Weak configurations for encryption and missing security headers topped the list of software issues found during a variety of penetration and application security tests.