blog

Phoenix Security Phoenix Welcomes Jim Manico, Cybersecurity leader, OWASP Pillar creator of OWASP Top 10

Manico’s deep-rooted expertise in application security, an active member of OWASP and creator of OWASP Top 10. will bolster Phoenix Security’s capabilities in vulnerability management and secure coding practices as the platform continues to evolve.

Jim Manico Joins Phoenix Security Advisory Board

LONDON, England (September 22, 2023) — Phoenix Security, a leading platform specializing in cloud and application security posture management, is thrilled to announce the appointment of Jim Manico to its advisory board. Manico brings a wealth of knowledge in application security, secure coding, and vulnerability management, fortifying Phoenix Security’s technical prowess as the company prepares for its next phase of growth.

Jim Manico founded Manicode Security, a firm dedicated to software security education. He is also a well-known author and educator in secure coding practices, contributing to the OWASP community and serving as a project co-leader for the OWASP Application Security Verification Standard (ASVS). Manico has been a keynote speaker at numerous security conferences and has provided training sessions globally. Jim created the famous OWASP Top 10 and is one of the biggest advocates.

With a career spanning over two decades, Manico has shaped application security standards and practices. His expertise will be invaluable in helping Phoenix Security refine its offerings, particularly in the areas of vulnerability management and secure coding.

“Adding Jim Manico to our advisory board is like bringing the whole of application security knowledge in one person, Jim has extended business and development perspective two fundamental topics we are aligning at Phoenix Security “

” said Francesco Cipollone, CEO and founder of Phoenix Security. “Jim’s unparalleled expertise in application security aligns perfectly with our mission. We’re honoured to have such a distinguished professional join our team.”

“I’m genuinely excited to be part of Phoenix Security’s journey,” said Manico. “The platform addresses critical gaps in application security, providing actionable insights for both technical teams and executives. It’s a game-changer, and I’m eager to contribute to its success.”

Manico joins an already impressive advisory board that includes cybersecurity luminaries such as Andrew Peterson, Xabi Errotabehere, Chris Hodson, Jonathan Rau.

Advisory Board Highlights:

Chris Romeo Brings a no-nonsense approach to cybersecurity with decades of experience in corporate organization and end-user training. Chris was the former Director of Devsecops security for CISO and recently CEO of the security journey
Xabi Errotabehere: Offers insights into early-stage business management and effective market penetration strategies. Xabi was the CTO of the cloud security company Cloud Conformity, acquired by Trend Micro
Andrew Peterson: Provides valuable exposure to the U.S. market and connections with venture capitalists. Andrew was the former CEO of Signal Science, acquired by Fastly.
Jonathan Rau: Brings cloud and several startup experiences to the table with a no-nonsense view on cybersecurity, recently Jonathan was the CISO for lightspin recently acquired by CISCO
John Kinsella: A cybersecurity expert from cloud to startup with a deep obsession for application security, John has previously exited his company to Quays.

To learn more about Phoenix Security or to schedule a free demo, visit https://www.phoenix.security/request-a-demo/.

News

News

Francesco Cipollone

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

28th September 2023

news

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

The New role of Threat-Centric Approach in Application Security Posture Management (ASPM) an Agentic ASPM in real life

As cyber threats become increasingly sophisticated, the need for a more proactive and comprehensive approach to vulnerability management is undeniable. A threat-centric methodology, when combined with advanced tools like Agentic AI and Application Security Posture Management (ASPM), offers organizations the ability to predict and mitigate vulnerabilities before they are exploited by threat actors. This article delves into how leveraging threat intelligence, exposure and reachability analysis, and contextual risk assessments can help organizations stay ahead of cyber threats, specifically focusing on high-risk vulnerabilities like remote code execution (RCE) and memory corruption. Through case studies like Citrix ADC and MOVEit Transfer, the article highlights the growing trend of zero-day exploits and emphasizes the importance of a proactive, data-driven security strategy. In a world where vulnerabilities are constantly targeted, adopting a threat-centric approach is not just a best practice—it’s essential to ensuring long-term security. For startups, the focus is clear—establish visibility and ensure core security practices are in place. Application Security Posture Management (ASPM) tools provide a straightforward, automated approach to detecting vulnerabilities and enforcing policies. These solutions help reduce risk quickly without overburdening small security teams. Mature organizations, on the other hand, are tackling a different set of problems. With the sheer number of vulnerabilities and an increasingly complicated threat landscape, enterprises need to fine-tune their approach. The goal shifts toward intelligent remediation, leveraging real-time threat intelligence and advanced risk prioritization. ASPM tools at this stage do more than just detect vulnerabilities—they provide context, enable proactive decision-making, and streamline the entire remediation process. The emergence of AI-assisted code generation has further complicated security in both environments. These tools, while speeding up development, are often responsible for introducing new vulnerabilities into applications at a faster pace than traditional methods. The challenge is clear: AI-generated code can hide flaws that are difficult to catch in the rush of innovation. Both startups and enterprises need to adjust their security posture to account for these new risks. ASPM platforms, like Phoenix Security, provide automated scanning of code before it hits production, ensuring that flaws don’t make it past the first line of defense. Meanwhile, organizations are also grappling with the backlog crisis in the National Vulnerability Database (NVD). A staggering number of CVEs remain unprocessed, leaving many businesses with limited data on which to base their patching decisions. While these delays leave companies vulnerable, Phoenix Security steps in by cross-referencing CVE data with known exploits and live threat intelligence, helping organizations stay ahead despite the lag in official vulnerability reporting. Whether just starting their security program or managing a complex infrastructure, organizations need a toolset that adapts with them. Phoenix Security enables businesses of any size to prioritize vulnerabilities based on actual risk, not just theoretical impact, helping security teams navigate the evolving threat landscape with speed and accuracy.

