Maturing Your Application Security Program

Tanya Janca opens by noting that many teams asking what comes next for their application security work find formal maturity frameworks such as SAMM, BSIMM, NIST and DSOMM out of reach. Drawing on close to 400 AppSec teams she has consulted with, she argues that programs should start smaller and build up from where they actually are.

She walks through three program types she sees often. The first relies on penetration testing a handful of critical applications and fixing findings at the end, which leaves coverage thin, costs high, and gives developers little help. The second is tool-heavy: teams hold SAST and DAST licences but roll them out only partly, report large backlogs, and do little to engage developers. The third has every tool and plenty of staff, yet heavy governance and friction leave developers and security at odds and slow every release.

For each model she gives concrete steps. Early on these include free scanners, a basic secure coding guideline, consolidating code into one place, threat modelling, and a simple way to report incidents. Later steps include balancing hires between testers and collaborative AppSec staff, reviewing tools every two years, finishing rollouts, and turning guidelines into developer-friendly standards. Her closing takeaways centre on building trust with developers, automating routine scans, and using the data a program already produces.