How to adopt continuous application security