local government bodies.

Roy Hills, technical director at NTA Monitor, said: "Web applications are accessible 24/7 and control sensitive data such as customer details, credit card numbers and proprietary corporate data.

"An ever increasing number of people are using the internet for personal business such as banking, bill payments and shopping, and as a core part of their working lives in terms of remote working and resource sharing.

"It is high time that organisations took greater steps towards protecting these revenue generating and efficiency enabling systems."

As the number, size and complexity of web applications increases, so does the risk exposure, Hills warned.

The research shows that attackers focusing on web application security problems are actively developing tools and techniques to exploit the flaws.

NTA Monitor has made three key recommendations that organisations can follow to reduce their risk: