Topic starter
02/08/2026 11:25 am
TL;DR: Application security teams are under pressure to replace fragmented AST with broader posture management as software supply chains, developer-owned security, and cloud complexity widen exposure, according to OXSecurity. The real shift is from point-in-time scanning to continuous governance across code, pipelines, and runtime, where identity, access, and dependency trust now matter as much as vulnerability counts.
Editorial analysis by NHI Mgmt Group, based on content published by OXSecurity: “Unleashing the Power of Simplicity in Application Security (AppSec)”.
By the numbers:
- Between 40-80% of code in new software projects comes from third parties, according to OXSecurity.
- More than 40% of code in new software projects comes from third parties, according to OXSecurity.
Key questions
Q: What breaks when application security relies on fragmented AST tools?
A: Fragmented AST breaks when teams need continuous governance rather than isolated scans.
Q: Why does third-party code make posture-based AppSec more important?
A: Third-party code expands the trusted surface beyond what internal teams directly build or review.
Q: How can security teams tell whether Application Security Posture Management is working?
A: ASPM is working when teams can explain which issues matter, why they matter and where they sit in the delivery chain.
Practitioner guidance
- Map security controls across the full SDLC Define how code scanning, dependency analysis, pipeline checks and runtime monitoring relate to one another so teams are not relying on disconnected tools to represent the same risk.
- Bring machine identities into AppSec governance Inventory the secrets, service accounts and tokens used by build and deployment systems, then align their access scope with application delivery controls.
- Prioritise vulnerabilities by exploit path Use contextual analysis and attack path analysis to focus remediation on issues that are reachable, inherited from third parties or tied to production exposure.
Bottom line: Fragmented application security testing no longer matches the pace of modern delivery, especially when code, pipelines and cloud runtime change continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:42 pm
ASPM is becoming the control plane for application risk because AppSec has outgrown scan-centric thinking. Point-in-time AST can still find defects, but it cannot govern the relationships between code, pipeline and runtime that now define exposure. The more software delivery is automated, the more security has to operate continuously rather than episodically. Practitioners should treat posture management as a lifecycle control model, not a reporting layer.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: What should teams do when developer-owned security meets cloud delivery complexity?
A: Teams should formalise shared ownership without assuming developers can absorb every control manually. That means embedding security into workflows, governing machine identities used in delivery, and using posture data to focus attention on the few issues that truly increase blast radius. The aim is secure speed, not security as a separate gate.
👉 Read our full editorial: Application security posture management is replacing fragmented AST