When the plan needs building and running.
I head the Application Security Business Unit at Innov8 (Pvt) Ltd, Colombo. The unit implements, integrates and operates application security for banks and enterprises.
01 / Capabilities
Six capabilities, one accountable team.
- 01
Application & API protection
WAF, WAAP, API security, bot mitigation and CDN, deployed and tuned for production.
- 02
Mobile application security
Runtime protection, app shielding and mobile security testing.
- 03
Security assessment
Vulnerability scanning, SAST, DAST and VAPT.
- 04
Monitoring & visibility
Security logs, observability and SIEM integrations.
- 05
Managed security services
Policy tuning, threat monitoring and ongoing operations.
- 06
Licensing & support
Platform licences, renewals and certified engineering support.
02 / Technology portfolio
Proven platforms, properly deployed.
| Service | Technologies | Value |
|---|---|---|
| WAAP / WAF | F5 Distributed Cloud, Imperva | Protect web applications against attacks |
| API security | F5 XC, Imperva | API discovery, exposure reduction, threat prevention |
| Bot protection | F5 XC, Imperva | Mitigate automated abuse |
| Mobile security | Zimperium MAPS, zShield, zScan | Protect apps against tampering and runtime threats |
| Application testing | Veracode SAST / DAST | Find software vulnerabilities |
| Vulnerability management | Tenable, Qualys, RidgeBot | Discover and prioritise vulnerabilities |
| Security monitoring | F5 logs, SIEM integrations, Datadog | Security visibility and troubleshooting |
| Managed application security | Vendor platforms + Innov8 engineers | Keep deployed controls tuned |
03 / Operating model
Continuous application security services.
- 01
Assess
Scan, test and baseline the estate.
- 02
Protect
Deploy edge, API, bot and mobile controls.
- 03
Monitor
Stream security telemetry to the SOC.
- 04
Validate
Prove controls work against real attack paths.
- 05
Improve
Tune continuously under managed service.
04 / Track record
Delivered for banks and global groups.
Hands-on programmes I have led. Client names are withheld under NDA; tap a redacted word to see why.
- 112applications migrated
Banking · A leading Sri Lankan private bank
Cloud WAAP migration at enterprise scale
Moved roughly 112 web applications and APIs to cloud web application and API protection in waves, from monitoring to blocking.
- 120applications protected
Manufacturing · A global apparel group headquartered in Sri Lanka
WAAP, API security and advanced bot protection
Deployed web application, API and advanced bot protection across around 120 applications for a multinational manufacturing group.
- T1bank vulnerability programme
Banking · A Tier-1 Sri Lankan commercial bank
Vulnerability management modernisation
Upgraded the vulnerability management platform and deployed web application scanning to cover the application layer.
- RASPin-app protection live
Banking · A leading private bank’s mobile app
Mobile application runtime protection
Rolled out in-app protection for a customer banking app, tuning policies and supporting SDK integration with the bank’s developers.
- SIEMtelemetry pipeline
Banking · A leading Sri Lankan private bank
WAAP security telemetry into the SOC
Integrated WAAP security logs into the bank’s SIEM through Logstash and resolved pipeline backpressure so events arrive reliably.
05 / FAQ
Common questions.
What does Innov8’s Application Security Business Unit do?
It implements and operates application security: web and API protection, bot mitigation, mobile app security, application testing, vulnerability management, SIEM integration and managed security services, using proven platforms and certified engineers.
Which technologies does the BU implement?
F5 Distributed Cloud and Imperva for WAAP, API security and bot protection; Zimperium for mobile app protection; Veracode for SAST and DAST; Tenable, Qualys and RidgeBot for vulnerability management; and SIEM and Datadog integrations for monitoring.
Does Innov8 offer managed application security?
Yes. After deployment, Innov8 engineers can operate and continuously tune the controls: WAAP policy tuning, bot rule maintenance, threat monitoring, escalation handling and periodic reviews.
06 / Enquire
Scope an implementation or managed service.
Share the applications, platforms and timelines involved. The Innov8 AppSec team will respond with a scoped approach and technology options.