Abstract: A discovery driven web-based application resource security analyzer (“resource security analyzer”) can be designed that learns the protection status of application resources and the desired protection status of application resources and rectifies differences between the protection status and desired protection status. The resource security analyzer can do this efficiently at an enterprise scale. When initialized, the resource security analyzer goes through a learning phase, wherein an agent(s) of the resource security analyzer discovers the resources accessed by the application requests. The resource security analyzer determines the protection status. A report on the protection statuses of the resources is generated and displayed.