Service · ½–1 day · Fixed fee
Give your board or your engineers a clear view of application risk
A plain-language briefing for the board and executives, or a hands-on workshop for engineers, built around your own applications rather than generic slides.
- ½–1 day
- Fixed fee
- OWASP Top 10
- OWASP API Security Top 10 (2023)
- NIST CSF 2.0
In short
An executive briefing or team workshop is a half-day to one-day session on application security risk, built around your organisation. For boards and executives it covers which threats matter, how exposed you are and which decisions are needed. For engineering teams it is hands-on: threat modelling a real feature, reading WAF (web application firewall) events or testing an API (application programming interface) for common flaws.
This is for you if
- The board needs to understand application risk without the jargon
- A new security strategy needs executive backing before budget
- Engineers ship fast but have never threat modelled a feature
- Several teams need the same baseline before an assessment starts
When to call me
The moments this engagement is built for.
- 01On the board or risk agendaDirectors want to know how exposed the digital channels are and what they are being asked to fund.
- 02After an incident in your sectorA peer was breached through an app or API, and leadership asks whether it could happen here.
- 03Kicking off a security programmeSecurity, IT and the business need a shared language before the roadmap is built.
- 04A new engineering teamA new squad or vendor team needs your standards, threats and controls from day one.
How it runs · ½–1 day
From kick-off to a plan you can act on.
- 01Pre-brief call
- Agree the audience, goals and decisions in play
- Pick the systems and risks to focus on
- 02Preparation
- Review your public exposure and shared context
- Build scenarios from your own applications
- 03Briefing or workshop
- Briefing: risks, exposure and decisions, plainly
- Workshop: guided exercises on a real feature
- 04Written follow-up
- Send a summary with agreed next actions
- Answer follow-up questions from attendees
What you get
Deliverables, not a slide deck of opinions.
- BriefingExecutive briefingA plain-language session on your top application risks, your exposure and the decisions needed.
- WorkshopHands-on workshopEngineers threat model a real feature, read attack events or test an API, with guidance.
- Slide deckSlides and exercisesThe deck and exercise material, yours to reuse with other teams.
- PDF summaryWritten summaryKey points, questions raised and agreed next actions, sent shortly after the session.
What happens next
Afterwards, you can decide.
An assessment is only useful if it changes a decision. These are the ones this engagement is designed to unlock.
- 1Whether a full assessment is the right next step, and which one
- 2Which application risks the board accepts, and which need funding
- 3Which team practice to adopt next, such as threat modelling
- 01
Assess
I audit your applications and the security you already have, across six areas. Evidence, not questionnaires.
- Findings with evidence
- Score per area
1–4 weeks
- 02
Recommend
A prioritised plan: what to fix first, what it costs, and what risk it removes.
- 30/90/365-day plan
- Board summary
With the assessment
- 03
Execute, case by case
If you want help delivering, I scope it by expertise, manpower and timeline. Your team, a partner or Innov8.
- Delivery options
- Independent oversight
Only where it makes sense
Method
Built on standards your auditors recognise.
- OWASP Top 10
- OWASP API Security Top 10 (2023)
- NIST CSF 2.0
Grounded in delivery
Where this experience comes from.
What does an application security board briefing cover?
Four questions, in plain language: which application and API (application programming interface) threats matter in your sector, how exposed your own digital channels look, what is already in place to stop them, and which decisions or budget are needed. Tool names and jargon stay out unless the board asks. Briefings usually run for half a day or less, with time for questions.
Can you run a workshop for developers and testers?
Yes. Engineering workshops are hands-on and use your own systems where possible: threat modelling a real feature, reviewing WAF (web application firewall) events from your edge, or testing an API (application programming interface) for common authorisation flaws in a safe environment. They work best with one team at a time, so the exercises stay specific to what that team builds.
Is the briefing a sales pitch?
No. The briefing is a paid, standalone engagement and it is vendor-neutral. I name products only when they help explain a point, and I disclose that I head Innov8’s Application Security Business Unit. If an assessment is the right next step I will say so, but the session has to be useful even if you never work with me again.
Can sessions be delivered remotely?
Yes. Ravindu Fernando, a Colombo-based application security consultant, runs executive briefings over video or in person. Longer hands-on workshops work better in one room, because exercises move faster. On-site sessions in Sri Lanka are simple to arrange, and sessions in the Maldives, the Gulf Cooperation Council (GCC) states and the Asia-Pacific region are arranged case by case.
Who should attend an executive briefing?
The people who own the risk and the budget: the chief executive or chief operating officer where possible, the CIO (chief information officer), the CISO (chief information security officer), the head of digital and a board or risk committee member. Keep it small enough for real questions. A separate session for technology leads can go deeper on controls without losing the executive audience.
Other engagements
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support