Four paths for months 4 to 6

By month four you have a pipeline map, an inventory, a triage habit and some trust with engineers. You cannot do everything next. Pick one programme, based on what the first three months showed you, and do it properly.

Path 1: security champions

A champions programme gives each development team a person with an interest in security, some extra training and a direct line to you. It scales you across teams you cannot attend every week. OWASP runs a Security Champions Guide project for organisations building one.

• Choose this if you have many teams and not enough of you.
• Make it voluntary, give champions real time for it and recognise their work in front of their managers.

Path 2: AI red team

If your products depend on AI features, test them the way an attacker would: try to make them reveal data, ignore rules, call tools they should not or produce harmful output. Use the OWASP Top 10 for LLM Applications as a starting checklist.

• Choose this if AI features are central to the product or growing fast.
• Agree scope and rules in writing first, and report findings the same way as any other.

Path 3: supply-chain security

Go deeper on what you started in month one: a bill of materials for key services, signed builds, reviewed updates and an approved list for model files and MCP servers.

• Choose this if your inventory showed many dependencies, unclear build steps or a lot of downloaded models.

Path 4: API security

APIs carry most of the data in modern products. The OWASP API Security Top 10 2023 puts Broken Object Level Authorization first: one user reading another user’s records by changing an ID. These flaws are rarely caught by generic scanners and need testing that understands the business logic.

• Choose this if your inventory is mostly APIs, or partners and mobile apps consume them directly.

Rule of thumb:Whichever path you choose, write down what success looks like at month six before you start, so you can tell whether it worked.