Dynamic application testing and API security
DAST & API security
Practical guides to authenticated DAST, route coverage and API inventory: verify what was tested, what is exposed and what remains unknown.
- SSRF prevention: review a webhook delivery workerReview SSRF prevention in webhook workers with destination controls, redirect handling, isolated tests and evidence for release decisions. · Sujan Singh
- API authorisation: test your tenant boundariesBuild API authorisation tests around identity, tenant, object and action, using controlled fixtures to verify both allowed operations and denied access. · Sujan Singh
- API inventory: find undocumented endpoints safelyBuild an API inventory from specifications, source routes and deployment evidence, then assign ownership and review undocumented or retired endpoints. · Sujan Singh
- Authenticated DAST: prove what your scan reachedCheck authenticated DAST coverage with session verification, role-specific routes and a reproducible test record before trusting a quiet scan report. · Sujan Singh
Application security posture management
ASPM
Correlating findings from SAST, SCA, secrets, IaC and container scanning into one prioritised view tied to the code and workloads they affect.
- ASPM vs CNAPP vs CSPM: what each covers and when to buyASPM vs CNAPP vs CSPM explained: where each category starts, what it covers and misses, where they overlap, and how to choose which you need first. · Sujan Singh
- Code-to-runtime security: a coverage checklistMap code-to-runtime security across source, builds, images, deployment and running workloads, with an evidence checklist for your evaluation. · Sujan Singh
- How to evaluate ASPM tools: a buyer's criteria checklistHow to evaluate ASPM tools on correlation, reachability, deduplication, gates, evidence and deployment model, with tests for your own proof of concept. · Sujan Singh
- Security finding correlation: one graph, not five queuesCorrelate security findings from SAST, SCA, container, IaC and cloud scanners on one graph, so each vulnerability becomes one ranked, routed finding. · Sujan Singh
- What is ASPM? Application security posture managementASPM connects scanner findings with code and deployment context, helping engineering, security and compliance teams prioritise and review remediation. · Sujan Singh
Static application security testing
SAST
Finding vulnerabilities in source code without running it: taint analysis, per-language engines and keeping the signal above the noise.
- SAST remediation: write tests that protect the fixTurn a SAST finding into a focused remediation test that checks the dangerous data flow, preserves valid behaviour and catches future regressions. · Sujan Singh
- SAST vs SCA vs secrets scanning: what each one catchesSAST vs SCA vs secrets scanning compared: what each inspects, what it misses, when it should run and who fixes its findings, with one shared example. · Sujan Singh
- Reducing SAST false positives without hiding real bugsReduce SAST review noise with better rules, reachability context and reason-coded triage, while keeping real weaknesses visible for reassessment. · Sujan Singh
- SAST taint analysis explained: sources, sinks, sanitisersLearn how SAST taint analysis traces untrusted input from source to sink, why it beats pattern matching on noise, and where its blind spots are. · Sujan Singh
Software composition analysis and SBOM
SCA & SBOM
Open-source dependencies, their known vulnerabilities and licences, and the bill of materials that records what actually shipped.
- SBOM diff: review what changed before a releaseUse an SBOM diff to review added, removed and changed dependencies, preserve component identity and distinguish inventory gaps from release changes. · Sujan Singh
- What is an SBOM? Formats, generation and VEX explainedLearn what an SBOM contains, how CycloneDX and SPDX differ, where to generate one, and how VEX communicates product-specific vulnerability assessments. · Sujan Singh
- New CVE response: use SBOMs to find which images shipped itUse retained SBOMs and workload links to investigate which images contain a newly disclosed vulnerability, then identify gaps that need further scanning. · Sujan Singh
- SCA vs SBOM: what each answers and why you need bothSCA tells you which components are vulnerable today; an SBOM records what shipped. Learn how SCA and SBOM work together to answer advisory questions. · Sujan Singh
Secrets detection
Secrets detection
Credentials in git history, CI logs and image layers: finding them, rotating them and proving the rotation happened.
