Why Enterprises Must Add Application Hardening to Their DevSecOps Strategy
July 31, 2023

Wing To
Digital.ai

As the volume, development velocity, and variety of applications and their attack vectors skyrocket, it's time to rethink how we use application hardening. Application hardening, also known as "application shielding" and "in-app protection," protects live applications from reverse engineering and tampering.

Application hardening isn't just for mobile applications anymore but is emerging as a standard way of protecting desktop and web applications across industries and for a good reason. Bringing application hardening into a comprehensive DevSecOps strategy will help enterprises overcome secure coding skills gaps and better enable developer teams to deliver higher quality applications faster to meet the demands of today's environment.

By 2025, IDC predicts that 750 million discrete applications will be released worldwide, up from roughly 195 million in 2021 (The Need for Application Hardening as Part of a Holistic DevSecOps Strategy, May 2023). With more applications being accessed from the growing variety of devices and platforms, the attack surface continues to expand. At the same time, cybercriminals keep finding new ways to exploit vulnerabilities, even in securely coded applications via reverse engineering and tampering techniques.

Unsurprisingly, application development velocity keeps increasing, given the popularity of DevOps practices and innovative developer tools powered by automation and AI to speed up dev cycles. IDC expects 70% of large organizations will have the means to release daily code in production by 2025, up from a meager 5% in 2021.

Now companies are integrating DevSecOps technologies with DevOps processes to make security best practices part of the developer's responsibilities. In reality, many developers need more secure coding experience and help to keep up with the shifting threat landscape. Application hardening helps fill these gaps.


Source: IDC, 2023(link is external)

The following are benefits of application hardening as part of DevSecOps

Improved build-time security posture without burdening developers

Code obfuscation is the most common type of build-time application hardening. It is the process of making code difficult for humans or machines to understand while retaining the integrity and behavior of the application. This process can be automated so more secure applications are released without requiring developers to be security experts. The best obfuscation solutions are regularly updating and releasing new techniques to prevent deobfuscation and reverse engineering.

Visibility into potential attacks of applications in production

Application tampering is the unsanctioned use of an application in a way not intended or authorized by the organization. Tampering happens after an application is released, and unless production monitoring is in place, the organization cannot detect it. Tampering is a growing problem that has led to data breaches, financial and reputational losses, and legal liabilities.

Tampering detection uncovers application and user behavior that signals an application is being messed with. For instance, a threat actor could use a debugger to reverse engineer an application for malicious intent. Device fingerprinting can provide insight into how a user connects to an application to understand behavior better. When alerted to tampering, enterprises receive detailed visibility into information such as the device, operating system, browser, IP address, and geographic location.

Real-time mitigation of attacks from known and unknown threats

While Web application firewalls (WAF) are used to protect Internet-based applications, they analyze the traffic to and from an application but are blind to data within applications. According to Kaspersky, public-facing web apps are the leading attack vector cybercriminals use to penetrate an organization's perimeter.

Application hardening should be integrated into DevOps workflows. Enterprises that take this approach can ensure that nonhardened applications are not released without security protections — for example, through coordination of release orchestration with an Open Policy Agent (OPA).

Application hardening also needs to encompass application monitoring and runtime application self-protection (RASP), which enables applications to detect tampering and automatically respond if tampering is detected. RASP security offers real-time threat detection by looking at both the application and analyzing the context of events causing the current behavior of the application. With this visibility into an application's logic and data flow, RASP can trigger automatic, customizable actions in response to unexpected behavior, offering greater attack protection of applications in production.

When considering an application hardening solution, enterprises should identify solutions that incorporate tamper detections, code obfuscations, and RASP with customizable event responses. Additionally, any solution should integrate with DevOps and DevSecOps workflows and allow for proper governance and compliance checks. Finally, solutions that are open-architecture and allow for heterogeneous toolsets will provide the most flexibility as they are incorporated into workflows.

Wing To is VP of Engineering for Value Stream Delivery Platform & DevOps at Digital.ai
Share this

Industry News

May 21, 2025

Red Hat announced jointly-engineered, integrated and supported images for Red Hat Enterprise Linux across Amazon Web Services (AWS), Google Cloud and Microsoft Azure.

May 21, 2025

Komodor announced the integration of the Komodor platform with Internal Developer Portals (IDPs), starting with built-in support for Backstage and Port.

May 21, 2025

Operant AI announced Woodpecker, an open-source, automated red teaming engine, that will make advanced security testing accessible to organizations of all sizes.

May 21, 2025

As part of Summer '25 Edition, Shopify is rolling out new tools and features designed specifically for developers.

May 21, 2025

Lenses.io announced the release of a suite of AI agents that can radically improve developer productivity.

May 20, 2025

Google unveiled a significant wave of advancements designed to supercharge how developers build and scale AI applications – from early-stage experimentation right through to large-scale deployment.

May 20, 2025

Red Hat announced Red Hat Advanced Developer Suite, a new addition to Red Hat OpenShift, the hybrid cloud application platform powered by Kubernetes, designed to improve developer productivity and application security with enhancements to speed the adoption of Red Hat AI technologies.

May 20, 2025

Perforce Software announced Perforce Intelligence, a blueprint to embed AI across its product lines and connect its AI with platforms and tools across the DevOps lifecycle.

May 20, 2025

CloudBees announced CloudBees Unify, a strategic leap forward in how enterprises manage software delivery at scale, shifting from offering standalone DevOps tools to delivering a comprehensive, modular solution for today’s most complex, hybrid software environments.

May 20, 2025

Azul and JetBrains announced a strategic technical collaboration to enhance the runtime performance and scalability of web and server-side Kotlin applications.

May 19, 2025

Docker, Inc.® announced Docker Hardened Images (DHI), a curated catalog of security-hardened, enterprise-grade container images designed to meet today’s toughest software supply chain challenges.

May 19, 2025

GitHub announced that GitHub Copilot now includes an asynchronous coding agent, embedded directly in GitHub and accessible from VS Code—creating a powerful Agentic DevOps loop across coding environments.

May 19, 2025

Red Hat announced its integration with the newly announced NVIDIA Enterprise AI Factory validated design, helping to power a new wave of agentic AI innovation.

May 19, 2025

JFrog announced the integration of its foundational DevSecOps tools with the NVIDIA Enterprise AI Factory validated design.

May 15, 2025

GitLab announced the launch of GitLab 18, including AI capabilities natively integrated into the platform and major new innovations across core DevOps, and security and compliance workflows that are available now, with further enhancements planned throughout the year.