Don’t Sh*t-Left: How to Actually Shift-Left
summary
Shift-left often fails because tools and processes are wrong, not the idea: adding a SAST to CI yields noise and not fixes, legacy scanners show 50–80% false positives (NIST up to 78%) and research finds 60% of vulnerabilities go undetected by automation. Surveys show 86% of developers deprioritize security, ~1/3 spend up to half their time on bugs, 43% of orgs see increased dev workload, 40% report too many vulns. Automated coding agents also raise risk — studies report ~30% more vulnerabilities — so the fix is clear processes, high‑fidelity findings, AI as a first line, developer‑facing assistance, and guarded platforms (Vercel/Replit style), plus Slack/traffic/ebpf discovery for shadow apps.
AI-written summary · about
chapters (20)
- 0:00Introduction and welcome
- 1:07Speaker background and company
- 2:31What shift-left really means
- 3:56Common misconceptions about shifting left
- 5:44Effectiveness of secure code training
- 7:22Security champions programs
- 8:49Developer experience as the key
- 10:15Core components of successful shift-left
- 13:01AI and vibe coding risks
- 16:55Future of shift-left with AI
- 17:36Recommendations for scaling security
- 20:50Q&A session begins
- 21:33Favorite Linux command and security as enabler
- 22:38Shadow apps and infrastructure
- 24:03Updating and maintaining vibe-coded apps
- 25:27AI art parallels and security education
- 27:15Enabling safe AI adoption
- 29:02Secure Legos for developers
- 31:05Will AI improve security skills?
- 34:40Identifying shadow infrastructure
related talks
35mShift left the right way to build secure software
01h 04mShifting Security Everywhere
22mShifting left, how security fits into the DevOps story
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
30mThe 3 Ways of DevSecOps – Making Shift Happen
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
40mDevSecOps Guide to Bulletproof Your Development Workflow
29mDevSecOps: Five Common Mistakes