Application security loves Agile
summary
Argument: application security works by adopting agile habits not buying big tools. Real findings: ~5,000 known vulnerabilities across 230 projects, CVSS scores cluster around 7.5 so policy thresholds mislead, and pentests often miss exploitable context. Practical build: start with spreadsheets and pivot tables, then add small scripts (bash + jq) to create a vulnerability curation pipeline that triages what’s actually exploitable, iterates quickly, and scales into tooling only when the process proves its value.
AI-written summary · about
chapters (14)
- 0:00Application security and Agile
- 4:05Security afterthought in dev
- 7:36Breaking silos security vs dev
- 11:51Agile for application security
- 15:25Supply chain vulnerabilities
- 21:14Prioritizing vulnerabilities
- 23:43From checklists to secure software
- 26:37Security-dev collaboration
- 28:44Regulations with Agile DevOps
- 32:37Balancing policies and collaboration
- 36:56Change in app security
- 37:58Why app security loves Agile
- 40:05Scaling security in Agile
- 42:59Q&A
related talks
53mPractical tips for web application security in the age of agile and DevOps
57mAgile Application Security
46mApplication Security in an Agile World
29mPainless Agile Security
33mBattle Tested Application Security
52mApplication Security at DevOps Speed and portfolio scale
44mApplication Security: Everything we know is wrong
26mHow to Build an Application Security Program