This study plan is based on milestones. So, check how much you can cover within the timeline. The more you cover the topics, the better candidate you are for the job role. Also, I assume you have already checked and are comfortable with Common Security Skills study plan.
Just to make sure that everyone understands what you need to learn to be an Application Security Engineer. Application Security is different from Web Security or commonly people think it as offensive security or pentesting. Though it needs some concepts aligned with pentester, it's altogether a totally different skill set.
It is more towards shift left security including Threat Modeling, Secure Code Review, Secure Code Design, Training Developers, taking care of overall SDL process, and of course OWASP Top 10 web and API security. I have another page specifically for "API Security Study Plan" because that skill also needs good time to learn.
- AppSec is not Pentesting (Penetration Testing) or Web Security (people use it generically).
- Think more of a combination of developer and attacker
- Talking to developers, giving training to them or going through the code should not scare you.
- Tougher than Pentesting (Topic of debate for another day)
- Can write code for PoC, Exploit or demo with comfort
- API security should be your area of interest.
- Good understanding of Identity and Access Management (IAM) will help for auth-related design and reviews.
Usually it will take you 6-12 months to be good at the Application Security fundamentals to get a job at entry level.
- Web Application Concepts - 6 weeks
- Threat Modeling - 2-3 weeks
- Secure Code Review - 6-8 weeks
- Cryptography - 3 weeks
- Security Development Lifecycle (SDL) - 4 weeks
- Books
- Videos
- Courses - Try to complete at least 1-2 courses (1-2 months)
- Certifications - on your bandwidth and wish
- Interview Questions
- Application Security Tools
- Whom to follow on X (formerly Twitter)
Duration: 6 weeks
This topic will have an overlap with the concepts required for Pentesting, but you have to now think more of a defender than offender. Go with your pace, but make sure you understand the basic web security concepts very well like HTTP Security Response headers, Bruteforce, CSRF, Injection, JWT, Cryptography, Hashing, Encoding etc.
- Understanding of various HTTP methods, PUT vs POST, UPDATE vs PATCH, leverage OPTIONS method
- Ability to understand response status codes.
- what if you got 200, when you tried something malicious
- what can we do if we get 403
- let's try to get 500 status code, and why so? What will it reveal?
- Try to understand each status code which as a pentester you would love to see.
- Understand HTTP headers very well, especially response headers. You would need it more often while doing pentest.
- TCP 3 way handshake
- How SSL works
- Basics of security terminologies
- Essentials Security Concepts
You can find the majority of the security concepts at OWASP Cheatsheet
Understand the fundamental concepts on what it is, how it can be vulnerable and how you can either exploit it or mitigate it.
- Understanding how proper implementation of AuthN and AuthZ contribute to robust security. What can an attacker do to exploit it and how to mitigate/defend it
- How session and cookies work and how it can be vulnerable, bypassed or even exploited
- Understand how session management can be more secured
- In-depth understanding of XSS from both perspective exploit and mitigation
- REST concepts like CRUD.
- Different types of injections specially SQLi, RFI,LFI, RCE
- Mass Assignment
- Concepts like rate limit, bruteforce, replay attack, MITM, session fixation, session hijack, credential stuffing
- CORS concepts
- How can you prevent SSRF attacks
- JWT Tokens in depth
- Basic of encoding, decoding, hashing
- Good understand of Cryptography and its implementation in application
- SAST vs SCA
- Very good at OWASP Top 10:2025 (current edition, announced Nov 2025 at Global AppSec DC, final release Jan 2026) and OWASP Top 10 for API 2023 (latest API edition)
- What changed from 2021: two new categories — A03:2025 Software Supply Chain Failures (widened from "Vulnerable and Outdated Components" to cover dependencies, build systems and distribution) and A10:2025 Mishandling of Exceptional Conditions. Broken Access Control stays at A01 and now absorbs SSRF; Security Misconfiguration climbs to A02. See also Software Supply Chain Security Study Plan for A03 depth.
- OWASP Top 10 for Web 2021 — historical, but still worth reading: a lot of tooling, training material and interview questions are still written against the 2021 IDs, so you need to be able to translate between the two.
- Go through OWASP Secure Code Review Guide, understand what to verify and how to use this guide.
- Very good at OWASP ASVS 5.0.0 (Application Security Verification Standard, released 30 May 2025 — project page), it's your job to make every developer aware about it and must use while development.
