"Why do you want to add a new security task into the backlog? Our applications are already secure, right? Right?!? What about the SAST, DAST and WAF that we have?" - you may have already heard or one day will hear such questions in the future from your Product Owner or Manager.

How to measure the security of your applications?

How to speak about security improvements to your managers?

I would like to present the Software Assurance Maturity Model which might be very useful in that.