Know what is being worked on.
See priorities, owners and acceptance criteria in the agreed tracker. New risks and urgent requests are handled through an explicit change in priorities.
Fractional application & product security
Fractional application security.
Engineering and leadership.
Bring a fractional application security engineer and product security manager into your team for an agreed share of capacity. Get hands-on assessment, implementation and ongoing ownership without a full-time hire.
Work directly with Jawad Ali Khan through WEFT Security.
One role, two connected responsibilities
Hands-on engineering.
Practical security management.
Choose the balance your team needs. These responsibilities define the work; the agreed capacity determines what can be delivered.
| As your AppSec engineer | As your AppSec manager |
|---|---|
| Assess the productReview architecture, code, APIs, dependencies and supporting infrastructure. Validate findings and identify practical changes. | Set directionAgree the security roadmap, priorities, coverage and ownership with engineering and product leaders. |
| Build and implementConfigure tools, integrate checks, engineer controls, harden systems and submit or pair on agreed code and configuration fixes. | Coordinate deliveryMaintain the agreed backlog, connect developers and other specialists, and follow work through review and release. |
| Verify and improveRetest the relevant behavior, validate released changes and add preventive tests or patterns for recurring issues. | Make progress visibleReport completed work, unresolved risks, exceptions and decisions needed. Prepare accurate technical evidence for stakeholders. |
A suggested starting sequence
A useful first month starts
with the real product.
This is a planning example. Timing and depth depend on your scope, access, engineering capacity and deadlines.
- Understand
Establish the baseline
Map the application, data, infrastructure, current tools and open findings. Meet the owners and identify the highest-priority questions.
- Agree
Choose the first outcomes
Build a bounded backlog with acceptance criteria. Agree who implements, reviews, deploys and verifies each change.
- Implement
Make the first improvements
Work through the agreed priorities: a control gap, broken check, risky dependency, security fix or missing workflow.
- Verify & adapt
Review evidence and choose what follows
Check the results, record risks and blockers, and decide the next priorities together.
What continuing support can look like
Part of the engineering rhythm.
The engagement can include backlog and release planning, scheduled hands-on work, design and code review, developer pairing and a regular progress review.
Keep the work near the team.
Use your repositories, pull requests, tickets and communication channels. Work alongside developers, platform engineers, auditors and other specialists.
See what changed and what remains.
Review designs, configured tools, fixes and verification results. Keep incomplete checks, residual risks and decisions visible.
Before the engagement begins
Make the responsibility concrete.
You receive a scoped proposal before committing. It defines the working arrangement and how the work will be evaluated.
Applications and priorities
Which products, environments and supporting systems are included, what matters most and what is outside the engagement.
Capacity and working rhythm
The time reserved, backlog size, meeting cadence, communication channels, response terms and how urgent work is handled.
Implementation and approval
Who writes, reviews, merges and deploys changes, plus the access, production windows and rollback arrangements needed.
Deliverables, fees and review
The expected outputs, verification criteria, fees and review points, including how scope can change and how handover works.
Start at the right level
Need to see the work
before ongoing support?
Begin with a scoped assessment or implementation project: review an API, validate a backlog, repair scanner coverage or harden a release pipeline. Agree the outcome, deliver it and then decide whether continuing support is useful.
Choosing fractional support
Your questions,
answered directly.
Understand the role, the scope and what to agree before you start.
Discuss your applicationWhat is fractional application security?
Fractional application security gives your team a hands-on security specialist for an agreed share of capacity instead of a full-time hire. At WEFT Security, Jawad Ali Khan combines assessment, engineering, implementation and management of the agreed application and product security work.
When does a fractional application security engineer make sense?
It can fit when the CTO or developers are carrying security alongside their main roles, findings are not getting fixed, tools need implementation, or a product change needs security attention. It can also add defined engineering capacity to an existing security team. The scope and reserved capacity must fit the work you need.
What does fractional product security cover?
Fractional product security follows the product across design, development, delivery and runtime. A fractional software security engineer can assess code, APIs and dependencies, implement controls, and verify fixes. The agreed scope can also include developer workspaces, source control, CI/CD, artifact registries, cloud and containers that build, ship and run the product.
Can a fractional application security expert handle advice and implementation?
Yes. Jawad can assess the application, explain the risks, agree a practical plan and carry out the engineering needed to address it. The engagement can combine expert review with tool integration, workflow changes, code and configuration fixes, and verification, working alongside your developers and other specialists.
What does a fractional application security manager handle?
A fractional application security manager turns agreed priorities into a roadmap and a working backlog, coordinates owners, follows remediation through release and reports evidence of progress. At WEFT, this management work can be combined with hands-on engineering. Your named owners retain business risk acceptance, investment decisions and production approvals.
Will you carry out engineering and implementation?
Yes. An engagement can include configuring security tools, integrating CI/CD checks, implementing controls and workflows, and writing or pairing on code and configuration fixes. We agree who implements, reviews, merges, deploys and verifies each change with your team.
How is this different from a pentest or a fractional CISO?
A pentest answers a bounded testing question for an agreed scope and version. Fractional AppSec can continue through prioritization, implementation, remediation and verification as the product changes. A fractional CISO usually focuses on broader business security leadership; this offer focuses on hands-on application and product security and can work alongside a CISO or vCISO.
What does fractional application security cost?
WEFT quotes after scoping the products, stack, priorities, reserved capacity and engineering and management responsibilities. Your proposal states deliverables, schedule, fees, response terms and boundaries before you commit. There is no published standard rate or assumed monthly allocation.
Can we start with an assessment before an ongoing engagement?
Yes. Start with a scoped product or API assessment, a remediation sprint, a tool integration or a delivery security improvement. Agree the deliverables and verification, complete the project, and then decide whether continuing fractional support is useful.
Is fractional support a full-time or round-the-clock security team?
The engagement provides the capacity and response terms you agree, rather than unlimited coverage. Your named owners retain business risk acceptance and production approvals. Emergency response, round-the-clock coverage and additional specialist work require a separate agreement.
Expertise without a full-time hire
What would you hand to your AppSec specialist first?
Tell us about your product, what needs attention and any deadline. We’ll agree a useful starting scope and the right level of support.