Insights — Ravindu Fernandohttps://ravindufernando.pages.dev/insightsApplication security field notes by Ravindu Fernando.en-gbMeasuring application security maturity with OWASP SAMM: a practical starting pointhttps://ravindufernando.pages.dev/insights/appsec-maturity-owasp-sammhttps://ravindufernando.pages.dev/insights/appsec-maturity-owasp-sammFri, 23 Oct 2026 00:00:00 GMTGovernance & StrategyA practical OWASP SAMM assessment guide: run a lightweight AppSec maturity assessment in 2–3 weeks, score honestly, set a target and build a security roadmap.What 112 application migrations taught me about moving to cloud WAAPhttps://ravindufernando.pages.dev/insights/cloud-waap-migration-lessonshttps://ravindufernando.pages.dev/insights/cloud-waap-migration-lessonsFri, 23 Oct 2026 00:00:00 GMTEdge & WAAPCloud WAAP migration lessons from onboarding ~112 applications: DNS cutover order, TLS compatibility, origin protection, staged blocking and SIEM logging.From vulnerability lists to exposure management: CTEM for South Asian enterpriseshttps://ravindufernando.pages.dev/insights/ctem-exposure-management-south-asiahttps://ravindufernando.pages.dev/insights/ctem-exposure-management-south-asiaFri, 23 Oct 2026 00:00:00 GMTExposure & TestingContinuous threat exposure management (CTEM) for South Asian enterprises: the five stages, better vulnerability prioritisation and how to mobilise owners.Mobile app shielding for banks: what RASP protects, and what it doesn'thttps://ravindufernando.pages.dev/insights/mobile-app-shielding-for-bankshttps://ravindufernando.pages.dev/insights/mobile-app-shielding-for-banksFri, 23 Oct 2026 00:00:00 GMTMobile & RuntimeMobile app shielding and RASP for banking apps explained: the threats in-app protection stops, what it cannot replace, and how to tune policy without friction.