Skip to main content

Topic hub

AppSec

Reviewed articles, glossary entries, and product proof related to appsec. Every claim carries a source.

Articles

  1. AppSec

    The bottleneck moved: secure software engineering in the age of coding agents

    When machines can generate code at machine speed, security cannot remain a human-speed review process. What replaces the manual gate: intent, policy, evidence, independence, and feedback.

    Ahsan Mir10 min read

  2. AppSec

    AI-assisted PR review for AppSec: what defensible evidence looks like when software moves at AI speed

    AI-assisted PR review sits alongside SAST, SCA, testing, and human security engineering. The important question is no longer whether an AI reviewer can produce comments. It is whether the organization can prove what was reviewed, why a finding was raised, what evidence supports it, and whether the risk was actually removed before merge.

    Rapticore Editorial14 min read

  3. AppSec

    Long live threat modeling

    In the age of cloud-native applications and CI/CD, the static, waterfall design review is dead and threat modeling has become the bottleneck. What an automated, continuous threat model has to do instead.

    Ahsan Mir5 min read

  4. AppSec

    Working your flanks: a new approach to application security

    The second part of the application security series. Move investment to the left and right of the SDL — threat modeling and NFRs on one side, runtime protection and continuous testing on the other — and treat SAST, DAST and training as measures, not gates.

    Ahsan Mir6 min read

  5. AppSec

    Seven common mistakes of secure software development programs

    Why multi-year secure software development programs so often show little reduction in risk: no measurable goal, too much faith in training and scanners, too little in design — and how to move the investment to where it counts.

    Ahsan Mir6 min read

From the glossary

  • Attack path — An attack path is the ordered sequence of steps — pivots, credentials, misconfigurations, and reachable network edges — that an attacker would traverse from a foothold to a business-critical asset. Attack paths are more actionable than isolated findings because they explain which fixes actually reduce reachable risk.
  • Exposure — Exposure is the subset of an organization’s attack surface that is reachable from the internet — including domains, records, certificates, services, and dependent third parties — and that could serve as an entry point for an adversary.
  • Authorized validation — Authorized validation is the practice of confirming an exposure by executing a scoped, permissioned check against the target — reproducing the evidence an attacker would see without harming the target or leaving persistent artifacts.
  • Guardrail — A guardrail is a preventive control that blocks a risky change at the boundary — for example, a policy that prevents a cloud identity from being created with wildcard permissions. Guardrails succeed by narrowing the space of possible misconfigurations rather than reacting to them after the fact.
  • Cloud posture — Cloud posture is the aggregate configuration state of an organization’s cloud environment — resources, identities, networks, and controls — measured against a defined policy baseline and expressed as a set of prioritized findings.