Harold Blankenship

My motivation comes from my direct involvement with OWASP since 2018. Through my work with projects, chapters, and Foundation operations, I've developed a strong understanding of how OWASP functions and where it can improve.

I want to help make it easier for people to contribute to OWASP and rely upon it. That means strengthening support for projects and chapters, reducing obstacles to participation, and ensuring OWASP continues evolving into a stronger organization. Ultimately, I view board service as an opportunity to help OWASP continue its growth and long-term success.

I do not believe OWASP has drifted from its core values. The organization's foundational principles remain intact.

What changes over time are priorities. Different boards and staff members may emphasize different aspects of those core values, so the organization's focus can shift from one area to another without changing the values themselves.

The area where I believe we need continued improvement is volunteer engagement. We should do more to attract new volunteers and make it easier for existing volunteers to contribute effectively. Supporting and enabling volunteers remains one of the most important responsibilities of the organization.

One of the most important responsibilities of board members is understanding the distinction between governance and operations.

Whether OWASP should pursue a new website is a strategic question and therefore an appropriate board-level discussion. However, decisions about how the project is executed, which vendors are selected, and how implementation is managed are operational matters that belong to Foundation staff.

My perspective is that the board's role is to set direction and approve strategy, while operational execution should remain within staff responsibilities.

I think the premise of the question overstates the situation. I do not believe long-term contributors are leaving OWASP in large numbers.

Have some projects departed? Yes. Were some contributors unhappy? Certainly. External factors also played a role in some cases.

The key issue is communication. Project leaders and chapter leaders will not always agree with organizational decisions, but they should understand what OWASP is doing, why it is doing it, the expected outcomes, and the timeline involved.

Clear communication reduces friction, builds trust, and helps maintain engagement within the volunteer community.

First, it is important to note that membership itself is not declining; membership numbers are growing. The challenge is communicating the value of membership more effectively.

OWASP membership often provides significant value that many people overlook. Membership helps support an organization whose projects, chapters, and resources are used throughout the security industry.

We already have benefits available to members, but not all of them are communicated effectively. Members should have more opportunities to hear directly from OWASP about what the organization is doing, how members can get involved, and what benefits are available to them.

Better communication and more member-specific opportunities to engage would strengthen the value proposition of membership.

Fundraising is one of the board's most important responsibilities.

For as long as I have been involved with OWASP, I have believed the organization has untapped potential. OWASP's resources, projects, and standards are referenced throughout the world, yet there remains significant room to expand funding sources.

We should continue engaging developer communities, build relationships with underserved communities, and broaden our outreach efforts globally. Areas such as India continue to demonstrate remarkable growth in chapters and participation.

We also need to better engage organizations that rely on OWASP resources every day. Many companies use OWASP guidance, tools, and standards extensively. Without compromising vendor neutrality, we should help those organizations recognize the value they receive and encourage them to invest back into the community that supports their work.

I do not believe OWASP itself treats AI projects differently from other projects.

AI projects currently attract significant interest and investment from external companies, which can create the appearance of imbalance. However, that funding generally comes from outside organizations rather than preferential treatment within OWASP.

OWASP's responsibility is to continue supporting all projects fairly and consistently. While flagship projects may receive strategic attention, every project should receive equal support appropriate to its tier and status within the organization.

As OWASP Treasurer and a member of the Board of Directors, much of my contribution has focused on supporting Foundation operations and governance.

I also make a point of attending AppSec events, engaging with project leaders and chapter leaders, and helping where needed. These conversations provide valuable insight into the challenges faced by volunteers across the organization.

One of the most important lessons I continue to learn is that board members must stay connected to the community. Understanding volunteer challenges and pain points helps the board determine which issues are strategic and how the organization should evolve to support its mission.