Application Security (AppSec).

Application Security covers all the people, processes and tools used to keep software free of exploitable weaknesses and able to defend itself in production. It spans threat modeling, secure design, secure coding standards, code review, automated testing (SAST, DAST, IAST, SCA), dependency hygiene and runtime protections such as WAFs and RASP. AppSec teams partner with engineering to integrate security gates into CI/CD pipelines so vulnerabilities are caught early, when they are cheapest to fix. The goal is not perfection but acceptable risk: balancing speed of delivery, attack surface and the business impact of a potential compromise.

The discipline gained urgency from incidents that turned a single code flaw into a mass breach. The 2017 Equifax compromise of roughly 147 million records traced to an unpatched Apache Struts remote-code-execution bug (CVE-2017-5638) — a software-composition and patch-management failure. Log4Shell (CVE-2021-44228, CVSS 10.0) then showed how one logging library could expose tens of thousands of organisations to remote code execution almost overnight, making software composition analysis (SCA) and a software bill of materials (SBOM) board-level concerns. Modern programs prioritise findings against the OWASP Top 10 (2021) and the CWE Top 25, and increasingly weigh real-world exploitability with EPSS and the CISA KEV catalog rather than CVSS alone.

flowchart LR
  A[Threat model & secure design] --> B[Secure coding]
  B --> C[SAST / SCA in CI]
  C --> D{Gate passes?}
  D -- No --> B
  D -- Yes --> E[DAST on staging]
  E --> F[Deploy]
  F --> G[Runtime: WAF / RASP]
  G --> H[Monitoring & feedback]
  H --> A

Mature AppSec shifts left for cheap early fixes while keeping runtime defences, because no pipeline catches everything. Core habits: pin and verify dependencies, enforce least privilege, parameterise queries, validate input and encode output, and feed production telemetry back into the next round of threat modeling.