As one of my executive mentors keeps telling me, “a strategic change plan is something I must repeat to everyone over and over again until they get it, so I’d better make it simple enough to explain in a few minutes but I’d better have a framework behind it so I can back it up with dashboards and metrics.” An application security program gives enterprises the opportunity to organize their efforts around a strategic plan which can be widely communicated.