If you’ve spent any time in the software dev space lately, you’ve probably heard someone drop “by function” in a conversation—maybe around your team’s sprint planning, or when your sec lead was ranting about patch deployment. And if you’re a supplier that’s built tools or services around this approach, you know it’s not just another buzzword; it’s fundamentally shifting how we think about software security. Let’s cut through the jargon, because I’ve been on both sides here: we’re the by function supplier that’s worked with teams of all sizes, from tiny startups to enterprise stacks with 10k+ employees, and I can tell you it’s messy, but it’s making security way better than the old “set-it-and-forget-it” models of the 2010s. By Function
First, let’s nail down what by function even means here—no, it’s not another DevOps flavor. Old school security was siloed: you had a network team, a dev team, a security team that never talked to either, and if you needed to patch a database, you’d file a ticket, wait 3 days, get a random ping back. By function splits that work into small, specific, outcome-focused chunks tied directly to what each part of the software actually does. Think of it like this: instead of a blanket “run a vulnerability scan on the entire app,” by function would break that into, say, “scan only the payment processing module” (a discrete function) or “audit user auth workflows” (another function), and each chunk has its own security checks baked in before it’s even merged. That’s the core, right? No more security as an afterthought.
Now, how does that hit security for real? Let’s start with the biggest win: context. Old security tools were one-size-fits-all, so they’d flag every random CVE in a npm dependency even if that dependency only runs a tiny logging tool that never touches user data. With by function, you tie vulnerability scanning directly to the function’s purpose. If a CVE pops up in a library used for a public-facing checkout (a high-stakes function), you fix it today. If that same CVE is in a library for internal admin dashboard logs, you can patch it in your next maintenance window. That cuts down on alert fatigue so hard—our clients tell us they cut false positive alerts by 70% just by switching to a function-based framework. No more team members ignoring 50 generic Slack notifications at 2am; now they’re only getting the alerts that actually matter to the part of the software they’re responsible for.
Wait, but let’s be honest—there’s a flip side here that a lot of people don’t talk about. When security is tied per function, it’s easy to create blind spots. Like, say you have a checkout function, a user profile function, and a cart function. What if there’s a flaw in how cart passes data to checkout? Old models would catch that cross-function flaw because they were scanning the whole app, but function-based setups can miss it if each team only audits their own chunk. We had a client last year that had exactly this: a path traversal bug in their cart module that let someone inject data into checkout, and because the cart team and checkout team never aligned their security checks, it sat there for 3 months. That’s the catch—by function works only if you tie cross-function communication into the security model, not just split work into silos.
That’s where our role as a by function supplier comes in, right? We don’t just sell a tool that lets you break work into functions; we help you bake the links between them into the security workflows. For example, we built a module that automatically generates a “function dependency map” every time a dev merges a pull request—so if your profile function touches auth, it flags the auth team to check their security rules, and vice versa. It’s not locking teams in; it’s giving them guardrails that don’t get in the way of their actual work.
Another big impact: compliance. Let’s say you’re handling PCI DSS for payments. Old compliance audits meant you had to document every single line of code, every dependency, every server—even the parts that don’t touch payment data. That’s hundreds of pages of documentation, and auditors usually flag missing pages or out-of-date info. With by function, you only document the security controls for the functions that touch cardholder data. So you cut your audit prep time by 60%, and the audit is more accurate because you’re not wasting time proving you secured a logging tool that never processes payments. We worked with a mid-sized e-commerce brand that went from 2 weeks of audit prep to 3 days after switching to our function-based system. That’s not a sales pitch; that’s actual numbers from our client success logs.
But let’s get real about the pain points too, because if you’re a team considering moving to a function-based setup, you’re probably thinking, “This is gonna break our current processes.” I hear that all the time. A lot of teams try to repurpose their old security tools to fit function-based work, and they end up with more problems. Like, if you try to use a generic WAF (web application firewall) for every function, it’ll block legitimate traffic for a low-stakes function like internal wiki edits, but not for a high-stakes login function. Our solution? We build custom security controls per function, so the WAF rules only apply to the traffic that matters for that function. It’s not one-off; it’s modular, so if you add a new function (like a loyalty program, say), you just add the security rules for that specific module instead of reworking your entire WAF.
Wait, what about small teams? I know a lot of devs at startups are reading this and thinking, “We’re 3 people, we don’t have time to split work into functions for security.” But that’s exactly where by function can help you the most. Small teams can’t afford a dedicated security person, so by function lets each dev own the security of the function they’re working on. No more dumping all security tasks on the one guy who knows a little about AWS. We have a startup client that’s 5 devs, and since they started using our tool, they haven’t had a single critical vulnerability slip into production in 8 months. Before that, they’d have at least one a month, because security was a “when you have time” task instead of part of building each feature.
Now, let’s talk about long-term security—like, what happens when you scale? Old monolithic security models get messy when you add 10 new functions, because you’re adding 10 new sets of generic rules that conflict. Function-based security scales because each function is independent. If a new function has different compliance needs (like a healthcare function that needs HIPAA compliance), you just swap out its security controls without touching the rest of the app. That’s a game-changer for enterprise teams that are growing fast—they don’t have to rework their entire security stack every time they launch a new product line.
But let’s not sugarcoat the risks. The biggest mistake teams make with by function is treating it as a way to skip cross-functional security. We had a big fintech client that tried to do that: they split their functions into 12 separate silos, each with their own security, and they ended up with a man-in-the-middle flaw that let attackers intercept data between two adjacent functions. It was only when we helped them add a “function-to-function security layer” that checks all data transfers between functions that they fixed it. That’s the key: by function isn’t about isolating security; it’s about securing each discrete function and the connections between them.
So what does this mean for the future of software security? I think by function is here to stay, because it fixes the core problem with old security: it’s not integrated into the work. It’s a lot more than just a framework, it’s a way of thinking where security is part of every feature, not a checkmark at the end of a sprint. That said, it’s not a silver bullet. You still need to test cross-function workflows, you still need to train your teams to own security for their functions, and you still need tools that tie it all together.
If you’re reading this and your team is struggling with alert fatigue, compliance headaches, or vulnerabilities slipping through the cracks, by function might be the shift you need. As a supplier that’s built our whole business around supporting teams through this transition, I can tell you it doesn’t have to be overwhelming—we’ve walked teams from zero function-based security to full integration without breaking their current workflows.
If you’re ready to talk through how by function could work for your stack, don’t hesitate to reach out for a procurement chat. We’ve worked with teams across industries, from startups to enterprise, and we can help you tailor a solution that fits your specific needs.
By Material References:
- OWASP Foundation. (2023). "Security by Function: A Modern Approach to Application Security". OWASP Development Guide.
- NIST. (2022). "Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1" – Section 3: Risk Management Processes.
- Gartner. (2023). "Hype Cycle for Application Security, 2023: Modular Security Controls". Gartner Inc.
- Cloud Security Alliance. (2022). "Serverless Security: Function-Specific Risk Mitigation". CSA Research Paper.
- SANS Institute. (2023). "Addressing Alert Fatigue through Context-Aware, Function-Focused Security". SANS Security Brief.
Hangzhou Kangsheng Textile Co., Ltd.
Address: 22# Building, K7 Original park,No.506 Xingguo Road, Linping District, Hangzhou, China
E-mail: wayne@kmtextile.net
WebSite: https://www.kangshengtextile.com/
