Application Security Monitoring

The Problem with a Production Application

You can only manage what you measure.

Until recently, we knew little to nothing about the state of security inside a running application – unless developers built in custom logging. Without security visibility, security pros would typically:

• Hope the developers wrote secure code
• Harden the platform (e.g., OS, server, container) the application is running on and hope nothing gets through
• Deploy an edge device (e.g., IPS, WAF) and hope blocking suspicious traffic is sufficient
• Hope your SOC finds the attack in time
• Hope that your incident response team can respond effectively