Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Scott Gerlach
StackHawk Wingman Gives Coding Agents a Security Partner
HomeInterviewsStackHawk Wingman Gives Coding Agents a Security Partner Guests: Scott Gerlach Hosts: Alan Shimel Category: Interviews Date: September 29, 2026 Security testing for coding agents is where AppSec must go when AI writes most of the code. Scott Gerlach, co-founder and CSO of StackHawk, joins Alan Shimel on Techstrong TV. Furthermore, he explains why fixing, not finding, is now the real constraint. About Scott Gerlach Scott ran security teams at GoDaddy for about 10 years.
Why Business Logic Testing (BLT) Should Be on Your AppSec Testing Menu
What's the best use of a pen tester's valuable time? Penetration testing is expensive—running from $20,000 to $100,000+, depending on scope—and it should be. Skilled pen testers bring creativity, intuition, and adversarial thinking that's genuinely valuable. What shouldn't be expensive is watching those same pen testers spend the majority of an engagement systematically checking whether User A can access User B's data across dozens of endpoints. And don't get me wrong.
The Fundamental Components to Achieving Shift-Left Success
“Shift-left” is a familiar concept to CISOs and security practitioners across the globe. A term coined to promote the integration of security practices earlier in the software development lifecycle (SDLC) in a bid to dwindle escalating application security risks. Boasting the ability to deliver more efficient and secure software, scale responsibilities and empower developers to fix security bugs, it’s no surprise that the concept has garnered significant industry attention in recent years.
The journey toward secure software development lifecycles
The digital transformation race is on, and companies are churning out applications at an ever-increasing pace. Unfortunately, this speed often comes at the cost of security. A recent study revealed a shocking statistic: 92% of companies experienced a breach due to vulnerabilities in their own internally developed applications. A different approach is clearly needed.
Source code: The source of truth for securing the API attack surface
Most organizations find themselves in the midst of their API security journey, racing to keep pace with expanding API ecosystems in a colossal threat landscape. As a core enabler of modern applications, facilitating seamless connectivity and powering mobile and web applications, APIs are everywhere. The DevOps…
Source code: The source of truth for securing the API attack surface
Most organizations find themselves in the midst of their API security journey, racing to keep pace with expanding API ecosystems in a colossal threat landscape. As a core enabler of modern applications, facilitating seamless connectivity and powering mobile and web applications, APIs are everywhere. The DevOps revolution has completely transformed the pace at which developers can design and build APIs faster than a security team can match.
Introducing GitHub Insights, Latest Solution to Combat Growing Threat to APIs
By Scott Gerlach, CSO – StackHawk The accelerated demand for software applications and application programming interfaces (APIs) across industries has caused organizations’ attack surfaces to become larger than ever before. Most modern organizations continue to struggle with sustaining adequate visibility over their key software components.
Rebuilding Fractured Trust Between Developers and Security Teams
Rebuilding Fractured Trust Between Developers and Security Teams It's no secret that trust and collaboration between developers and security professionals has historically been rocky, at best. However, with digital transformation showing no signs of slowing down, the introduction of cloud environments, faster software development lifecycles, along with the proliferated use of APIs, has led to tremendous friction between the two parties.
Tis the Season to be Cautious: Mitigating Surging API Threats and Risks
Online shopping activity has proliferated in recent years. In 2022, the United States retail ecommerce ecosystem generated and an estimated 2.64 billion consumers will have completed at least one purchase online by the end of this year. With the total global ecommerce sales projected to grow by 50% over the next three years, cybercriminals have pinpointed retail and e-commerce organizations as prime, lucrative attack targets.
People, process, technology: How to shift security testing left successfully
This site uses various technologies, including third-party cookies, pixels, and codes, to personalize our website functionalities, measure website usage and performance and provide targeting advertising. Information about your site visit may be stored or shared with third parties as identified in our Privacy Policy . By continuing to use this website you consent to our Privacy Policy and Terms of Use .
People, process, technology: How to shift security testing left successfully
The benefits of shift-left security are clear. It puts security testing in the hands of the engineers who write the code, enabling vulnerability fixes to occur before software hit production. This provides fixers with faster feedback loops on vulnerabilities found, as well as ensuring more efficient time to feature delivery and cohesive teamwork between security and development teams.
