Network Security personnel are entirely responsible for web application security.

Assigning sole responsibility to network security ignores application-layer vulnerabilities such as SQL injection or XSS that must be addressed by developers and AppSec teams.

Web application security requires collaboration among developers, application owners, security architects, and network security teams. No single group holds complete responsibility because vulnerabilities can be introduced at the code level, infrastructure level, or configuration level. A defense-in-depth model distributes accountability across all stakeholders.