App Security

Set up mutual TLS between microservices and validate certificate chains and expiry

Add FIDO2 and WebAuthn passkeys with platform authenticators and NIST AAL3 controls

Patch OT and ICS systems safely with vendor testing, staged rollouts and rollback plans

Identify, test, deploy and verify software updates to close vulnerabilities across IT

Set up Rapid7 InsightVM consoles, scan engines and credentialed vulnerability scans

Generate, store and rotate RSA key pairs per NIST SP 800-57 with PEM, DER and PKCS#8

Deploy OpenRASP agents to block attacks from inside Java and Python web apps

Block hardcoded secrets in git with Gitleaks pre-commit hooks, CI checks and baselines

Run HashiCorp Vault for dynamic secrets, transit encryption and PKI in CI/CD

Scan CI/CD pipelines with gitleaks and TruffleHog to block leaked secrets before deploy

Write custom Semgrep YAML rules to catch app-specific bugs and enforce coding standards

Sign and verify artifacts with Cosign keyless signing, Rekor and Fulcio

Verify container build pipelines with in-toto layouts, signed link metadata and SLSA

Automate OpenVAS scans with python-gvm and turn Greenbone XML reports into findings

Design a vulnerability SLA program with severity matrices, exceptions and escalations

Build a vulnerability SLA tracker with breach detection, alerts and compliance metrics

Build Schnorr zero-knowledge proofs so logins never send the password to the server

Run OWASP ZAP baseline and API scans in GitHub Actions and GitLab CI as quality gates

Run CodeQL and Semgrep on pull requests with SARIF upload and merge-blocking gates

Inventory crypto and deploy hybrid ML-KEM key exchange on TLS, VPN and SSH

Scan hosts and cloud snapshots for vulnerabilities without installing endpoint agents

Fuzz REST APIs stateful from an OpenAPI spec with Microsoft RESTler

Inventory documented, shadow and zombie APIs from traffic, DNS and cloud resources

Test API rate limits for bypasses via spoofed headers, IPs, methods and versions

Build Postman collections that test OWASP API Top 10 flaws and run in CI

Score asset criticality from data, business and exposure to weight vulnerability fixes

Run credentialed OpenVAS scans over SSH or SMB to find missing patches and misconfigs

Plan credentialed scans with Nessus, Qualys or InsightVM to inspect patches and configs

Confirm blind SSRF with out-of-band callbacks and reach internal cloud metadata

Test frame embedding controls and build overlay proofs of concept for clickjacking

Scan images, repos and clusters with Trivy for CVEs, IaC issues and leaked secrets

Find weak Content-Security-Policy rules that allow XSS through JSONP and unsafe-inline

Audit application crypto for weak algorithms, insecure modes and hardcoded keys

Forge cross-site requests against sessions to test CSRF defenses in authorized tests

Rank CVEs using the CISA KEV catalog with EPSS and CVSS for BOD 22-01 deadlines

Test file path parameters for traversal and LFI with encoding bypasses and ffuf

Roll DMARC from p=none to p=reject after inventorying and aligning all mail senders

Rank endpoint CVEs by risk, deploy patches and validate that fixes stuck

Test GraphQL depth limits with deeply nested queries to find denial-of-service risks

Pull GraphQL schemas via introspection and test batching and alias brute force

Assess GraphQL endpoints for introspection leaks, injection and authorization flaws

Generate, sign and encrypt keys on HSMs via PKCS#11 with SoftHSM2, CloudHSM or YubiHSM2

Send duplicate parameters to slip past WAF and validation that parse them differently

Forge JWTs with alg none using PyJWT and a proxy to test signature checks

Find over-permissioned OAuth app grants and excessive API scopes in SaaS platforms

Run OT vulnerability assessments with Claroty xDome for asset discovery and risk scoring

Scan OT and ICS networks for vulnerabilities without crashing fragile legacy controllers

Inventory quantum-vulnerable crypto and plan a move to NIST post-quantum standards

Scan dependencies and lockfiles with Snyk in CI to catch vulnerable open-source packages