Working groups

The GovOps Working Group will develop a new scalable operational architecture for governing authorization risk across modern software systems, infrastructure, and endpoints. GovOps elevates “capability” as the primary unit of governance for measuring, managing, and reducing authorization risk. The group’s initial work will define a standard catalog of capabilities, new metrics to measure the direction of travel, and an architecture overview with implementation and governance guidance. By exposing capabilities, governors can deploy new tools to help prioritize mitigating the authorization risks with the biggest impacts, hold the right parties accountable, and foster organizational risk transparency. This work supports OWASP’s mission by advancing software security in an area that is becoming increasingly urgent: authorization governance. As AI agents and autonomous workloads expand, organizations need open, vendor-neutral methods to make access decisions visible, measurable, and accountable. GovOps will help OWASP provide leadership in securing the next generation of application, API, and agentic systems.

The purpose of the OWASP ISO Liaison Working Group is to formally bridge the gap between OWASP’s practitioner-led security guidance and the International Organization for Standardization’s (ISO) global policy frameworks. While OWASP dominates the operational reality of application security, ISO standards (such as the 27000 series) drive governance and compliance.

This is a placeholder for Shruti's working group.

Group to improve student chapters