Having ASPM your Way: How to Avoid the Trough of Disillusionment

The speaker, a long-time AppSec practitioner, questions whether application security posture management (ASPM) is a genuinely new discipline. He compares analyst and vendor definitions with core AppSec ideas he has applied for years, such as visibility, risk assessment, prioritization and automation, and finds little beyond a new label. He also notes how crowded the vendor market has become, with many products claiming the term.

He then turns to the practical value he sees. The main benefit, in his view, is budget: leaders respond to the buzz, so practitioners can use it to argue for funding. He lays out first principles: favor broad coverage over deep testing, collect metrics early so trends can be shown, build a complete application inventory as a single source of truth, and confirm an owner for every application. He also stresses empathy with development teams, including rotating roles so people understand the work involved. He walks through a pipeline that grows from an internal intake-triage-test-deliver process into event-driven scans that feed a central findings platform. He shares a case where testing volume rose sharply over two years through small, repeated improvements.

He closes with takeaways: automate repetitive work, treat people as the scarcest resource, start with tools you can run without heavy dependence on other teams, and select only the parts of the ASPM market that fit your own context.