Application security starts at design, not at testing. The later a weakness is found, the more expensive it is to fix.<\/p>\n
Threat modelling at design time, secure coding and code review during development, automated checks in the pipeline and monitoring in production all interlock. If one link fails, the chain does not hold.<\/p>\n","protected":false},"featured_media":0,"template":"","glossary_intl_set":[],"glossary_intl_cluster":[392],"glossary_intl_theme":[],"class_list":["post-29153","glossary_intl","type-glossary_intl","status-publish","hentry","glossary_intl_cluster-cybersecurity"],"acf":{"card_description":"Protecting software from threats across its whole lifecycle.","nav_theme":"","nav_subtheme":"","dataset_version":"","term_inline":"","term_plural":false,"heading_overrides":null,"synonyms":null,"lead_definition":"Application security covers every measure that protects software from threats \u2013 from design through development and operation to decommissioning. It ties secure coding, testing tools and processes into one continuous chain.","at_a_glance":[{"bullet":"
Security belongs in the design<\/b>, not in the acceptance test.<\/p>\n"},{"bullet":"
Automated checks in the pipeline catch the bulk of standard mistakes.<\/p>\n"},{"bullet":"
Third-party libraries are part of your application \u2013 and of your responsibility.<\/p>\n"}],"intro_answer":"","steps_answer":"","steps":null,"examples":[{"example":"A code review catches an SQL injection before the code ever reaches production."},{"example":"A dependency scan flags a known weakness in a library that was pulled in."}],"misconception":[{"myth":"\u201cA penetration test at the end is enough.\u201d","reality":"A test at the end finds what is still there \u2013 it prevents nothing. The cheapest corrections happen at design time."}],"faq":[{"q":"Where does application security begin?","a":"At design. The ten most common classes of flaw are listed in the OWASP Top Ten<\/a>."},{"q":"Is one tool enough?","a":"No. Static analysis, dependency scanning and runtime testing each find different faults; the BSI IT-Grundschutz<\/a> describes how they fit together."}],"compare_answer":"","compare":null,"variants":null,"signals_answer":"","signals":null,"protect_answer":"","prevent":null,"incident":null,"related_terms":null,"pillar_link":null,"sources":[{"publisher":"","name":"OWASP Top Ten","url":"https:\/\/owasp.org\/www-project-top-ten\/","doc_type":"","group":"used"},{"publisher":"","name":"BSI IT-Grundschutz","url":"https:\/\/www.bsi.bund.de\/DE\/Themen\/Unternehmen-und-Organisationen\/Standards-und-Zertifizierung\/IT-Grundschutz\/it-grundschutz_node.html","doc_type":"","group":"used"}],"reviewer":{"name":"Jakub Novak","qualification":"IT security","date":"2026-06-01"},"disclaimer":""},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t