Francesco Cipollone

ASPM at Two Speeds: Remediation Strategies for Every Security Journey & CVE/NVD Collapse

The journey of securing an organization’s application landscape varies dramatically, depending on where a company stands in its maturity. Early-stage startups with small security teams face challenges not only with vulnerabilities but also with scaling their security processes in line with their growth. On the flip side, established enterprises struggle with managing complex environments, prioritizing remediation, and dealing with vast amounts of vulnerabilities while staying ahead of sophisticated threats. For startups, the focus is clear—establish visibility and ensure core security practices are in place. Application Security Posture Management (ASPM) tools provide a straightforward, automated approach to detecting vulnerabilities and enforcing policies. These solutions help reduce risk quickly without overburdening small security teams. Mature organizations, on the other hand, are tackling a different set of problems. With the sheer number of vulnerabilities and an increasingly complicated threat landscape, enterprises need to fine-tune their approach. The goal shifts toward intelligent remediation, leveraging real-time threat intelligence and advanced risk prioritization. ASPM tools at this stage do more than just detect vulnerabilities—they provide context, enable proactive decision-making, and streamline the entire remediation process. The emergence of AI-assisted code generation has further complicated security in both environments. These tools, while speeding up development, are often responsible for introducing new vulnerabilities into applications at a faster pace than traditional methods. The challenge is clear: AI-generated code can hide flaws that are difficult to catch in the rush of innovation. Both startups and enterprises need to adjust their security posture to account for these new risks. ASPM platforms, like Phoenix Security, provide automated scanning of code before it hits production, ensuring that flaws don’t make it past the first line of defense. Meanwhile, organizations are also grappling with the backlog crisis in the National Vulnerability Database (NVD). A staggering number of CVEs remain unprocessed, leaving many businesses with limited data on which to base their patching decisions. While these delays leave companies vulnerable, Phoenix Security steps in by cross-referencing CVE data with known exploits and live threat intelligence, helping organizations stay ahead despite the lag in official vulnerability reporting. Whether just starting their security program or managing a complex infrastructure, organizations need a toolset that adapts with them. Phoenix Security enables businesses of any size to prioritize vulnerabilities based on actual risk, not just theoretical impact, helping security teams navigate the evolving threat landscape with speed and accuracy.

Francesco Cipollone

The CVE & NVD Crisis: A Wake-Up Call for Cybersecurity Industry andApplication Security

The cybersecurity world is reeling as MITRE’s funding for the CVE and NVD systems expires, disrupting the backbone of global vulnerability management. As traditional sources like the National Vulnerability Database collapse under funding cuts and submission backlogs, security teams face delays, incomplete data, and loss of automation in remediation pipelines. This isn’t just a data problem—it’s a structural crisis for application security and vulnerability correlation. In this landscape of uncertainty, Phoenix Security’s ASPM platform steps up with a code-to-cloud correlation engine that doesn’t depend on outdated data workflows. By connecting code-level insights (including tools like Semgrep) to runtime and cloud environments, Phoenix enables faster, context-aware vulnerability remediation—even as NVD and CVE pipelines deteriorate. This article dives into the implications of the CVE shutdown and how Phoenix Security is helping security and development teams transition to a resilient, correlation-first approach to cybersecurity.

Francesco Cipollone

Announcing Phoenix Threat Centric Approach

Learn how to predict ransomware risks and vulnerability exploitation using a threat-centric approach. Explore data-driven insights, verified exploit trends, and methods for assessing the likelihood of attacks with key references to CISA KEV, EPSS, and Phoenix Security’s 4D Risk Formula.

Francesco Cipollone

A Threat-Centric Look at Vulnerability Exploitation Likelihood and Ransomware Risk

Remote Code Execution flaws continue to undermine Kubernetes ingress integrity. IngressNightmare (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974) showcases severe threat vectors in NGINX-based proxies, leading to cluster-wide exposure. ASPM, robust remediation tactics, and strong application security solutions—like Phoenix Security—mitigate these vulnerabilities before ransomware groups exploit them.

Francesco Cipollone

IS NGINX IngressNightmare bad? Bad news it is: Critical Remote Code Execution Threats (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, CVE-2025-1974)

Francesco Cipollone

blog