A self-hosted application is software that an organization runs on infrastructure it controls, such as its own servers or a cloud environment it manages. Unlike a vendor-hosted service, the customer is responsible for operating the application and typically for applying updates, configuring access, and protecting the underlying environment.
In cyber security, self-hosting gives organizations more control but also more operational responsibility. An unpatched flaw in a self-hosted web application, such as a content management system, can expose the customer’s server to attack. If an authenticated vulnerability enables code execution, an attacker with valid access may be able to run code under the application’s permissions. Defenses include tracking software versions, applying security updates promptly, limiting account privileges, and monitoring application and server activity.