Application security continues to receive short shrift by too many information security executives. How do you justify allocating funds and effort on an application security program? How do you ensure the investment and effort will be effective? How do you make application security relevant, and how do you measure it?