About the Application Security Posture Management (ASPM) category
What belongs in this category
The Application Security Posture Management (ASPM) category covers products that sit above an organization's application security tools. Typical entries collect findings from code, dependency, secrets, cloud and runtime scanners. They remove duplicates, link each finding to its application, owner and business context, rank what matters most and send fixes to developers in the tools they already use.
ASPM manages findings rather than producing them; a scanner whose main job is testing code fits Application Security, the broad application category, which an ASPM product may also enter. A scanner built for the pipeline fits DevSecOps. Platforms that link code findings to cloud runtime risk can also enter Cloud-Native Application Protection Platform (CNAPP).
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the application estate the product covers: applications, repositories and scanners connected, findings handled, and customers that use it as the main record of application risk.
- Innovation — a findings problem solved in a new way, such as tracing a production risk back to the team and line of code responsible, ranking by whether vulnerable code is reachable and exposed, or fixes delivered straight to the responsible developer's pull request.
- Impact — results for customers: duplicate and low-value findings removed, time to fix critical issues, share of findings with a clear owner, backlog reduced. Give before-and-after figures.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.