People, process, technology: How to shift security testing left successfully
Share The benefits of shift-left security are clear. It puts security testing in the hands of the engineers who write the code, enabling vulnerability fixes to occur before software hit production. This provides fixers with faster feedback loops on vulnerabilities found, as well as ensuring more efficient time to feature delivery and cohesive teamwork between security and development teams.
People, process, technology: How to shift security testing left successfully
Tech News Tube is a real time news feed of the latest technology news headlines.Follow all of the top tech sites in one place, on the web or your mobile device.
Scott Gerlach
By Scott Gerlach APIs are the driving force of innovation within every organization, but not without a price. APIs enable the seamless connection between customers, vital data and services while allowing engineering teams to quickly iterate with better documentation thanks to standardization. APIs have an immense impact on business value with data standardization ... Read More
Closing the Talent Gap in Cybersecurity
According to one projection, there are expected to be 3.5 million open cybersecurity jobs by 2025. However, it's no secret that breaking into cybersecurity or selecting it as a degree is no guarantee. For many, there is often the question: How do I-or even can I-enter the cybersecurity industry? There is no such thing as one-size-fits-all when it comes to entering the industry. The career journey for every person and student will be different.
Here’s how organizations can fix their API security troubles
Application Programming Interface (API) security monitoring and testing is quickly emerging as a top priority that the C-suite refuses to keep on the back burner any longer. According to a recent report, API-focused attacks increased by 400% in the first six months of 2023. However, there are many tools and processes available today to help grapple with this increasing challenge.
You can't avoid APIs, so you need to secure them
As APIs emerge as the unsung heroes behind modern software development for their ability to accelerate innovation and streamline processes, it’s no secret or even a surprise that API security is a lingering problem that the broader cybersecurity industry has yet to fully solve.
You can't avoid APIs, so you need to secure them
Tech News Tube is a real time news feed of the latest technology news headlines.Follow all of the top tech sites in one place, on the web or your mobile device.
application security Archives
AppViewX Unfurls Certificate Life Cycle Management Platform for Kubernetes AppViewX today launched an automated certificate life cycle management platform for Kubernetes environments ... | | application security, AppViewX, certificate management, cloud-native applications Principle of Shared Responsibility in Cloud-Native Applications Using the cloud means you can focus on your application and use a third party for most of your infrastructure.
How Can Your Security Team Help Developers Shift Left?
Question: How can I get my organization to shift its security left without slowing down our developers? Scott Gerlach, CSO and co-founder of StackHawk: Ultimately, it requires a mix of people, processes, and technology. Tooling on its own cannot get you there. I typically recommend the following six steps to organizations beginning their journey. When teams apply the steps, they can actually start to shift security left without compromising developer velocity. 1.
Communicating Common Web App Security Threats to Developers
Automated security testing tools enable us to identify web application vulnerabilities early and often, but what happens after a vulnerability has been identified? Does your security team have the coding skills to mitigate it themselves, or are your developers suddenly security experts once a vulnerability is discovered? Most likely not. So, how do we go from finding vulnerabilities to fixing them? Enter a key component of shifting left: Collaboration between security and developer teams.
Driving Innovation, Fueling Security Significance
APIs are the driving force of innovation within every organization, but not without a price. APIs enable the seamless connection between customers, vital data and services while allowing engineering teams to quickly iterate with better documentation thanks to standardization. APIs have an immense impact on business value with data standardization and machine compatibility.
StackHawk 2023 Predictions: Shifting Left in 2023
Industry executives and experts share their predictions for 2023. Read them in this 15th annual VMblog.com series exclusive. By Scott Gerlach, Co-founder and Chief Security Officer at StackHawk As software is being built and released more rapidly and security breaches continue to increase in frequency and severity, companies are making more serious overtures to shift their security strategies left and take a proactive approach by giving more control to the developer teams.
Shift left: Beyond the cybersecurity buzzword
Shift left is one of the most popular terms within modern cybersecurity, used heavily in vendor marketing campaigns and as a headlining topic at industry conferences worldwide. As a result, the core objective and best approach to shift left has become unclear. While shift left has increased in popularity in recent years, it’s important to recognize that it is not a new concept.
3 Reasons Teams Struggle to Shift Security Left
It seems like you can’t talk about application security today without mentioning “shifting left.” This phrase refers to bringing security into the ‘left’ side of the software development life cycle and testing for vulnerabilities while code is being developed instead of after it is live in production. And while this sounds good, it is difficult to successfully integrate AppSec into the developer workflow without causing friction.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Scott
Contact Scott, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack