In the past, the focus has been on securing the operating system and protocols, but increasingly, attackers are using the applications you have installed on your systems to get in the “back way” and application security has come to the forefront. There are different approaches, but one is to build an application security program. This article explains why your organization needs such a program and of course, pushes its own solution, Veracode. But whichever product you choose, the points are still relevant and can help you to justify the budget request to management.
http://www.veracode.com/blog/2012/06/five-reasons-why-you-need-an-application-security-program/