Securing web applications is a team sport. To stand a chance against a growing onslaught of web application attacks, software engineers and security practitioners need to know when to pass the ball.