Roadmaps Security roadmaps Application, engineering and product security
Secure the products a company ships: requirements, secure development at scale, a PSIRT for vulnerabilities in your products, and the regulations such as the EU Cyber Resilience Act.
Estimated time: 15–26 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Enterprise security protects the company; product security protects customers using what the company ships. The threats, stakeholders and rules differ.
Write security requirements that engineers can build and test: authentication, logging, data handling, update mechanisms. Reuse a standard such as ASVS.
One team can be reviewed by hand; fifty cannot. Learn the lifecycle activities and how to make them routine across teams.
Review new features for security impact early, threat model the risky ones, and track findings to closure. Prioritise by exposure, not by calendar.
Researchers and customers will find flaws in your products. Publish a security contact and a disclosure policy so they can tell you safely.
A standard security.txt file and a monitored security address are the minimum. They make it easy for people to report rather than publish.
A PSIRT triages reports, coordinates fixes across engineering, decides severity and tells customers. Learn the lifecycle and the roles.
Use CVSS consistently, add context on exploitability and exposure, and set fix timelines by severity. Customers will compare your scores with others'.
Assign CVE IDs to vulnerabilities in your products, possibly as a CVE Numbering Authority. It gives customers a standard way to track them.
Write advisories that tell customers what is affected, how bad it is, and what to do, with machine-readable data such as CSAF where possible.
Work with researchers, other vendors and coordinators on timelines and embargoes. Handle disagreements professionally; they are public otherwise.
Bounties bring more eyes but also noise and cost. Set scope, rewards and triage capacity before launching, and start private.
The CRA sets security, vulnerability handling and reporting duties for products with digital elements sold in the EU. Learn what it requires and when.
Medical devices, vehicles, consumer IoT and critical infrastructure each have product security rules. Know which apply to your products.
Questionnaires, pen test reports, SBOMs and certifications are what customers ask for. Build a trust centre and reusable evidence.
Products must be updatable securely for their lifetime: signed updates, rollback protection and clear end-of-life. This is now a legal expectation.
Customers and regulators want to know what is inside your product. Generate SBOMs per release and be ready to answer exposure questions.
Commission pen tests and reviews of products, scope them well and act on the findings. Independent testing is also evidence for customers.
Set standards, the SDLC, the PSIRT and the assurance programme across all products, and fund them with a clear business case.
Track vulnerabilities per release, time to fix, review coverage, disclosure timeliness and customer-found flaws. Report trends to leadership.
Product security succeeds when product managers plan for it and engineers own it. Build those relationships and the champions network.
Product security protects what the organisation sells rather than what it runs internally. It covers security requirements, secure development across many teams, handling vulnerability reports in shipped products, and meeting the regulations and customer demands that apply to products.
A product security team typically runs the secure development lifecycle, security reviews, a PSIRT that coordinates fixes and advisories, and the evidence customers and regulators ask for. It sits close to engineering and product management.
Products carry a company's reputation and legal exposure. New laws such as the Cyber Resilience Act make security a condition of selling, and customers increasingly ask for proof. Companies need people who can build and run a product security function.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact