AI for Security and Securing AI: The Two Fronts Every CISO Must Lead

Artificial Intelligence is rapidly changing enterprise security - not just in how organizations defend themselves, but also in what they must defend. For CISOs, this has created two parallel priorities that can no longer operate independently:

1. Using AI to strengthen security programs
2. Securing the organization’s own AI ecosystem

Organizations that focus on only one side are discovering major gaps either inefficient security operations or uncontrolled AI risk exposure.

The future of security is no longer just “security for applications.” It is now AI-enhanced security operations combined with AI governance and AI defense.

AI for Security: Transforming Application Security Programs

Traditional application security programs have matured over the years with practices such as SAST in CI/CD pipeline, DAST, Manual Penetration Testing, Manual Secure Code Review and VDP. 

These do remain critical. However, modern development velocity and AI-assisted coding have fundamentally changed the threat landscape. Applications are now larger, faster-changing, AI-generated in parts, micro-service driven and increasingly dependent on third-party components.  

This means traditional AppSec processes alone are no longer sufficient. The next generation of AppSec requires two major AI-driven additions:

 The AppSec lifecycle is evolving from: 

“Find vulnerabilities” to “Find, validate, and understand business impact.”

2. Securing AI: The New Enterprise Security Program

While organizations are using AI to improve security, they are simultaneously deploying AI across business functions internal copilots, customer support bots, AI-enabled workflows, AI-assisted development, document intelligence systems, AI agents and RAG-based enterprise platforms and so on. This introduces an entirely new attack surface and many organizations are discovering a dangerous misconception. Out-of-the-box AI security controls are not enough.

As highlighted in the recent case study “Building an AI Security Program for a Global Investment Firm”, securing AI requires a dedicated organizational process, not simply enabling default protections. AI systems introduce different risks and require different level of customization:

The Emerging CISO Reality

The modern CISO now operates two security transformation programs simultaneously:

Organizations that mature in only one area will remain exposed in the other.

 

Blueinfy’s Approach

At Blueinfy, we are working closely with CISOs to help establish both dimensions of this transformation:

The organizations that succeed over the next few years will not simply “adopt AI.”
They will:

• Use AI to improve security effectiveness
• Secure AI systems with the same rigor as critical enterprise applications

That combination will define the next generation of cybersecurity maturity.

Article by Hemil Shah

[Case Study] Building and Running an effective Application Security Program for a global biotechnology company

Client Overview
ACME is a global biotechnology company committed to strengthening their internal IT and application security program. They partnered with Blueinfy to develop and implement a robust application security strategy that integrates seamlessly into their development lifecycle. 

Partnership with Blueinfy

Team Structure
Technical SME - Application Security

• Technical Point of contact for Application Security & Web Penetration Testing.
• Technical support in end to end application security life cycle management.
• Identify and drive continuous process improvements across security programs and services.
• Resolve roadblocks through driving trade-off decisions to move work forward.
• Provide strategic direction and subject matter expertise for wide adoption of DevSecOps automation.
• Develop and promote best practices for DevSecOps and secure CI/CD.
• Stay up-to-date on new security tools & techniques, and act as driver of innovation and process maturity.
• Perform threat modelling and design reviews to assess security implications of new code deployments.

Manager - Application Security

• Administrative Point of contact for Application Security & Web Penetration Testing
• Accountable and responsible for overflow responsibilities from senior security leadership
• Identify and drive continuous process improvements across security programs and services
• Resolve roadblocks through driving trade-off decisions to move work forward
• Deliver correct security results to the business units
• Tracking, monitoring and influencing priority of significant application security objectives and plans
• Provide strategic direction and subject matter expertise for wide adoption of DevSecOps automation.
• Develop and promote best practices for DevSecOps and secure CI/CD.

Actions Taken

• The Blueinfy team actively engaged with the development team, attending sprint cycle calls to understand their workflow and challenges.
• Created documentation and collaborated with management to integrate application security into the development cycle, ensuring security was an integral part of the process rather than a hindrance.
• Proposed a process for penetration testing and code review where discovered vulnerabilities were mapped directly to the code, facilitating clear remediation actions for developers. This approach led to a smooth buy-in from the development team, resulting in applications being deployed with no critical or high-risk vulnerabilities.

SAST Implementation
SAST SME

• Work as SAST SME
• Develop and implement SAST strategies and methodologies tailored to Genmab's needs.
• Lead the selection, implementation, and customization of SAST tools and technologies.
• Conduct thorough static code analysis to identify security vulnerabilities, coding flaws, and quality issues.
• Collaborate with development teams to integrate SAST into CI/CD pipelines and development processes.
• Provide guidance and support to developers on secure coding practices and remediation of identified issues.
• Perform code reviews and audits to ensure compliance with security policies, standards, and regulatory requirements.
• Stay updated on emerging threats, vulnerabilities, and industry trends related to application security.
• Create and maintain documentation, including SAST procedures, guidelines, and best practices.
• Work closely with cross-functional teams, including security, engineering, and IT operations, to drive security initiatives and improvements.
• Act as a trusted advisor to management and stakeholders on SAST-related matters.

