Application Security: Everything we know is wrong
summary
Claims that time‑boxed pentests fail because attackers spend 10–100× longer probing, that most breaches are business‑logic failures not scannerable bugs, and that about 80% of codebase often comes from third parties while 26% of downloads vulnerable shows supply‑chain risk. Recommends combining tuned DAST/SAST and multiple scanners with manual validation, threat‑modeling, dependency patching and continuous monitoring so fixes target real business risk rather than endless checkbox pen tests.
AI-written summary · about
chapters (32)
- 0:00Intro
- 1:53Organizations have no lack of relevancy
- 3:05Loyalty bill hack
- 4:46Statistics
- 5:42Money
- 6:51Software insecurity wrong
- 7:28Asymmetric arms race
- 9:22Traditional model
- 10:00Too many variables
- 11:27The accepted world
- 12:57The attacker schedule
- 13:58The idea of risk
- 14:50Timelimited approach
- 18:43Clientside tools
- 20:11Internal tools
- 22:36Cheeseburger analogy
- 24:13Software food chain
- 25:54Opensource vulnerability statistics
- 26:45Spring vulnerability
- 27:44Patch management
- 29:04Biting off more
- 30:07Large scale vulnerabilities
- 31:16Where we are
- 31:27Data consumption
- 31:52Enterprise Security Intelligence
- 34:15Information Flooding
- 34:38Context
- 36:31Compliance
- 37:54Kinder Eggs
- 38:37Legal in USA
- 41:26Conclusion
- 43:20Outro
related talks
52mApplication Security at DevOps Speed and portfolio scale
33mBattle Tested Application Security
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
26mBeyond Testing: Application Security in the Age of DevOps
19mPenetration Testing
49mPragmatic Approaches To Building Secure Software
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
45mApplication security loves Agile