Servers still exist, but the platform looks after them. You write a function, the platform gives it a URL or wires it to an event, runs it when needed and scales it for you. API routes in a Next.js app on Vercel, Netlify Functions, AWS Lambda and Supabase Edge Functions are all versions of this. Most AI-built apps have no other backend.
Serverless removes server patching from your list, but it does not remove application security. OWASP maintains a serverless interpretation of its Top 10 because the same flaws apply: injection, broken authentication, exposed sensitive data and broken access control. Each function is its own small public entry point, so an app with thirty functions has thirty doors, and generated code tends to protect the ones attached to visible pages and forget the rest.
Give every function its own authentication and input validation instead of assuming another layer did it. Keep secrets in the platform's environment settings. Give each function only the permissions it needs, and set limits on execution time and request rate so that a flood of calls cannot run up a large bill.