In 30 seconds
- Test for vulnerabilities throughout development.
- Mix automated scans with expert testing.
- Shift left: catch issues early when they're cheap to fix.
Main types
| Type | What it checks |
|---|---|
| Static analysis (SAST) | Source code for risky patterns |
| Dynamic analysis (DAST) | The running app for exploitable flaws |
| Dependency scanning | Libraries with known vulnerabilities |
| Penetration testing | Experts attempting real attacks |
Shifting left
- Run scans automatically in the pipeline
- Add security checks to the Definition of Done
- Write security-focused acceptance criteria for sensitive features
- Use the OWASP Top 10 as a shared checklist
Who's responsible
Security is part of the whole team's job, with specialists coaching and doing deeper testing. This approach is often called DevSecOps.
Myth vs reality
Myth · Security is a separate team's job.
Reality · Everyone shares it; specialists guide.
Myth · A yearly pen test is enough.
Reality · Vulnerabilities appear with every change.
Myth · Scanners find everything.
Reality · Logic flaws need human testing.
FAQ
What's the OWASP Top 10?
A widely used list of the most critical web application security risks.
What's DevSecOps?
Building security into DevOps practices from the start.
How often should we pen test?
At least before major releases and periodically, based on risk.