PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

HackerOne Champion of the Quarter: monday.com's Amit Levy on Thinking Like an Attacker to Defend Like a Pro

hackerone.com | blog | #ai-security | #bug-bounty | #appsec | #metrics | #hackerone | #sdlc | #adversarial-testing | #monday-com
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

monday.com's AppSec lead Amit Levy explains how embedding adversarial testing into the SDLC and thinking like an attacker transformed his team's posture and earned genuine engineering buy-in.
Published
Collected

Related coverage

blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
New CTEM Metrics That Matter: How to Brief Your Board on AI-Accelerated Exposure
HackerOne argues vulnerability counts no longer brief boards well and proposes CTEM metrics like Time to Validate, as AI-accelerated discovery compresses exploitation timelines.
blog · netspi.com
A Checklist for Application Security Program Maturity
A phased checklist for building AppSec maturity: keep practices current with SDLC and DevOps changes, benchmark against industry data, and use roadmaps to prioritize remediation.
blog · netspi.com
Build Strong Relationships Between Development and Application Security Teams to Find and Fix Vulnerabilities Faster
Bridging the DevSecOps divide: with 71% of AppSec pros citing developers who skip early security work, the post urges empathy and shared incentives between development and security teams.
blog · netspi.com
Four Application Security Myths – Debunked
Debunks four application security myths—'an AppSec team is optional,' 'we're too small'—and shows how small teams, governance, and security champions programs can embed security into the SDLC.
blog · netspi.com
Make it Easy on the Development Team
NetSPI examines why development and application security teams clash over deadlines and findings, offering five steps to make security testing participation easier and less adversarial for developers.
Back