Application Security Program Handbook

A practical handbook for building application security into real software teams

Application Security Program Handbook is a focused, workplace-ready guide for software engineers and team leaders who need more than a checklist. Derek Fisher organizes the subject around the life cycle of an application security program, starting with why security work often fails, then moving into risk, threat modeling, tooling, DevSecOps, team structure, and measurement.

The book’s strength is its program view. Instead of treating security as a single tool or a late-stage gate, it shows how application security connects to engineering processes, shared responsibility, and ongoing improvement. That makes it especially relevant for organizations trying to move from ad hoc fixes toward a repeatable security practice.

What the book covers

• the role of an application security program
• confidentiality, integrity, availability, authentication, and authorization
• threat modeling and security analysis tools
• secure code release and DevSecOps workflows
• security education, standards, and reference architecture
• roadmaps, KPIs, scorecards, and continuous improvement

Why it stands out

This is a book about building capability, not just adding controls. It addresses the practical tension between shipping software quickly and reducing risk, then offers a structured way to improve both over time. Readers looking for a grounded, manager-friendly, engineer-friendly view of application security will find a clear narrative and a coherent set of methods.

Best suited to

Teams working in software engineering, application security, DevSecOps, or security leadership will find the most value here. The language and table of contents suggest a book aimed at practitioners who want an actionable framework they can adapt to their own organization.

If your goal is to strengthen application security without slowing delivery to a crawl, this handbook belongs on the shortlist.