Navigating the Maze of Vulnerabilities with Strategic ASPM

aspm vulnerability Phoenix Security

What is the magic formula to overcome the vulnerability of an overlord?  With over 204,000 CVEs, more than half deemed high or critical, the real challenge lies in identifying vulnerabilities and prioritising them in sync with business and development needs. This is where ASPM (Application Security Posture Management) steps in as a guiding light.

You can find more on the vulnerability growth in the Vulnerability Visualizers that explain concepts used in this post like exploitation, CISA KEV


Exploit in the wild: 

vulnerability, cve, growth, cvss per year, first, epss

Imagine the current scenario where you have vulnerabilities in software and operational runtime environments growing at a rate of 35% year on year, and with the current rate of growth, we are on track for 500K, half a million vulnerabilities by 2028 

vulnerability, cve, growth, cvss per year, first, epss, phoenix security, vulnerability in 2030
CVE Vulnerability Projection by 2030

The Current Challenge: A Balancing Act between ASPM and Operational Security

Imagine your Jira overflowing with every security finding marked urgent based solely on CVSS scores. This well-intentioned but impractical approach burdens product teams, who already struggle between integrating new features for business growth and tackling security vulnerabilities. Prioritization is a way to focus more on the vulnerabilities that matter, but is it sufficient?

aspm, application security, image overlord, vulnerability, cve, growth, cvss per year, first, epss
Application security and environment security overlords

Diverging Perspectives Business vs Development vs security

  • Business Perspective: Companies need to stay secure but without hampering growth and innovation. An endless list of fixes can be a roadblock to business agility.
  • Developer Perspective: Developers favour a concise, prioritized list of security issues. A manageable list of 10-15 key vulnerabilities allows for efficient workload management and contributes to a secure product.
  • Security Perspective: Security teams aim for visible progress. They advocate for initiatives like security champion programs to foster a security-first mindset within development teams.

The Overwhelming Reality of Operation

The task seems daunting, with the bulk of CVEs ranking high in severity. Yet, filtering these through exploitability and fixability lenses drastically reduces the number. This focus is vital for aligning with business objectives.

Demystify vulnerability overload: a Data-Driven approach with ASPM and Shifting Everywhere.

The solution lies in connecting three pivotal elements: business goals, security imperatives, and development capabilities. Embracing a data-driven ASPM approach allows organizations to prioritize vulnerabilities that pose the most significant risk. This method ensures that security efforts align with business and development objectives, transcending the mere checkbox approach.

aspm, application security, approach on vulnerability management

What is ASPM? A Beacon in Vulnerability Management

Application security posture management analyzes security signals across software development, deployment and operation to improve visibility, better manage vulnerabilities and enforce controls. Security leaders can use ASPM to improve application security efficacy and better manage risk.

Gartner on ASPM

ASPM emerges as a beacon in this scenario, offering a strategic, data-informed pathway. It transforms an overwhelming vulnerability list into a focused, actionable set of tasks. This alignment propels security measures and dovetails with business objectives, ensuring a secure yet agile business environment. For a deeper dive on the innovation insight, refer to the analysis of Gartner on ASPM


Effective vulnerability management in the age of endless vulnerabilities isn’t about a frenzied race to patch every issue. It’s about a strategic, informed approach that resonates with overarching business goals. ASPM paves the way for this synchronization, ensuring security measures are both impactful and business-oriented.

Let’s journey towards a more secure, business-aligned cybersecurity environment. Share your insights and experiences in the comments and join the conversation!

How Phoenix Security Can Help

attack graph phoenix security

Phoenix Security helps organizations identify and trace which systems have vulnerabilities, understanding the relation between code and cloud. One of the significant challenges in securing applications is knowing where and how frameworks like Struts are used. ASPM tools can scan the application portfolio to identify instances of Struts, mapping out where it is deployed across the organization. This information is crucial for targeted security measures and efficient patch management. Phoenix Security’s robust Application Security Posture Management (ASPM) system is adept at not just managing, but preempting the exploitation of vulnerabilities through its automated identification system. This system prioritises critical vulnerabilities, ensuring that teams can address the most pressing threats first, optimising resource allocation and remediation efforts.

Get an overview of your asset lineage

The Role of Application Security Posture Management (ASPM):

ASPM plays a vital role in managing and securing applications like those built with Apache Struts, Log4j and other vulnerabilities. It involves continuous assessment, monitoring, and improvement of the security posture of applications. ASPM tools can:

  1. Identify and Track Struts Components: Locate where Struts is implemented within the application infrastructure.
  2. Vulnerability Management: Detect known vulnerabilities in Struts and prioritize them for remediation.
  3. Configuration Monitoring: Ensure Struts configurations adhere to best security practices.
  4. Compliance: Check if the usage of Struts aligns with relevant cybersecurity regulations and standards.

By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains current and focuses on the key vulnerabilities.

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone
Explore the critical insights into the latest container security vulnerabilities named leaky vessels, including CVE-2024-21626, CVE-2024-23651, CVE-2024-23653, and CVE-2024-23652, BuildKit flaws, with our comprehensive guide on mitigation strategies, best practices for application security, and tips for robust vulnerability management in Docker and Kubernetes environments. Stay ahead in securing your container deployments against potential threats with ASPM help
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.