Security Without the Sermon
There's a particular failure mode in security leadership that Fisher has built his career avoiding: the instinct to become the department that says no. Every security team eventually faces this gravity. The engineering team wants to ship. The security team sees the risks. The meeting happens. Nothing gets built. Everyone leaves frustrated. Fisher calls this out explicitly - the job is to manage risk, not to be a blocker.
His approach at Envestnet reflects this. Product security, in his framing, is not a checkpoint at the end of the development cycle. It's a function that lives inside the software development lifecycle from the start - embedded in the architecture conversations, the threat modeling sessions, the sprint planning. DevSecOps is not a buzzword in his world. It's a description of how the kitchen actually runs.
That philosophy is what drove him to write the Application Security Program Handbook, published by Manning. The book does not assume you already have a mature security program. It starts at zero and walks engineering leads and team leaders through building something real - reproducible, scalable, and actually connected to how software gets built in 2024. The foreword was written by Matt Rose, Chief Architect at Bionic and former leader at Checkmarx and Fortify - a signal of the book's credibility in serious practitioner circles.
Fisher's instinct to translate complex security work for broader audiences didn't stop at the practitioner handbook. He also wrote the Alicia Connected series - a three-book cybersecurity education series for children aged 6 to 10. The inspiration was personal: raising his own daughter as a digital native, he saw an opportunity to give parents and kids a way to understand technology safety before the threats arrived. Not every AppSec leader writes picture books. Fisher does.
At Temple University, he brings this same translation instinct to undergraduate and graduate computer science students. He teaches software security to people who are still forming their mental models of what secure code looks like - building the next generation of engineers who will not need to be told that security matters, because they already understand why. He also serves as an advisor to Temple's CyberDIA PSM program.
His Securely Built newsletter on Substack extends that reach further. The newsletter covers application security and product security topics with the clarity of someone who has been in the room when things went wrong and knows exactly how to explain the lesson afterward. Recent coverage has included prompt injection attacks in GitHub Actions that expose API keys from AI coding tools - the kinds of real-world, immediate threats that security newsletters should cover.
Outside of work, Fisher runs Spartan Races. Obstacle courses. Fire. Barbed wire. The same methodical thinking that builds enterprise security programs also, apparently, keeps him moving through mud and over walls. The crossover makes a certain sense: Spartan Races, like AppSec programs, require showing up prepared, trusting the process, and finishing even when conditions are not ideal.