Cryptographic API Misuses in Industry: A Case Study on Prevalence and Remediation

Correct use of cryptographic APIs is crucial for data security in enterprise systems, yet remains challenging. This paper reports our experience applying CogniCrypt and CryptoGuard to detect cryptographic API misuses in 17 Java artifacts from a large agricultural research company. We identified 67 vulnerabilities—primarily involving insecure modes (e.g., AES/ECB) and key management issues—with 34 concentrated in a shared architectural component. Through a developer focus group and manual remediation, we assessed the tools’ effectiveness and developers’ perceptions, highlighting challenges in Static Application Security Testing (SAST) adoption and legacy code maintenance. As a practical contribution, we share our experience fixing the vulnerabilities and outline a migration strategy—necessary to ensure continued system functionality—that supports algorithm coexistence during and API compatibility.