Application Security Services

Application Security Services
Build it better and make it secure: Kroll’s product security experts enhance your software
security program with both strategic and tactical security services catered to your team’s
culture and needs, merging engineering and security into a nimble unit.
Our product security experts assist clients in all the elements required to design and implement a successful
application security program. We’re not just helping your team implement static application security testing(SAST) and/or dynamic application security testing (DAST) tools—our goal is to help organizations adopt
programs and capabilities that will enable them to effectively manage the security of their application portfolios
while being nimble enough to address changes in business needs, technologies and operating environments.

Responding to a Security-Focused Software Market
Kroll understands that building and maintaining a successful application security (“appsec”) program is not for
the faint of heart. A good appsec program requires sound strategy and supporting processes to help guide
software product teams in practicing secure coding practices, investing in the right security tools to reduceorganizational risk, and in building programs to measure the effectiveness of application security controls.
This may require a complete culture shift within your engineering and security teams to embrace a moresecure software development initiative.

Tooling

Metrics & Dashboards• SAST/SCA/DASTOptimization• Custom Security Automationand Integration• Security within/of the CI/CD• Vulnerability Correlation• Feedback Loops (Threat toVulnerability mapping)• Program Effectiveness andFuture State ReadinessThreat Modeling• Story Driven and Component
Driven Modeling• Mapped to Engineering
Personas• Program Design andDevelopment

Solution
Engineering

Skill Development

RiskAssessment

Governance

2Vulnerability
Management

Enablement• Security Champions
Program• Brown-bag Trainings• Table-top WalkthroughSessions

Assessment

Program Development

Agile Penetration Testing• Maturity/Gap Assessments• BSIMM/OWASP SAMM
Framework Implementations• Strategy and Policy
Development• Build-Operate-Transfer
Programs• Smart Automation toMaximize Efficiency• Security Regression

Application Security Services

AppSec Services: Scalable to Every Project
Application security is not a one-size-fits-all endeavor, so scalability is critical, especially as your program grows.
Kroll experts provide software product teams with the tools, processes, guidelines and confidence necessary tooffer innovative products to their internal and external customers without exposing them to security vulnerabilities.
Whether your organization is a tiny seed-stage startup, a large enterprise organization or anything in between,
our appsec program can be tailored to meet the needs and complexity of your project. Kroll’s team of appsec
experts has the experience and know-how to execute appsec program engagements of any size.

Real Appsec Use Cases
Application Security Program DevelopmentLarge North American Bank

Major Entertainment Provider

Built and operationalized appsec program

Helped build and scale appsec program

Defined processes and metrics (KPIs) on:

Application intake, triage and onboarding– Developed and implemented security
champions program

Security champion training– SAST/DAST/SCA– Application intake, prioritization and onboarding

Vulnerability management solution
integration with CI/CD– Vulnerability management

Created feedback process to resolve
challenges and program improvement

Financial Services

Fortune 500 Energy & Utilities Provider

Improved and developed methodologies
for internal penetration testing

Developed a software security strategic
roadmap

Risk profiling and threat modeling

Assessed current state across global
business units

Trained internal teams on web app
assessments and threat modeling

Short-/long-term goals (three-year roadmap)– AppSec governance

Fintech Provider– DSO capabilities

Enabled engineering team to launch productsthat are secure by default– AppSec engineering support

Developed and implemented security
champions program
Developed DevSecOps capabilities
AppSec governance and process improvisation

3

Many of our cyber• Federal Bureau of Investigation (FBI)professionals bring years• Interpolof unique experience from• U.S. Department of Justice (DOJ)

their former service withlarge enterprises as well

• Securities & Exchange Commission (SEC)

as law enforcement and• U.K. Intelligence and Policing

regulatory agencies:• U.S. Department of Homeland Security (DHS)CREST has accredited Kroll asa global Penetration Testing andSecurity Operations Center(SOC) provider• U.S. Secret Service (USSS)• U.S. Attorney’s Office
Kroll is certified as a Global
PCI Forensic Investigator(PFI) company
Kroll works on …

3000+

Kroll works with over…

Cyber events per year for clients
ranging from Fortune 100 tomedium-sized businesses.

68%

93%

of theof theFortune 100

AM Law 100

Kroll recognized as a
Representative Vendor for
Digital Forensics and Incident
Response (DFIR) and Managed
Detection and Response (MDR)

Kroll has a dedicated insurance team for insurance and legal channels,
with extensive relationships with 60+ cyber insurance carriers and exclusive
benefits to insureds.

Kroll named a Global Leader inIncident Response ReadinessNorth America

UKHong Kong

Additional hotlines at:

T: 877 300 6816

T: 808 101 2168

T: 800 908 015

kroll.com/hotlines

Singapore

Australia

BrazilOr via email:T: 800 101 3633

T: 1800 870 399

T: 0800 761 2318

CyberResponse@kroll.com

About KrollAs the leading independent provider of risk and financial advisory solutions, Kroll leverages our unique insights, data and technology to help clients stay ahead ofcomplex demands. Kroll’s global team continues the firm’s nearly 100-year history of trusted expertise spanning risk, governance, transactions and valuation. Our advancedsolutions and intelligence provide clients the foresight they need to create an enduring competitive advantage. At Kroll, our values define who we are and how we partnerwith clients and communities. Learn more at Kroll.com.
M&A advisory, capital raising and secondary market advisory services in the United States are provided by Kroll Securities, LLC (member FINRA/SIPC). M&A advisory, capitalraising and secondary market advisory services in the United Kingdom are provided by Kroll Securities Ltd., which is authorized and regulated by the Financial Conduct Authority(FCA). Valuation Advisory Services in India are provided by Kroll Advisory Private Limited (formerly, Duff & Phelps India Private Limited), under a category 1 merchant banker
license issued by the Securities and Exchange Board of India.
© 2023 Kroll, LLC. All rights reserved.KR22122312