Applications drive your core business functions, and are the way that customers and partners see your organization. Despite this many CISOs have little or no knowledge about the part of their infrastructure that represents the highest risk, despite over 80% of breaches being due to application layer vulnerabilities. In this workshop we will share experiences to allow us to: - Understand – what is it about applications that makes them risky? - Assess – how can your organization measure the risk that you have today? How big is your ‘gap’? - Stabilize – what practical steps can you take to prevent your application attack surface growing out of control