Patch, an application security engineer, looking deadpan

Patch: Working as Designed

A comic about application security, reality, and the gap in between.

Tuesdays.

Patch is an overworked application security engineer who fights vulns, false positives and organisational chaos, one ticket at a time. He is not a real person and neither is anyone else here — every strip is drawn from a public discussion of a problem the whole industry has, and says which one. See the terms.

Four panels. A manager tells Patch their new AI scanner found 47,000 vulnerabilities overnight. Patch asks how many it can reproduce. The manager says that is what we hired you for. Final panel: Patch buried behind enormous stacks of paper, saying he would like to report a denial-of-service attack. — Inspired by a public discussion: CVE scanners generating more work than actual security. Read the thread

Got a topic? The good ones are usually the thing that made you close your laptop and stare at a wall. If you have seen a public thread that captures it, that is exactly what these are made from.