Application Security Backlog Management Guide

This guide outlines a three-step process to effectively manage and reduce the application security (AppSec) backlog using runtime context. It begins by emphasizing the importance of identifying exploitable vulnerabilities in production environments through the Contrast Graph, which provides a live map of application routes and connections. The first step involves collapsing the backlog by prioritizing vulnerabilities based on their exploitability, allowing teams to focus on the most critical issues. The second step recommends enabling structural in-process blocking to defend against potential exploits while fixes are being implemented. The final step encourages continuous validation of fixes to ensure that vulnerabilities are effectively addressed. Additionally, the guide poses essential questions for organizations to consider before purchasing or renewing security solutions, focusing on exploitability measurement and the ability to protect flaws without immediate patches. The document provides a comprehensive approach to enhancing application security and managing vulnerabilities efficiently.