A control plane is the layer that holds desired state and makes reality converge to it — the pattern behind Kubernetes, cloud networking, and modern infrastructure. Applied to AppSec, a security control plane holds the intended security state of the delivery estate — which pipelines scan, under what policy, with which provider configuration — and continuously reconciles the estate against it.
The defining properties
- Stateful: inventory, enrollment, policy, and history are first-class data, not implied by YAML contents.
- Authoritative: decisions are computed centrally and projected outward; clients render, they do not re-decide.
- Reconciling: observed state is compared to desired state on a loop; drift is surfaced and repaired.
- Audited: every state change carries actor, target, and time.
Control plane vs dashboard
A dashboard reads someone else's state and displays it. A control plane owns state and changes the world to match. The difference shows up in verbs: dashboards show coverage; control planes enforce it.
