Sponsored by Invicti

Organizations are coming to realize the difference between running the occasional pentest or vulnerability scan and having an effective application security program. In the long run, in-house automated testing with integrated vulnerability management is not only better for security but also cheaper and more efficient.

Building a quality DAST solution into their services as a cornerstone of their application security offering can help MSSPs not only enhance their customers’ security posture but also build customer loyalty, support compliance requirements, and expand revenue sources.

Organizations worldwide are reporting data breaches resulting from attacks on the popular MOVEit Transfer web application for managed file transfers. After gaining a foothold via an SQL injection vulnerability, attackers install a web shell and extract any data they can find. This post summarizes what is currently known about the ongoing attacks, breaches, and remediation methods.

Everyday application design decisions can result in API endpoints popping up all over your web environment. This post shows how and why this can happen even in a very basic scenario, examines the tradeoffs between running local code and using a web service for the same job, and suggests ways to maintain application security regardless of the specific technologies, architectures, and languages used.

The European Union Agency for Cybersecurity (ENISA) has published a report on potential cybersecurity threats for 2030, trying to anticipate future security risks based on current trends and expert opinions. While some of the less likely predictions may touch on science fiction, the top two anticipated threats are already with us today: software supply chain compromises and AI-enhanced disinformation campaigns.

Despite surges in some severe vulnerabilities, Invicti customers are reaping the benefits of increased scanning as they find more, fix more, and reduce risk overall. Read on for a few key insights from the Spring Invicti AppSec Indicator, and then get the full report to gain a deeper understanding of current vulnerability trends, ideal best practices, and industry breakdowns from our data.

Securing third-party code that makes up the majority of any modern web application is always a challenge – and even more so if you want ISO 27001 compliance. The current edition of the standard specifies security requirements across the entire lifecycle of third-party code.

As the AI feeding frenzy continues, there is a lot of speculation and scaremongering out there, especially in terms of security. This post sets the record straight on some of the crucial ways that AI relates to application security, based on the points raised by Invicti’s Frank Catucci on Application Security Weekly #234.

Betting big on cybersecurity this year? With a carefully planned budget for application scanning tools, you can reduce risk, prepare employees, and boost customer confidence – all without wasting a penny.

Application security can get noisy, especially when organizations are balancing multiple tools of varying quality and integration levels. Luckily, you don’t have to be Marie Kondo to declutter your web AppSec program – provided you use accurate DAST and build it into your workflows.