It’s the first anniversary of the Biden Administration’s EO on cybersecurity and progress has been made, but there’s still work to do in securing the public sector.

Web application programming interfaces (APIs) provide the back-end for modern web and mobile applications. REST APIs are the most common type of web API for web services and microservices, so let’s see what you can do to ensure REST API security.

False positives in application security have a negative impact on the work of cybersecurity experts, developers, and the entire business. This post explains false positives in the context of web AppSec, demonstrates why less advanced web security tools are prone to false positives and shows how Invicti’s web application security scanner addresses the problem of false positives through provable accuracy.

Following the Log4j crisis, timely patching and software supply chain security in general are now finally getting the attention they deserve. The deeper lesson from the whole affair, though, is that taking application security on faith is asking for trouble. The only way to know your true AppSec posture is to test everything – and trust nothing.