SHOW ME THE (AppSec) DATA!!!

Too often, application security decisions are made based on opinion or anecdotes. Application security professionals can help their leaders to make educated decisions about investment and resource allocation for activities like penetration testing, by evaluating relevant data points and taking a data-driven approach to decision making.

This week, Mike Shema published a blog post highlighting the signal and noise relationship in the findings reported via Cobalt's crowdsourced security platform.

Specifically, the post presents a visualization of the acceptance state of vulnerabilities reported in 2016 through both bug bounty and pen test programs. It compares the number of duplicate, invalid, new, out of scope, triage, and valid findings.

Check it out here.

For more from Mike, register for his AppSec Reanimated webinar series.