Blog

Application security for the people accountable for it

Written for CISOs, security leaders and the executives they report to: where the industry is, what regulators expect, how to measure and run an AppSec programme, and worked use cases from code to cloud, with the diagrams and the screens.

The landscape

Where application security stands: the numbers, the market, the new AI surface and what regulators now expect.

The landscape For every reader

Why application security stopped scaling

More scanners, more findings, and no clearer answer to “are we safer?”

12 min read The landscape For CISOs & security leaders

ASPM, CNAPP, CSPM, CIEM: a market map for security leaders

Eleven acronyms, three real jobs, and where the categories are converging

13 min read The landscape For CISOs & security leaders

AI is three new attack surfaces, not one

AI-written code, AI-powered features and AI agents with tools

12 min read The landscape For executives & boards

What regulators now expect of your software

SEC disclosure, the EU Cyber Resilience Act, DORA, NIS2, PCI DSS 4.0 and the AI Act

14 min read The landscape For CISOs & security leaders

The opportunity: from finding problems to fixing them

Why the next three years belong to security teams that close the loop

11 min read

The CISO's operating model

What to measure, how to prioritise, who owns a vulnerability, and how to keep developers on side.

The CISO's operating model For AppSec & cloud security leads

CVSS is not a priority

Exploitation, exposure and business context, and a score that shows its work

13 min read The CISO's operating model For executives & boards

Board metrics for application security

From vulnerability counts to risk burn-down

12 min read The CISO's operating model For CISOs & security leaders

Who owns a vulnerability?

An operating model for AppSec, platform and product teams

11 min read The CISO's operating model For AppSec & cloud security leads

The developer trust budget

Every false alarm spends it. Every useful fix earns it back.

11 min read

Use cases, worked end to end

One real situation per post: what happens, who does what, and what the console shows at each step.

Use cases, worked end to end For every reader

From the internet to card data in four hops

How four medium findings add up to one critical attack path

12 min read Use cases, worked end to end For CISOs & security leaders

A new KEV on Friday afternoon

“Are we affected?” answered in minutes, not days

11 min read Use cases, worked end to end For AppSec & cloud security leads

The key in last year’s commit

Secrets in git history, and why deleting the file fixes nothing

10 min read Use cases, worked end to end For AppSec & cloud security leads

The API nobody documented

Shadow endpoints, dynamic testing and the gap between the spec and production

11 min read Use cases, worked end to end For CISOs & security leaders

Securing AI agents: a CISO’s playbook

Inventory, least privilege and a policy check before every tool call

14 min read Use cases, worked end to end For AppSec & cloud security leads

A shell in production

When a runtime alert meets a known vulnerability

10 min read Use cases, worked end to end For AppSec & cloud security leads

The role that could do anything

Cloud identities, blast radius and least privilege from real usage

11 min read Use cases, worked end to end For CISOs & security leaders

Audit preparation from evidence, not spreadsheets

PCI DSS 4.0, SOC 2 and ISO 27001 from the findings you already have

10 min read

Adopting it

The business case, the buying decision and the first ninety days.

Adopting it For executives & boards

Building the business case for ASPM

The cost of noise, the cost of a breach, and the cost of tools that overlap

12 min read Adopting it For CISOs & security leaders

Consolidate, integrate or build?

The ASPM buying decision, including when building is right

11 min read Adopting it For CISOs & security leaders

The first ninety days

From first scan to a board-ready risk number

12 min read

See it on your own estate

Stop reading about it

Bring two repositories and one cloud account to a working session and see the funnel, the paths and the fixes on your own estate.

Request a demo