Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls

Where should the OWASP Proactive Controls go after giving developers a concise defensive counterpart to the Top 10? Project leaders Jim Manico and Katy Anton discuss the document’s origins, intended audience, and plans for its next version. They explore how much implementation guidance belongs in a short list, whether data should shape future priorities, and how the controls relate to ASVS, cheat sheets, and other OWASP resources. The guests consider language-specific guidance and a future in which developers can move from a high-level control to concrete examples for their platform. Chris also asks how the community can review and contribute. The conversation captures an open-source project deciding how to remain approachable while becoming more useful to practicing software engineers.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Jim Manico and Katy Anton:→ Jim Manico on LinkedIn→ Katy Anton on LinkedIn→ OWASP Proactive ControlsMentioned in this episode:→ OWASP Proactive Controls→ OWASP ASVS→ OWASP Cheat Sheet Series→ NIST Digital Identity GuidelinesFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 The future of OWASP Proactive Controls02:43 A defensive counterpart to the Top 1004:46 The project’s origin story06:10 Priorities for the next version09:11 Whether data should shape the controls12:39 Mapping to ASVS and other projects14:25 A five-year vision for the project16:24 Language-specific developer guidance17:24 How the community can contribute18:50 Final thanks and next steps