- Security logging: test what leaves your applicationReview security logging with synthetic secrets, export-path checks and failure tests while preserving useful evidence for incident investigation. · Sujan Singh
- Secret rotation: verify every consumer switchedPlan secret rotation around consumer inventory, controlled cutover and revocation evidence so an updated secret does not leave old credentials usable. · Sujan Singh
- Leaked secret response: rotate, trace, then prevent repeatsDeleting a leaked secret from HEAD is not remediation. The response that works: rotate first, trace affected images, keep evidence and gate repeats. · Sujan Singh
- Secrets detection beyond HEAD: git history, CI logs, imagesSecrets detection that only scans HEAD misses real leaks. Where credentials hide in git history, CI logs and image layers, and how to verify them safely. · Sujan Singh
Infrastructure-as-code scanning
IaC scanning
Terraform, Kubernetes manifests and Helm charts checked before apply, and linked to the resources they become.
- Terraform drift: reconcile an emergency changeReview Terraform drift after an emergency change by comparing configuration, state and live resources before choosing a controlled reconciliation. · Sujan Singh
- IaC drift: close findings on live evidence, not on mergeIaC drift means a merged fix is not a deployed one. Link each IaC finding to the cloud resource it created and close it on evidence from the account. · Sujan Singh
- IaC scanning before apply: catch misconfigurations in the PRIaC scanning catches Terraform, Kubernetes and CloudFormation misconfigurations at pull-request time, while the fix is still a one-line change. · Sujan Singh
Container image security
Container security
Image layers, base images and the binding between an image digest and the workload that runs it.
- Open-source container image scanners: Trivy, Grype, SyftOpen-source container image scanning tools compared: what Trivy, Grype, Syft and Dockle each find, where they disagree, and how to run them in CI. · Sujan Singh
- Build provenance: verify the image you deployVerify container build provenance against the image digest, trusted builder and approved source, then retain the evidence behind deployment decisions. · Sujan Singh
- How to prioritise container vulnerabilities: KEV, EPSS, reachPrioritise container vulnerabilities with CISA KEV, FIRST EPSS, reachability and image-to-workload exposure, so the short list is what attackers would use. · Sujan Singh
- Container image scanning: layers, base images and real fixesContainer image scanning that separates base-image, OS package and application dependency findings, so each goes to the team that can fix it. · Sujan Singh
- Container images to workloads: bind by digest, not by tagBind container images to workloads by digest, so vulnerabilities are prioritised by what is deployed and reachable, not by what sits in a registry. · Sujan Singh
Cloud security posture management
CSPM
Cloud account misconfiguration and exposure, drift, posture SLAs and attack paths that combine posture with workloads and identity.
- Open-source CSPM tools: Prowler, ScoutSuite and beyondAn honest guide to open-source CSPM tools: what Prowler, ScoutSuite, Cloud Custodian, Steampipe and Trivy each do, and where a correlation layer fits. · Sujan Singh
- Cloud attack paths: chaining posture, workload and identityLearn how cloud attack paths chain posture, workload and identity findings into one route, so you can close the link that matters first. · Sujan Singh
- CSPM beyond misconfiguration lists: rank by exposureCSPM finds misconfigurations; this guide shows how ownership, exposure ranking and drift SLAs turn that list into fixes teams actually ship. · Sujan Singh
Cloud infrastructure entitlement management
CIEM
Which identities can assume which roles and reach which data, modelled as edges rather than a quarterly access review.
- Cloud permission changes: prove access was reducedVerify cloud permission reductions with scoped access tests, session checks and fresh evidence, so an approved change becomes a defensible closure. · Sujan Singh
- Cloud access review: verify unused permissionsReview unused cloud permissions using ownership, observation scope and tests, without confusing missing activity with proof of unnecessary access. · Sujan Singh
- What is CIEM? Cloud infrastructure entitlement managementWhat is CIEM? How cloud infrastructure entitlement management finds excess permissions across human and machine identities, and how it differs from IAM. · Sujan Singh
- Excess privilege in the cloud: model it as graph edgesFind excess cloud privilege by modelling identities, roles and trust policies as graph edges you can walk, rank and cut, not rows in an access review. · Sujan Singh
- Identity attack paths: from assumable role to data storeTrace identity attack paths from a workload identity through assumable roles and trust policies to the data store it can reach, then cut one edge. · Sujan Singh
Kubernetes security posture management
KSPM
Cluster inventory, topology, admission control and drift between manifests in git and live cluster state.
- Kubernetes service accounts: audit workload accessAudit Kubernetes service accounts by tracing token mounts, effective permissions and workload ownership, then verify that access changes work. · Sujan Singh
- Kubernetes NetworkPolicy: test workload isolationVerify Kubernetes NetworkPolicy with an explicit traffic matrix, allowed and denied probes, and evidence that distinguishes policy from network failure. · Sujan Singh
- KSPM: why Kubernetes posture starts with inventoryKSPM starts with a live inventory of clusters, workloads and RBAC. Learn how inventory, topology and admission control turn posture into enforcement. · Sujan Singh
- Kubernetes admission gates and the cluster drift problemKubernetes admission gates decide what runs, but drift undoes them. Learn what to gate on and how to keep the live cluster matching git. · Sujan Singh
Policy as code and deployment gates
Policy-as-code gates
Gates at pull request, pipeline and admission time, written as policy, explainable, recorded and fail-closed.
- Rollback security: reassess the release you restoreReview rollback security with exact artefact identity, current evidence and dependency checks so an older release does not inherit an outdated approval. · Sujan Singh
- Policy-as-code testing: verify release decisionsTest policy-as-code release decisions with explicit inputs, negative fixtures and failure cases before promoting a gate into the delivery workflow. · Sujan Singh
- Fail-closed deployment gates: why severity counts failFail-closed gates built on severity counts get routed around. Use reachability, exposure, ownership and recorded overrides to keep them trusted. · Sujan Singh
- Policy as code for deployment gates with OPA and RegoPolicy as code with OPA and Rego turns deployment gates into testable rules that explain every decision at pull request, pipeline and admission. · Sujan Singh
Continuous compliance automation
Continuous compliance
Control status derived from scan evidence as scans complete, cross-walked across frameworks, with auditor access to the evidence itself.
- Audit evidence sampling: account for the missing recordsBuild a reviewable audit evidence sample by defining its population, explaining exclusions and reconciling missing records before drawing conclusions. · Sujan Singh
- Audit evidence freshness: review what still holdsAssess audit evidence freshness using collection scope, change events and accountable review, so an old successful check does not imply current assurance. · Sujan Singh
- How to automate SOC 2 evidence collection from your pipelineAutomate SOC 2 evidence collection from CI pipelines, cloud accounts and triage decisions, so Type II sampling becomes a query instead of a hunt. · Sujan Singh
- Continuous compliance: live evidence, not screenshot foldersContinuous compliance re-evaluates control status from scan evidence, so audit preparation becomes a review of signed records, not a screenshot hunt. · Sujan Singh
- Framework cross-walks: one evidence chain for every auditFramework cross-walks help teams reuse audit evidence across shared controls while checking differences in scope, coverage and assessment requirements. · Sujan Singh
Risk-based vulnerability management
Vulnerability management
Reachability and exposure before severity counts, ownership derived from the graph, and closure by evidence.
- Scanner coverage: account for missing scan runsReview scanner coverage against expected assets, completed runs and evidence freshness, so a quiet findings queue does not conceal missing assessments. · Sujan Singh
- Vulnerability exceptions: review what changedReview vulnerability exceptions against changed assets, exposure and evidence, so a temporary acceptance does not quietly become permanent closure. · Sujan Singh
- Vulnerability ownership: make team handoffs explicitMake vulnerability ownership transfers explicit, with acceptance criteria, escalation and retained evidence so security work survives team changes. · Sujan Singh
- Vulnerability remediation: prove the fix is liveVerify vulnerability remediation from source change to deployed artefact, with clear closure criteria for rescans, rollout gaps and temporary mitigation. · Sujan Singh
- Risk-based vulnerability management: rank by reachabilityRisk-based vulnerability management ranks findings by reachability and exposure, turning a thousand CVSS criticals into a short list worth fixing now. · Sujan Singh
- Vulnerability ownership: route findings by the graphVulnerability ownership belongs in the graph, not a spreadsheet. Route each finding to the team that can fix it and close it on scan evidence. · Sujan Singh
See it on your stack
See connected security in action.
Explore the workflow with your engineering, security and compliance teams. No repository access is needed for the initial demonstration.