Industry · Manufacturing & groups
One clear view of application risk across every business unit
I map the web apps, portals and APIs each business unit runs, show where edge protection and ownership break down, and give the group one plan.
- Top priorityEdge & WAAPUnits buy their own hosting, so some sites sit outside group edge protection.
- Top priorityGovernance & maturityWithout one owner and one inventory, fixes stall between group and unit.
- ElevatedAPI security
- ElevatedVulnerabilities & exposure
- ElevatedMonitoring & visibility
- BaselineMobile apps
In short
Application security for manufacturers and diversified groups is mostly a consistency problem: each business unit runs its own websites, supplier and dealer portals, APIs (application programming interfaces) and vendors. I build one inventory, check edge protection and ownership for each application, and score maturity across units. The result is a single group roadmap that central security can fund and track.
Where I usually start
- AppSec maturity assessment
- WAAP & API protection assessment
- Fractional AppSec advisor
The pressure
What manufacturing & groups security teams are up against.
- Many business unitsEach unit picks its own vendors and hosting, so controls and standards vary from site to site.
- No single inventoryNobody can list every app the group runs, so unprotected sites surface only after an incident.
- Supplier and dealer accessPortals for suppliers, dealers and buyers carry orders, prices and payment details worth stealing.
- Central policy, local ownersGroup security sets the standard, but fixes depend on business units with their own priorities.
Attack scenarios
The attacks I test your defences against.
Each scenario maps to one of the six areas, so you can see which layer should have stopped it.
Try the attack simulator- Scenario 01Subsidiary site outside the WAFOne unit’s website never moved behind group edge protection and becomes the easy way in, or a defacement.Edge & WAAP
- Scenario 02Old B2B API still answeringAn order or inventory API built for a former buyer still accepts an old key and returns live pricing data.API security
- Scenario 03Supplier portal on an old versionAn internet-facing supplier or HR portal with a public exploit gives attackers a route to the ERP network.Vulnerabilities & exposure
- Scenario 04Vendor-built app with no ownerAn agency hands over a site with no patch owner or security clause, and a known flaw stays open for years.Governance & maturity
Recommended
Where I would start with you.
Three engagements that fit this sector best. Each ends in a prioritised plan; delivery is your call.
- 01AppSec maturity assessmentScores each business unit on the same scale, so the group can compare units and fund the gaps.2–3 weeksFixed feeSee the service
- 02WAAP & API protection assessmentShows which units’ sites and APIs sit outside edge protection and what it takes to bring them in.2–4 weeksFixed feeSee the service
- 03Fractional AppSec advisorOngoing senior oversight of the group roadmap and of the vendors delivering it across units.MonthlyRetainerSee the service
Rules you work under
The frameworks I map findings to.
Findings are written so your risk, audit and compliance teams can use them directly. This is orientation, not legal advice.
- ISO and IECISO/IEC 27001:2022Groups often certify some units and not others, which can leave customer-facing apps outside the certified scope.
- US National Institute of Standards and TechnologyNIST Cybersecurity Framework (CSF) 2.0Its Govern function gives a group one language for application risk across units at different maturity levels.
- Parliament of Sri LankaPersonal Data Protection Act, No. 9 of 2022Employee, customer and supplier data held by Sri Lankan group companies falls under the Act’s duties.
- PCI Security Standards CouncilPayment Card Industry Data Security Standard (PCI DSS) v4.0.1Applies wherever a group’s retail, e-commerce or hospitality businesses take card payments online.
Proof
Programmes I have led in manufacturing & groups.
Names stay under NDA. The scale and the work are real.
How do you assess application security across a group of companies?
I start with one inventory of every web application, portal and API (application programming interface) across business units, with an owner for each. Then I check edge protection, patching and logging per application, and score each unit’s maturity on the same open model, the Software Assurance Maturity Model (SAMM). The group gets a comparable view by unit and one roadmap that central security can fund and track.
Can a group put every business unit on one WAAP platform?
Often, yes. A single WAAP (web application and API protection) platform simplifies policy, logging and support. The hard part is onboarding: each application needs an owner, a tested cutover plan, origin servers locked to the provider, and a monitoring period before blocking. I assess whether one platform suits your estate, which applications should move first, and what has to be true before each wave.
Who should own application security in a diversified group?
A named group-level owner should set the standard, keep the inventory and report risk to the board, while each business unit names an owner for every application it runs. Central teams usually fund shared controls such as edge protection and scanning; units fund fixes in their own applications. Without both levels, findings bounce between group and unit, and nothing closes.
Do manufacturers really need bot protection?
Where logins, prices or stock data are online, often yes. Bots scrape catalogues and pricing, test stolen passwords on dealer and supplier portals, and flood forms. The need depends on what each portal exposes, so I look at the actual traffic before recommending anything. For portals that hold orders or payment details, bot controls on the edge platform are worth testing against that traffic.
What has Ravindu Fernando done for manufacturing groups?
Ravindu Fernando, a Colombo-based application security consultant, worked on deploying web application, API (application programming interface) and advanced bot protection across about 120 applications for a global apparel group headquartered in Sri Lanka. For groups he assesses the whole application estate and recommends a prioritised plan, with delivery scoped case by case: the group’s own teams, a chosen partner or Innov8, which he heads.
Other industries