Keynote: Dumping Traditional Security Teams
summary
Argues that centralized security teams shrink outcomes and instead shifts ownership to product and dev teams, scaling security from tiny staffs (<1% of headcount) by building tooling and culture: risk registers published and exec-visible SLAs, get-hooks that flag risky commits, auto-patching and dependency monitoring, PII tokenization, and role-specific threat-model training. Teams adopt product teams own decisions, create golden paths and auto-remediation, and report fewer bottlenecks, more developer pushback for bad features, and measurable uptake—security becomes consultative, automated, and scalable.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:11Useless Lego Trivia
- 3:45Companies Oversimplified
- 5:11Cops & Gatekeepers
- 7:16Hacker or Ticket Pusher?
- 8:34What We Want to Believe
- 11:59Actually Make It Everyone's Job!
- 14:34Share the Red Legos
- 17:38Things Fall Apart
- 20:23Still PLENTY To Do!
- 23:05Wholistic Risk Visibility
- 24:25Educate!
- 27:37Shepherd Vulnerabilities
- 29:24Catch the Stinkers
- 29:49Assist Incidents
- 30:31Not All Legos Are Safe for Everyone!
- 31:31Create Golden Paths
- 32:47Provide Duplo Blocks
- 33:05Build Robots!
related talks
01h 04mKeynote: Every Security Team is a Software Team Now
01h 04mShifting Security Everywhere
13mKeynote: Software Security: _You_ are the Calvary
25mKeynote: DevOps - The Return of Security
43mOpening Keynote - Flipping the script
25mWhat Does it Mean to Build a Proactive Security...
26mSecurity Is an API: Evolving to a decentralised security culture
40mMaking Security an integrated part of the SW Dev Lifecycle