What Does it Mean to Build a Proactive Security...
summary
Argues that culture scales security more than headcount, cites a 1:150 security to engineer ratio, and gives concrete practices: embed security engineers, run bug bounty walkthroughs, share metrics and blameless retros, and gamify with Monocle security score that grades repos. Uses GitHub and Dependabot auto‑merge to reduce noise, treats mass scanner output as a failure mode, and prefers validated, actionable fixes over generic advice. Warns against hard deadlines, secrecy, and dumping hundreds of untriaged tickets.
AI-written summary · about
chapters (9)
- 0:00Introduction to proactive security
- 2:27Why invest in security culture
- 5:43What works in security culture
- 13:28What doesn’t work in security culture
- 17:21Measuring security culture
- 18:46Conclusion and next steps
- 19:39Q&A on CEO involvement
- 21:23Q&A on risk reporting
- 23:19Q&A on dependency management
related talks
39mProactive Security, less buzzword, more action
24mConcrete Steps to Create a Security Culture
38mKeynote: Dumping Traditional Security Teams
57mBuilding a Modern Security Engineering Organization
20mBuilding security culture on infrastructure teams
31mSharing Security Secrets: How to Encourage Security Advocates
48mLevel Up Your Security Mindset
52mLeveraging Psychological Needs For Building A Security Culture Amongst Developers