The state of AppSec: Are we getting ahead of attackers — or falling behind?

Industry experts reflect on the state of AppSec, noting progress in adopting safer languages (Rust, Go), improved container security practices, and broader 'shift-left' supply chain controls (e.g., signed commits, dependency scanning), while emphasizing persistent challenges such as legacy C/C++ codebases, tooling fragmentation, transitive dependency risk, and implementation gaps. They advocate investing in people, avoiding developer blame, pursuing transparency over liability, and modernizing tooling and budgets to meet the scale and complexity of software supply chain threats.