Are We Ready for a Security Software Assurance Program?

Outsourcing guides rarely address security: require secure coding training, put security reviews in contracts, and demand a penetration test plus code review with mitigation before release.

Five steps for an effective secure code review program: build security culture with developers, rotate reviewers, standardize processes and tooling, and catch vulnerabilities before deployment.

Four myths hold back application security programs, from 'AppSec teams are optional' to 'DevOps shops do not need one'; successful journeys start with a central governing team and defect discovery.

Automated scanners like Fortify and Checkmarx satisfy PCI DSS 6.3.2 but miss flaws found in manual review, especially authentication bugs, and false positives often overwhelm developers.

A New Year reminder that code review and penetration testing each miss vulnerabilities the other finds, so organizations should do both and remediate findings instead of delaying fixes.

Argues repeatedly scanning stable complex web apps adds little value; testing should follow the release cycle and prioritize manual assessment of flaws like business logic errors.