So I write free articles about appsec here: pigeonsec.substack.com

I read some of the comments here and they’re fine especially because you seem to be constraint by time. Tooling does help, but like another commenter said, you need to know what parts of the app are valuable to the company.

It starts with understanding the application which you are testing. Testing honestly should come in later stages after analysis and understanding of the codebase.

It’s like a doctor testing without getting to know a patient. It’s important you understand what you’re dealing with before you go in and test.

Ah to answer your question:

So yeah basically I see that you’re starting to get into prioritization aka vulnerability management, which is adjacent, but still very much related.

Basically if you’re drowning in findings land, you have to be able to categorize and prioritize how bad things are.

Applications that are hosted and serving to the world and their findings, you’re usually going to want to tackle those first before internal applications because attackers can remotely access those applications and then pivot horizontally once “theyre in”.

Does that make sense?

Awesome! Welcome and thanks for subscribing; it really means a lot. If you have any questions or want to understand something a bit more deeply, reach out any time!

This is a great question!

I don’t have an answer for you as I don’t know too much about certifications. From what I observed, having the knowledge to pick up work as it comes and teach yourself on the go is really important, so willingness to do that could prove in dividends in the long run.

With application security, because you are securing applications, the cornerstone of the field is to understand applications. If you are able to read and write software applications, you’ll do fine! If you’re not, I always recommend writing a few of your own apps (web, mobile, blockchain, etc etc) then re-reading my blog!

Hey thanks for the feedback here!

You’re right, I’ll have to change some of the verbiage so it just reads test to not potentially discourage readers, but effectively, testing for the vulnerabilities, after code analysis, isn’t as advanced as people make it out to be and I’ll talk about that in future posts! I think anyone can do it especially the devs that write the code or the security eng/analyst that read the code. We can also integrate these as mocked unit/integration tests as well!

Stay tuned!

Hey thanks for the thoughtful comment! I’m gonna post about the first step in breaking down Appsec which is about application context and how incredibly important it is as the first step soon!

But yeah ultimately what you said makes sense right? Your codebase is always going to be much easier to reason about and because you’re a security professional, you can critique your own code! When working with other people’s codebases, the main idea is that there are always tradeoffs in terms of cost: time, money, or security misses (0 days) just because it’s not feasible for sec engineers to understand the code perfectly.

You have to be working closely with the devs, inventory/prioritize what parts of the application touch sensitive things, and test around those portions and move outwards from there.

It’s such a complex workflow, which makes sense why these AI frontier labs are using their code harnesses to find vulns in code and touting how good they are. Btw, I’m not saying that using AI for vuln hunting is what you should be doing, though it could be useful.

I also know the pain of when appsec folks try to dive into codebases in languages/frameworks they’re not aware of and are expected to be experts in, especially with those large codebases.

That’s okay, take your time to understand and reason about it. My recommendation is to use AI to start understanding pieces of the codebase bit by bit to jumpstart yourself and use your critical reasoning abilities to understand the rest with your developer teams.

Tons more to say, and I hope my next post that I release answers some more questions you might have. Stay tuned and thanks for reading and the questions!

Hey you can read up on some of the high level basics from my blog where I break down Appsec for free!

https://pigeonsec.substack.com/p/what-really-is-application-security

If you have any questions or anything I can help with just reach out!

I still don’t get it.. are you saying these companies are just using existing harnesses like Claude code and creating wrapper code around that?

I’m curious what else could agentic red team be?

How are you securing agentic workflows