How to Build an Application Security Program
summary
Argues there is no perfect appsec product and successful programs pair static + dynamic tools (static often ~$5k, dynamic $10,000–$20,000), rely on people more than tooling, and reach roughly 65–70% automation in the best orgs rather than the 95% vendors promise. Recommends whiteboarding full deploy-to-prod workflows, enforce shared linters, run dev CTFs and hands‑on training, measure business impact of bugs (loss per hour), and expects config drift of ~20–25% even in automated environments.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker background
- 3:39Lessons learned in app sec
- 8:23Managing management and product teams
- 11:54Working with developers
- 13:20Time and budget management
- 16:15Common security pitfalls
- 20:29Communication and titles matter
- 21:55Key takeaways and summary
- 24:26Q&A on framework updates
related talks
36m5 Steps to Drive Enterprise Software Security
42mBuilding an AppSec Program with a Budget of $0: Beyond the OWASP Top 10
33mBattle Tested Application Security
57mKeynote: Maturing Your Application Security Program
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
57mWhat’s in an AppSec program?
47mSecurity is Everybody's Job
45mApplication security loves Agile