Role: The Catalyst
For consultants — and those who might hire them: here's how to leverage external expertise without long-term dependency.
Hiring a security consultant can speed up the development of your internal AppSec capacity or hold it back. It depends heavily on clear boundaries, expectations, and accountability. This deep dive on the Catalyst role provides a blueprint for shaping the collaboration without creating long-term dependency.
Who is the Catalyst?
The Catalyst is one of six roles within the AppSec Ownership Model and refers to:
Someone who brings external expertise in building AppSec ownership within your company.
This includes:
AppSec consultants or guides
AppSec trainers
This is, of course, not an exhaustive list and you may find these boundaries useful in other contexts outside of AppSec as well.
If you are currently looking for AppSec guidance, feel free to reach out. I’m committed to keeping you independent.
What AppSec domains can the Catalyst support?
The Catalyst can’t own AppSec domains, they can only support. So here’s what they can focus on:
Security Tooling | Provide current market insights on what solutions are available and how to select and integrate tools to support your team.
A good guide is independent. That means they don’t work with just one vendor, but help you choose something that fits your needs individually.
Security Strategy | Provide guidance in navigating the complexity of AppSec.
This includes setting up processes for Vulnerability Management and Incident Readiness, and providing resources to customize for every AppSec domain.
Security Culture | Provide guidance for building a strong security culture and a company-wide security champions program.
A good guide knows how important culture is and will help you build an AppSec program that is centered around your developers, not your security team.
Now that you see the bigger picture, let’s make accountability explicit.
What is the Catalyst accountable for?
Here’s what you can hold your Catalyst accountable for:
Coaching the AppSec lead and acting as a strategic sparring partner.
Reviewing and advising on tooling, processes, and structural decisions.
Spotting blind spots, challenging assumptions, and providing external validation.
Supporting the setup of a scalable AppSec strategy and guidance for developing a strong security culture.
Providing best practices, templates, and playbooks to accelerate internal decision-making.
Maintaining external perspective and bringing in relevant market, tooling, or ecosystem insights.
What accountability must stay internally?
Here’s what you must strictly own internally:
Delivering or owning policies, findings, or operational outcomes.
Acting as a direct contact for developers or security champions.
Taking over operational responsibilities within product or security teams.
Creating dependencies or acting as a “shadow AppSec lead”.
If you let a consultant take ownership of these areas, you’ll become dependent on them in the long run. They can support you, but you must be careful not to externalize accountability.
Who does the Catalyst work with?
There is only one role the Catalyst should work with:
Owner (e.g., AppSec lead) | Only with a clear mandate and by invitation.
They may work with interim stakeholders (e.g., CTO or an architect) during the initial phase to facilitate alignment and prepare for the takeover of an internal owner. If there is no internal owner, appointing one should be the highest priority.
They can work with other roles initially, e.g., as a trainer for software developers, but this should not turn into a long-term dependency and shouldn’t happen without the Owner’s explicit approval.
The Catalyst is one of six roles within the AppSec Ownership Model, which defines clear accountability for everyone involved in developing secure software.