The Human Element in AppSec: Why People Matter More Than Tools
By Matt Tesauro
When it comes to application security (AppSec), the conversation often revolves around the latest tools and technologies. While these advancements can play a critical role, true success in securing applications is rooted in something far more fundamental: the people driving these efforts. Whether managing a lean, agile security team or overseeing a larger, more complex department, one truth remains constant: tools alone will never be enough. It’s the expertise, collaboration and strategic mindset of the people behind AppSec that ultimately turn plans into real, actionable outcomes.
Focus on Fundamentals, Not Fads
The basics of AppSec haven’t changed in decades, even as buzzwords like “DevSecOps” and “ASPM” (Application Security Posture Management) gain traction. Trends and terminology come and go, but the principles of securing applications remain the same: identifying vulnerabilities, managing risks and ensuring secure development practices.
As tempting as it is to chase every new tool or framework, teams must focus on consistent execution of the fundamentals. For example, a recent Ponemon Institute study found that 60% of organizations experienced a breach caused by an unpatched vulnerability. This is a basic yet persistent problem that could have been prevented with effective vulnerability management. This statistic highlights a critical lesson: success in AppSec doesn’t hinge on new technologies alone, but on solidifying the foundational practices that reduce risk and safeguard applications.
Leveraging Tools as Enablers, Not Cures
While tools are not the cure-all for every AppSec challenge, they do play a valuable role in enabling teams to scale their efforts and streamline workflows. For example, vulnerability management platforms that aggregate data from multiple sources can empower teams to focus their attention on what matters most – mitigating risks and fixing issues. These tools become enablers of efficiency, allowing security professionals to prioritize and address vulnerabilities in a timely manner.
Automation is one area where the right tools can make a significant impact, especially in light of the ongoing talent gap in cybersecurity. According to Gartner, organizations that leverage automation in their security operations can reduce time spent on repetitive tasks by up to 80%. Automating routine activities like vulnerability triage, reporting and patch management not only saves time but also reduces human error, making it possible for security teams to redirect their efforts to higher-value tasks such as threat modeling, risk assessment and proactive security strategy development. This shift allows teams to be more agile and responsive to emerging threats without becoming bogged down by mundane tasks.
The Human-Centered Challenge of AppSec
At its core, AppSec is as much a human challenge as it is a technical one. The most advanced tools and platforms are only as effective as the individuals who wield them. A tool might be state-of-the-art, but if the team using it lacks the expertise or strategic focus to deploy it effectively, its potential remains unrealized. It’s essential to invest in building and nurturing talent and creating an environment where individuals can grow and thrive as part of a cohesive security program.
The key to long-term success in AppSec isn’t just about adopting the latest technologies or methodologies – it’s about empowering people. By ensuring that the right skills, mindset and collaborative spirit are in place, security leaders can create programs that are not only effective in the short term but resilient in the face of evolving threats. As cybersecurity continues to grow in complexity, the people who drive it forward will remain the ultimate differentiator.
Matt Tesauro is a DevSecOps and AppSec guru who specializes in creating security programs, leveraging automation to maximize team velocity and training emerging and senior security professionals. When not writing automation code in Go, Matt is pushing for DevSecOps everywhere via his involvement in open-source projects, presentations, trainings and new technology innovation.
As a versatile engineer, Matt’s background spans software development (primarily web development), Linux system administration, penetration testing and application / cloud security. He thrives on tackling industry defining technical problems.
Currently, as a Founder and CTO at DefectDojo Inc, Matt is making an already great vulnerability management platform even better. Matt is also on the OWASP Global Board of Directors helping to progress open source AppSec. Previously, he delved deep into API Security at Noname Security and rolled out AppSec automation at USAA. Early in his career, Matt served as Director of Community and Operations at the OWASP Foundation, Senior AppSec Engineer at Duo Security, Senior Software Security Engineer at Pearson and Senior Product Security Engineer at Rackspace.