About the Application Security category
What belongs in this category
The Application Security category covers products that find and fix weaknesses in the software an organization builds and protect it once it runs. Typical entries test source code (static testing), running applications (dynamic and interactive testing) or both, protect applications from inside while they run (runtime application self-protection, or RASP), or combine several of these in one platform.
This is the broad application category. Code and application testing, including fuzzing, has no narrower category and enters here; testing built into developer pipelines can also enter DevSecOps. Runtime self-protection can enter here or Web Application and API Protection (WAAP). A specialist product starts in its own category, such as Application Security Posture Management (ASPM), Software Supply Chain Security, Open Source Security, SBOM Management, Threat Modeling, Mobile Application Security, API Security, API Abuse Prevention or Website Security, or AI Code Security and Remediation for AI that writes code fixes. Each of them can also enter Application Security.
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the applications the product secures: applications and code scanned, languages and frameworks supported, development teams using it, and customers that run their application security program on it.
- Innovation — an application security problem solved in a new way, such as findings developers trust enough to fix, testing that keeps pace with daily releases, or one engine covering code, dependencies and running applications.
- Impact — results for customers: vulnerabilities fixed before release, time to fix, false positives removed, findings in production reduced. Give before-and-after figures.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.