How legacy AppSec is holding back Secure by Design

This report argues that realizing Secure by Design requires moving beyond legacy AST/SCA and vulnerability-centric approaches to holistic, system-level testing and integrity checks that address software supply chain risks exemplified by SolarWinds, 3CX, Log4j, and MOVEit. Experts emphasize aligning developer incentives, embedding product security within product teams, improving secure developer experience, and adopting frameworks like NIST SSDF and OWASP SAMM, while expanding visibility and vetting for commercial off-the-shelf software. The piece contends CISA’s current guidance remains insufficient for detecting integrity and malware implant issues and calls for crash-test–like evaluations of fully assembled software before release.