Shifting Log4j Discovery Right

You hear a lot about shifting your application security (AppSec) left – in other words, shifting AppSec to the beginning of the software development lifecycle (SDLC). While we firmly believe that you should continue scanning in development environments, that doesn’t mean that you should neglect applications that have been deployed to or staged in runtime environments.  Runtime presents a unique set of challenges – misconfigurations, logic errors and the like that can’t be identified in a static or software composition analysis scan. If you aren’t testing for vulnerabilities at runtime, you are risking a potential breach of a different kind. As Chris Wysopal, our co-founder and CTO, frequently emphasizes:  In a shift left world, shifting right is more important than ever. There are many examples that warrant shifting both left and right – especially during times of heightened alert like the current political unrest. President Biden recently addressed our nation on cybersecurity,…