Starting Strong: Taming AppSec Chaos from Day One

A 30/60/90 Guide to Help New AppSec Leaders Hit the Ground Running

March 5, 2025

This is an excerpt from Starting Strong: Taming AppSec Chaos from Day One: A 30/60/90 Guide to Help New AppSec Leaders Hit the Ground Running, complete the form below to gain access to the full report.

Introduction

The moment you accept an offer for a new role as an AppSec leader, the challenges start. Whether you join a large enterprise or a small startup—and whether your title calls you a Team Lead, a Director, a VP, or something else—you start on Day 1 with a limited understanding of the environment you’re getting yourself into.

To create this guide, we interviewed experienced AppSec leaders on how they see the challenges and opportunities offered by a brand-new role in the first 90 days on the job.

Every one of our interviewees agreed: the first 90 days in an AppSec leadership role can make or break your long-term impact. Jump in too fast, and you risk fighting fires reactively instead of setting strategic priorities. Spend too much time observing without action, and security debt piles up while developers stick to old habits. The key is striking the right balance—building relationships, assessing gaps, and securing quick wins—so that by day 90, you're not just reacting to risks, but driving real, iterative security improvements.

Understanding Your Domain: Foundations of Security Success

Discovery Phase (Days 1-30): Understanding Your Team and the Business Landscape

In your first month, multiple security leaders said to ignore any impulse to dive right in to security architecture, tools, and challenges. Instead, they encourage a broader approach based on understanding business fundamentals.

Start Relationships Right: For this phase to be most successful, you’ll need to spend time meeting and beginning to build relationships with your counterparts in engineering, QA, DevOps, IT, and other security teams—as well as teams further afield, like customer success and marketing.

“Start by discovering as much as you can about the business—don’t ask so many AppSec questions,” said Naor Penso, VP of Product Security at FICO. “A good AppSec leader has a deep understanding of the business and how they deliver value to their customers.”

No Rabbit Holes: Teja Myneedu, Director of Security at Navan and formerly Director of Product Security at Splunk, puts the brakes on before delving too deep into security. “As a hands-on security engineer, I gravitate toward looking at source code and infrastructure, architecture diagrams, things like that,” he said. “I have to consciously stop myself before I dive deeper and say, ‘let’s not go down the rabbit hole, let me look at the big picture.’”

According to Myneedu, “It’s really crucial to understand breadth: overall, what does the company do? What do its products do? What kind of data do we have? That’s where I’d spend my first weeks, which will help me get clarity on where I need to dive deeper.”

Look Before You Leap: Even if you’re eager to roll out process changes, the first 30 days isn’t the right time. “Successful security strategies start with empathy, and that comes from developing relationships,” said Sumeet Jain, VP of Product Security at BeyondTrust. “Learn the lay of the land, how many customers, how many products. ”Get the relationship angle covered first, before showing people the problems and changing anything in the process.”

Observe Without Changing: One big security-related task for your first 30 days can be to learn what security tooling is being used across the organization—and make a note of any duplicate tools, where different teams use products that solve the same problem. You should also note where there are manual processes and handoffs that seem broken at any point in the SDLC, from design to deployment. You don’t need to change anything yet. Just write it down for your own reference.

Quick Win For Day 30: Model the Business

Making initial connections across departments and domains can help you map out a high-level model—either a mental or digital one—of the organization itself. According to Naor Penso, that model can be more valuable to more parts of the business than you think.

“The thing that distinguishes AppSec and product security leaders from everyone else is that they’re the only ones, along with their teams, who have a view of every part of the SDLC from the design phase to when clients are using it,” he said. “IT, engineering, architecture, account management, post-sales, professional services—everyone is siloed. Security people are the only ones who get to see the whole story.”

Because of that visibility, Penso said, “As an AppSec leader, you can create huge business value by creating an outline of how the business works. Here’s this process with many subprocesses, here’s how these teams fit together, here’s the handovers—and this one or that one is broken.”

By sharing this bird’s eye view of the business with your counterparts in other departments, you can start off relationships right, using your unique position in the organization to help others understand it better.

The Bottom Line: What Matters is the Bottom Line

While relationship building isn’t every AppSec leader’s favorite part of the job, skipping out on building this initial understanding can be a critical mistake. Change too much without enough business context, and you’ll find you’re costing the business more than you’re saving.

Penso said the focus on fundamentals and relationship building is a simple matter of business priorities: “Ultimately, the company’s job is to deliver software to clients and bring money in. If you don’t understand who the clients are and what you’re selling, you can’t meet those needs and solve for client demands.”