- What changed in 5.0: ~350 requirements across 17 chapters (down from 4.0's count, heavily deduplicated); the old V1 Architecture chapter was dissolved into the topic chapters; new chapters for Web Frontend Security, Self-Contained Tokens (JWT etc.), OAuth/OIDC and WebRTC; cryptography guidance updated with post-quantum considerations; password rules realigned to NIST SP 800-63; L1 streamlined for easier adoption.
- Go through OWASP Software Assurance maturity Model (OSAMM), if you aim for a security architect role.
- Understand what causes BOLA and BFLA and try to be good at testing these vulnerabilities.
- Various weak cipher suites, how to test, how to make developers aware about it
- Authentication and Authorization
- Advanced SQL Injection
- XML Injection, JSON Injection
- Understand SAML and LDAP Injection
- NoSQL Injection
- GraphQL Injection
- XXE Attacks
- Server-side Template Injection
- Deserialization
- CSP: Content Security Policy
Read Threat Modeling Study Plan
Read Secure Code Review
Read Cryptography
Read Security Development Lifecycle
If you work with mobile apps (Android/iOS), also check the Mobile Application Security Study Plan.
Most code you review from 2025 onwards is at least partly generated by an AI coding assistant, and that shifts the AppSec threat model in ways worth planning for:
- Volume and review pressure — far more code lands per developer per sprint, so manual review does not scale; your leverage moves to guardrails in CI, secure defaults in frameworks/templates, and paved-road libraries rather than case-by-case review.
- Repeated, patterned defects — assistants reproduce whatever pattern they were trained on, so a single insecure idiom (string-concatenated SQL, disabled TLS verification, hand-rolled auth checks, hardcoded secrets in examples) shows up across many files instead of once. Fix the pattern and the prompt/rule set, not just the instance.
- Missing security requirements — a feature prompted into existence usually has no threat model and no non-functional security requirements behind it. Push security requirements into the prompt/PRD stage instead of finding them at review time.
- New trust boundaries in your own toolchain — the assistant, its extensions/MCP servers and the packages it suggests are now part of your build path. Untrusted content the assistant reads (an issue, a doc, a dependency's README) can influence what it writes: treat that as an injection surface, and treat a hallucinated or attacker-registered package name as a supply chain risk (see Software Supply Chain Security Study Plan).
- The application itself may be AI-backed — if the app calls an LLM, does RAG, or runs agents/tools, the AppSec threat model has to extend to prompt injection, excessive agency and output handling.
Don't learn this from this page — go to the dedicated plans:
- GenAI Security Study Plan for LLM/agentic threats, OWASP Top 10 for LLM and Agentic Applications, and AI-assistant/toolchain security.
- Secure Code Review Study Plan for how to review AI-generated code and where to place automation.
- Threat Modeling Study Plan for shifting requirements earlier, before the code is generated.
- Agile Application Security
- Application Security Program Handbook
- Writing Secure Code
- The Tangled Web: A Guide to Securing Modern Web Applications
- Alice and Bob Learn Application Security
- OWASP Code Review Guide
- Introduction to Application Security
- Scaling your AppSec Program with semgrep
- Building an AppSec Program from the ground up by Snyk
- Application Security - Understanding, Exploiting and Defending against Top Web Vulnerabilities by Cerner
- Securing Web Application
- Web Application Security: 10 things developers need to know
- Application Security from SANS Institute
- Software Security on Coursera
- Cloud Application Security
- Application Security Guide - Udemy
- Sec522: Application Security: Securing Web Apps, APIs, and Microservices from SANS Really nice one but costly.
- Free OWASP Top 10 practice from Kontra Security
- CSSLP: Certified Secure Software Lifecycle Professional Recommended
- CASE: Certified Application Security Engineer for Java and .NET professionals
- GWEB: GIAC Certified Web Application Defender
Possible Application Security interview questions is shared at different github repo to keep it aligned with career roadmap guide.
- Checkmarx for SAST or HCL AppSCan (Previously it was IBM AppScan)
- Snyk Code for SAST and Snyk Open Source for SCA
- git-secrets or gitleaks or trufflehog to find out secrets
- Chef Inspec
- OWASP Dependency Check is for SCA
- Bandit for python code
- Sonarqube for SAST with few plugins like findsecbugs
- RetireJS for JS libraries
- Contrast for IAST solution
- Coverity from Snyopsys
- You must not ignore Burp Suite Pro
- Veracode
- InSight from Rapid7
Why? Because you will see lots of security professionals active here and sharing cool stuff often. Note that since the 2023 rebrand to X, a good number of AppSec folks have moved most of their posting to LinkedIn, Bluesky or Mastodon — the handles below are the same names to look for on those platforms too, so follow them wherever they are actually posting.