The question we get from CTOs and security leads, more than any other: "we've done some security work; what should we do next?" The honest answer is "it depends," but the dependency tree is shallower than it looks. Most companies, regardless of their stack, benefit from the same set of priorities in roughly the same order.
Here's the roadmap we'd hand to a team that asked.
Phase 1: Foundation (months 1–3)
Before any sophisticated work, the basics need to be solid.
- Centralized authentication. One identity system per environment. Not one per service. Not three across legacy products. The number of "shadow auth" implementations a typical company has is depressing; the consolidation pays for itself.
- Logging that survives. Application logs, authentication events, admin actions, and security-relevant errors flow to a system someone could query during an incident. Real-time isn't necessary. Retention is.
- Secrets out of source control. Not just "rotated when we got caught." All of them, audited and confirmed via secret scanning across the full git history.
- MFA enforced on every administrative interface. Cloud consoles, source control, package registries, deployment systems. No exceptions for "convenience."
- Dependency monitoring. SCA running on every build. Critical CVEs trigger an alert; high CVEs trigger a ticket; medium and low aggregate to a weekly report.
None of these are exciting. Each one prevents an entire class of incident.
Phase 2: Application surface (months 3–6)
Once the foundations exist, the application-level work pays off.
- Authorization audit. Every endpoint, every action, every resource. Document who can do what. Find the endpoints that exist but aren't in any spec. Fix the ones that don't check what they should.
- Input validation discipline. Adopt a single validation library. Enforce its use at every API boundary. The goal is not "no SQL injection" but "no unstructured input crossing trust boundaries."
- Security headers across the board. CSP in report-only first, then enforced. HSTS preload. The full Mozilla Observatory checklist.
- Rate limiting on every authentication-adjacent endpoint. Login, password reset, email verification, MFA, OAuth callbacks. The same rate-limit story applies to all of them.
- Session and token rotation. Long-lived tokens become short-lived. Refresh flows replace forever-tokens. Revocation works and has been tested.
This phase is where most of the immediate-payoff vulnerability classes get closed. A serious external assessment after this phase will produce a different report than one done before it.
Phase 3: Adversarial readiness (months 6–9)
Now you're protecting against an attacker, not just an audit.
- External pentest, focused on application logic and chain construction. Not a scanner-driven engagement. A real two-week effort by experienced testers.
- Remediation with deadlines. Critical in 7 days, high in 30, medium in 90. Track in your normal ticket system, but with these labels.
- Retest. Verify remediation. Get an updated report. This is the artifact procurement teams will increasingly ask for.
- Threat modeling on upcoming changes. The big feature releases of the next six months get walked through. Not all of them in the same detail; risk-rank by visibility and trust boundary changes.
Phase 4: Operational depth (months 9–12)
Detection, response, and continuous improvement.
- Detection rules for the bugs you fixed. If we found an auth bypass, your monitoring should now alert if anyone tries to exploit the same pattern.
- Incident response runbook. Documented, rehearsed. The first time you use it should not be the first time.
- Backup restore tested. Not "we have backups." Restored a real backup in the last 90 days, with verified data integrity.
- Bug bounty or VDP. A safe channel for outside researchers. Even a public security.txt with a contact email puts you ahead of most peers.
The takeaway
None of this is novel. None of it requires a specific tool. The work is mostly making the boring things actually happen, in order, and following through.
The companies that follow this roadmap don't have zero risk. They have substantially less risk than they had a year before, and they have evidence to show it. That evidence is what wins enterprise deals, satisfies auditors, and — when something does go wrong — turns potential disasters into manageable incidents.
If you're stuck on "what next," start at Phase 1 step 1 and don't move on until each item is genuinely done. Most companies underestimate how far they have to go on the foundation. The companies that get the foundation right need less of everything else.