Security is everybody's problem: The key to breaking the App Sec barrier.
Summary: PortSwigger Research argues that AppSec's separation from the rest of the business makes security enablement hard to achieve, and that responsibility for security must be shared across the technical organization rather than held by one team. The piece cites a skill shortage, manual testing that cannot keep pace with faster shipping, and shifting attack surfaces, and quotes Brandon, a career AppSec leader at Unity3d, saying security needs to become part of the development process the way QA did.
Why it matters: The article's core claim is that as long as one team owns all of security, everything that team proposes reads to the business as a blockade - so AppSec's effectiveness depends on whether developers and executives share the responsibility, not on the tools alone.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026