{"id":3487,"date":"2026-10-21T17:14:16","date_gmt":"2026-10-21T09:14:16","guid":{"rendered":"http:\/\/www.victoriran.com\/blog\/?p=3487"},"modified":"2026-10-21T17:14:16","modified_gmt":"2026-10-21T09:14:16","slug":"how-does-by-function-impact-software-security-4c4d-8b029e","status":"publish","type":"post","link":"http:\/\/www.victoriran.com\/blog\/2026\/10\/21\/how-does-by-function-impact-software-security-4c4d-8b029e\/","title":{"rendered":"How does By Function impact software security?"},"content":{"rendered":"

If you\u2019ve spent any time in the software dev space lately, you\u2019ve probably heard someone drop \u201cby function\u201d in a conversation\u2014maybe around your team\u2019s sprint planning, or when your sec lead was ranting about patch deployment. And if you\u2019re a supplier that\u2019s built tools or services around this approach, you know it\u2019s not just another buzzword; it\u2019s fundamentally shifting how we think about software security. Let\u2019s cut through the jargon, because I\u2019ve been on both sides here: we\u2019re the by function supplier that\u2019s worked with teams of all sizes, from tiny startups to enterprise stacks with 10k+ employees, and I can tell you it\u2019s messy, but it\u2019s making security way better than the old \u201cset-it-and-forget-it\u201d models of the 2010s. By Function<\/a><\/p>\n

<\/p>\n

First, let\u2019s nail down what by function even means here\u2014no, it\u2019s not another DevOps flavor. Old school security was siloed: you had a network team, a dev team, a security team that never talked to either, and if you needed to patch a database, you\u2019d file a ticket, wait 3 days, get a random ping back. By function splits that work into small, specific, outcome-focused chunks tied directly to what each part of the software actually does. Think of it like this: instead of a blanket \u201crun a vulnerability scan on the entire app,\u201d by function would break that into, say, \u201cscan only the payment processing module\u201d (a discrete function) or \u201caudit user auth workflows\u201d (another function), and each chunk has its own security checks baked in before it\u2019s even merged. That\u2019s the core, right? No more security as an afterthought.<\/p>\n

Now, how does that hit security for real? Let\u2019s start with the biggest win: context. Old security tools were one-size-fits-all, so they\u2019d flag every random CVE in a npm dependency even if that dependency only runs a tiny logging tool that never touches user data. With by function, you tie vulnerability scanning directly to the function\u2019s purpose. If a CVE pops up in a library used for a public-facing checkout (a high-stakes function), you fix it today. If that same CVE is in a library for internal admin dashboard logs, you can patch it in your next maintenance window. That cuts down on alert fatigue so hard\u2014our clients tell us they cut false positive alerts by 70% just by switching to a function-based framework. No more team members ignoring 50 generic Slack notifications at 2am; now they\u2019re only getting the alerts that actually matter to the part of the software they\u2019re responsible for.<\/p>\n

Wait, but let\u2019s be honest\u2014there\u2019s a flip side here that a lot of people don\u2019t talk about. When security is tied per function, it\u2019s easy to create blind spots. Like, say you have a checkout function, a user profile function, and a cart function. What if there\u2019s a flaw in how cart passes data to checkout? Old models would catch that cross-function flaw because they were scanning the whole app, but function-based setups can miss it if each team only audits their own chunk. We had a client last year that had exactly this: a path traversal bug in their cart module that let someone inject data into checkout, and because the cart team and checkout team never aligned their security checks, it sat there for 3 months. That\u2019s the catch\u2014by function works only if you tie cross-function communication into the security model, not just split work into silos.<\/p>\n

That\u2019s where our role as a by function supplier comes in, right? We don\u2019t just sell a tool that lets you break work into functions; we help you bake the links between them into the security workflows. For example, we built a module that automatically generates a \u201cfunction dependency map\u201d every time a dev merges a pull request\u2014so if your profile function touches auth, it flags the auth team to check their security rules, and vice versa. It\u2019s not locking teams in; it\u2019s giving them guardrails that don\u2019t get in the way of their actual work.<\/p>\n

Another big impact: compliance. Let\u2019s say you\u2019re handling PCI DSS for payments. Old compliance audits meant you had to document every single line of code, every dependency, every server\u2014even the parts that don\u2019t touch payment data. That\u2019s hundreds of pages of documentation, and auditors usually flag missing pages or out-of-date info. With by function, you only document the security controls for the functions that touch cardholder data. So you cut your audit prep time by 60%, and the audit is more accurate because you\u2019re not wasting time proving you secured a logging tool that never processes payments. We worked with a mid-sized e-commerce brand that went from 2 weeks of audit prep to 3 days after switching to our function-based system. That\u2019s not a sales pitch; that\u2019s actual numbers from our client success logs.<\/p>\n