SAST Tool Selection

• A comprehensive list of requirements was created and shared with stakeholders, including development and infrastructure teams.
• Evaluated SAST products based on required features, scoring each product to determine the best fit.
• Selected and purchased the most suitable SAST tool based on evaluation results.
• Integrated the tool into the CI/CD pipeline, ensuring early detection of vulnerabilities and removal of false positives.

Outcome
With the comprehensive application security program, including SAST, penetration testing, and code reviews, ACME successfully secured all their applications before they went into production. This proactive approach ensured that vulnerabilities were addressed early in the development cycle, enhancing the overall security posture of ACME's applications.

Article by Hemil Shah

[Case Study] Implementing Comprehensive Application Security Program for ACME – Pharma Company

Background
ACME is a global pharmaceutical company overseeing more than 30,000 domains. The company operates a diverse portfolio, including critical applications related to vaccine sales and lower-priority platforms like cafeteria surveys. The new CISO faced a significant challenge: determining how to best allocate resources for application security amid a lack of compliance requirements, no existing pen-testing program, and a general absence of strategic focus. Additionally, ACME had limited knowledge about its technology stack and faced issues with SSL certificate configurations.

Challenges

1. Resource Allocation Dilemma
The CISO needed to decide whether to invest more in securing high-value applications like those related to vaccine sales or lower-priority ones like cafeteria surveys, which might not pose immediate risks but could still impact the brand.
2. Lack of Structured Security Program
ACME lacked a strategic approach to application security, resulting in reactive rather than proactive measures. Without regulatory compliance driving security practices, there was no structured pen-testing or regular scanning in place.
3. Knowledge Gaps and Technology Issues
The company had limited understanding of the technology stack used across its domains.  Even an inconsistent SSL certificate configurations across domains posed potential security risks.
4. Inadequate Scanning Practices
Scans were performed on-demand by the application team without a comprehensive strategy, leading to incomplete vulnerability management.

Solution
Blueinfy was enlisted to create and implement a detailed multiyear application security program to address ACME's multifaceted challenges.

Phase 1: Comprehensive Domain Profiling and Risk Assessment

1. Domain Profiling through Data Collection and Public Data Analysis
Blueinfy conducted an in-depth profiling of all 30,000+ domains (which was collected as part of DNS dumps and proprietary methodologies which gathers information from public domains). This involved collecting 60 different data points, including information about the technology stack and SSL certificate status.

2. Asset Base Reduction
Identification of expired or non-essential domains allowed ACME to streamline its application asset base, focusing on domains that required attention.

3. Risk Assessment

• Blueinfy worked closely with ACME to assign risk levels to each domain (High, Medium, Low) based on predefined criteria such as handling PII, PHI, login functionalities, and e-commerce.
• A new policy was developed, mandating regular scans and pen-testing based on the risk rating of each domain, ensuring that high-risk domains received prioritized attention.

4. Vulnerability Discovery

• The profiling identified domains hosting viruses due to sub-domain takeover vulnerabilities.
• Numerous SSL certificate-related vulnerabilities were discovered, including expired certificates and misconfigurations.
• Numerous domains were discovered where admin interface were accessible with default credentials.

Phase 2: Implementation of DAST Scanner and Pen-Testing

1. DAST Scanner Evaluation and Implementation

• Blueinfy assessed various DAST (Dynamic Application Security Testing) scanners to find the best fit for ACME’s needs.
• The chosen DAST scanner was implemented, with Blueinfy assisting in configuring and fine-tuning scan profiles to enhance accuracy and effectiveness.
• Detailed evaluations were conducted to eliminate false positives and ensure actionable results.

2. Pen-Testing

• Comprehensive pen-testing was performed on all high-risk domains identified during Phase 1. This included manual and automated testing to have comprehensive security review to uncover complex vulnerabilities and actionable report with zero false positives.

Results
1. Enhanced Security Posture
The structured approach led to significant improvements in the security of ACME’s application assets, with critical vulnerabilities being addressed and mitigated.
2. Strategic Resource Allocation
ACME was able to make informed decisions about where to allocate resources, ensuring that high-value applications received the necessary protection while reducing the focus on lower-priority domains.
3. Improved Security Measures
The implementation of a DAST scanner and pen-testing processes established a more robust security framework, leading to better management of vulnerabilities and improved overall security.
4. Operational Efficiency
The reduction of domains and optimized scanning practices led to more efficient operations and a more manageable security environment.

Conclusion
By partnering with Blueinfy, ACME successfully addressed its application security challenges with a well-structured phase wise plan. The comprehensive profiling and risk assessment in Phase 1 provided a clear understanding of the security landscape, while the implementation of a DAST scanner and pen-testing in Phase 2 enhanced the company's security posture. The approach not only optimized resource allocation but also established a strategic focus on application security, positioning ACME to better protect its diverse range of domains and applications.

Article by Hemil Shah