Six Activities to Jump Start Your Application Security Journey

Debunks four application security myths—'an AppSec team is optional,' 'we're too small'—and shows how small teams, governance, and security champions programs can embed security into the SDLC.

Kicks off a series on building an application security program, emphasizing policies, standards, and procedures as the foundation before tooling, with placement guidance in existing portfolios.

NetSPI consultant Tyler Sullivan recounts his path to CREST certification, from CPSA and CRT exams to CCT, explaining why the respected accreditation strengthens client trust across EMEA.

The 2023 OWASP API Security Top 10 keeps BOLA and Broken Authentication on top while adding SSRF, unrestricted resource consumption, and unsafe API consumption; industry pros react.

API security remains underprioritized as usage surges; the 2023 OWASP API Security Top 10 still leads with BOLA and broken authentication, and manual testing is needed where scanners fall short.

Podcast talk on shift-left application security: moving tests earlier saves time and money but strains teams, and contextual pentesting with better asset prioritization eases AppSec friction.