SSDF 1.2 sees AppSec as a journey

The report examines NIST’s SSDF 1.2 update, emphasizing a move from “write secure code” to “operate secure software” through continuous improvement (PO 6.0), proactive vulnerability management, comprehensive observability, AI-assisted anomaly detection, automated patching, and stronger release practices (testing, canary deployments, and robust rollbacks). Expert commentary underscores breaking down dev/sec/ops silos, tracking metrics like vulnerability escape rate, and keeping development environments and delivery pipelines continuously updated to reduce risk and speed incident response.