Novalys

The 2026 Guide to Securing PowerBuilder Applications

    Action plan, checklists and compliance — From executable integrity to access control and auditing

  • 9 structured, standalone chapters
  • Operational checklists
  • Mapping to ISO 27001, NIST, PCI DSS, HIPAA, SOX, GDPR
  • FAQ — 11 frequently asked questions

Download the guide

Receive the complete PDF (30 pages)

We respect your privacy. Your data won't be shared.

Why this guide?

PowerBuilder applications power critical business processes: finance, healthcare, logistics, manufacturing, public sector. They must now meet security and compliance requirements far stricter than when they were first built.

Strengthen security

Without rewriting the application, by leveraging recent PowerBuilder features and specialized tools.

Identify and fix risks

Prioritize vulnerabilities and implement corrective measures systematically.

Demonstrate compliance

Generate the audit evidence required by ISO 27001, NIST, PCI DSS, HIPAA, SOX, GDPR standards.

What's inside

9 structured chapters

Each chapter stands alone and covers: context and risks, objectives, tool features, compliance and evidence.

  • 1. Securing executables and deployed components
  • 2. Encrypt data at rest and in transit
  • 3. Adopt modern and secure network protocols
  • 4. Secure exchanges with external services and APIs
  • 5. Reduce the attack surface related to the embedded browser
  • 6. Secure the build and deployment chain
  • 7. Strengthen authentication and access control
  • 8. Migrate to a modern architecture with PowerServer
  • 9. Bring applications into compliance with modern standards

Also included

Operational checklists

Two actionable checklists: generic measures recommended in most cases, and optional measures based on your architecture and regulatory constraints.

FAQ

Answers to the 11 most frequently asked questions about securing PowerBuilder applications: where to start, encryption, authentication, compliance, etc.

Bibliography

Sources cited in the guide: NIST, CISA, OWASP, Verizon DBIR publications, Appeon documentation, and references to Visual Expert and Visual Guard features.

Based on three complementary tools

PB

PowerBuilder

Code signing, connection encryption, secure network protocols (TLS 1.3, HTTP/2), OAuth 2.0, modernized WebBrowser (WebView2), solution format for automation.

VE

Visual Expert

PowerBuilder-specific static analysis (SAST): vulnerability detection, hard-coded secrets, obsolete algorithms, insecure network calls. Version-tracked reports.

VG

Visual Guard

Strong authentication (MFA), access control (RBAC), separation of duties (SoD), traceability and auditing, permission matrix, standards compliance.

Download the guide

Get the full PDF guide (30 pages): action plan, checklists and compliance mapping.

Get the guide