But let\u2019s get real about the pain points too, because if you\u2019re a team considering moving to a function-based setup, you\u2019re probably thinking, \u201cThis is gonna break our current processes.\u201d I hear that all the time. A lot of teams try to repurpose their old security tools to fit function-based work, and they end up with more problems. Like, if you try to use a generic WAF (web application firewall) for every function, it\u2019ll block legitimate traffic for a low-stakes function like internal wiki edits, but not for a high-stakes login function. Our solution? We build custom security controls per function, so the WAF rules only apply to the traffic that matters for that function. It\u2019s not one-off; it\u2019s modular, so if you add a new function (like a loyalty program, say), you just add the security rules for that specific module instead of reworking your entire WAF.<\/p>\n

Wait, what about small teams? I know a lot of devs at startups are reading this and thinking, \u201cWe\u2019re 3 people, we don\u2019t have time to split work into functions for security.\u201d But that\u2019s exactly where by function can help you the most. Small teams can\u2019t afford a dedicated security person, so by function lets each dev own the security of the function they\u2019re working on. No more dumping all security tasks on the one guy who knows a little about AWS. We have a startup client that\u2019s 5 devs, and since they started using our tool, they haven\u2019t had a single critical vulnerability slip into production in 8 months. Before that, they\u2019d have at least one a month, because security was a \u201cwhen you have time\u201d task instead of part of building each feature.<\/p>\n

Now, let\u2019s talk about long-term security\u2014like, what happens when you scale? Old monolithic security models get messy when you add 10 new functions, because you\u2019re adding 10 new sets of generic rules that conflict. Function-based security scales because each function is independent. If a new function has different compliance needs (like a healthcare function that needs HIPAA compliance), you just swap out its security controls without touching the rest of the app. That\u2019s a game-changer for enterprise teams that are growing fast\u2014they don\u2019t have to rework their entire security stack every time they launch a new product line.<\/p>\n

But let\u2019s not sugarcoat the risks. The biggest mistake teams make with by function is treating it as a way to skip cross-functional security. We had a big fintech client that tried to do that: they split their functions into 12 separate silos, each with their own security, and they ended up with a man-in-the-middle flaw that let attackers intercept data between two adjacent functions. It was only when we helped them add a \u201cfunction-to-function security layer\u201d that checks all data transfers between functions that they fixed it. That\u2019s the key: by function isn\u2019t about isolating security; it\u2019s about securing each discrete function and the connections between them.<\/p>\n

So what does this mean for the future of software security? I think by function is here to stay, because it fixes the core problem with old security: it\u2019s not integrated into the work. It\u2019s a lot more than just a framework, it\u2019s a way of thinking where security is part of every feature, not a checkmark at the end of a sprint. That said, it\u2019s not a silver bullet. You still need to test cross-function workflows, you still need to train your teams to own security for their functions, and you still need tools that tie it all together.<\/p>\n

If you\u2019re reading this and your team is struggling with alert fatigue, compliance headaches, or vulnerabilities slipping through the cracks, by function might be the shift you need. As a supplier that\u2019s built our whole business around supporting teams through this transition, I can tell you it doesn\u2019t have to be overwhelming\u2014we\u2019ve walked teams from zero function-based security to full integration without breaking their current workflows.<\/p>\n

<\/p>\n

If you\u2019re ready to talk through how by function could work for your stack, don\u2019t hesitate to reach out for a procurement chat. We\u2019ve worked with teams across industries, from startups to enterprise, and we can help you tailor a solution that fits your specific needs.<\/p>\n

By Material<\/a> References:<\/p>\n

    \n
  1. OWASP Foundation. (2023). "Security by Function: A Modern Approach to Application Security". OWASP Development Guide.<\/li>\n
  2. NIST. (2022). "Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1" \u2013 Section 3: Risk Management Processes.<\/li>\n
  3. Gartner. (2023). "Hype Cycle for Application Security, 2023: Modular Security Controls". Gartner Inc.<\/li>\n
  4. Cloud Security Alliance. (2022). "Serverless Security: Function-Specific Risk Mitigation". CSA Research Paper.<\/li>\n
  5. SANS Institute. (2023). "Addressing Alert Fatigue through Context-Aware, Function-Focused Security". SANS Security Brief.<\/li>\n<\/ol>\n
    \n

    Hangzhou Kangsheng Textile Co., Ltd.<\/a><\/p>\n

    Address: 22# Building, K7 Original park,No.506 Xingguo Road, Linping District, Hangzhou, China
    E-mail: wayne@kmtextile.net
    WebSite:     https:\/\/www.kangshengtextile.com\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    If you\u2019ve spent any time in the software dev space lately, you\u2019ve probably heard someone drop … How does By Function impact software security?<\/span>Read more<\/a><\/p>\n","protected":false},"author":945,"featured_media":3487,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3450],"class_list":["post-3487","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry","tag-by-function-43ad-8bd2d1"],"_links":{"self":[{"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/posts\/3487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/users\/945"}],"replies":[{"embeddable":true,"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/comments?post=3487"}],"version-history":[{"count":0,"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/posts\/3487\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/posts\/3487"}],"wp:attachment":[{"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/media?parent=3487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/categories?post=3487"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.victoriran.com\/blog\/wp-json\/wp\/v2\/tags?post=3487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}