Topic starter
18/08/2026 2:18 pm
TL;DR: Effective application security depends less on warnings than on training that uses real vulnerabilities, shows concrete impact, and resets the relationship between security and developers, according to Probely. The practical lesson is that AppSec governance fails when teams treat discovery as blame rather than as a shared control to improve.
Editorial analysis by NHI Mgmt Group, based on content published by Probely: “Balancing Act: The Six Keys to Successfully Navigating Security and App Development Team Tensions”.
Key questions
Q: What breaks when AppSec training uses only generic examples?
A: Generic examples usually fail to change developer behaviour because they do not feel operationally real.
Q: Why does showing exploit impact improve developer buy-in?
A: Developers often prioritise work based on visible consequences, not abstract severity labels.
Q: What do security teams get wrong about mobile AppSec findings?
A: They often treat every alert as equally urgent.
Practitioner guidance
- Use internal vulnerability examples in training Build sessions around defects your own teams found in code, not only textbook examples.
- Show exploit paths, not just scan results Demonstrate what an attacker can do with the flaw, such as session hijacking or sensitive data access, so the team understands why remediation matters.
- Remove stigma from vulnerability discovery Frame discovered flaws as expected engineering outcomes that must be found and removed, not evidence that a developer failed personally.
Bottom line: AppSec training is most effective when it uses examples from the organisation’s own code and avoids turning discovery into a blame exercise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:10 pm
Shared evidence is the real control here: AppSec training works when both teams are looking at the same proof, not when one side is trying to persuade the other with abstract risk language. Real findings create a common factual base that reduces defensiveness and improves decision quality. The practitioner conclusion is that training content should be built from actual environment evidence, not generic awareness slides.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations align developers and security teams in AppSec?
A: They should treat AppSec as a shared operating model, not a handoff after code is finished. That means training developers with evidence from real findings, using tools that explain issues clearly, and setting remediation expectations that fit delivery realities. Trust improves when security helps teams ship safely, not just block release.
👉 Read our full editorial: AppSec training works when security and developers share evidence