State of (Absolute) AppSec
summary
Claims that secure by defaults cuts whole vulnerability classes (example: CSP to reduce XSS) but organizations still miss priorities—CI/CD and supply‑chain exposures, leaked secrets and credential stuffing drive breaches, MFA gaps persist. Practical fixes call for platform engineering to bake defaults, use EPSS scores to weight real exploitability, and pair bug‑bounty case studies with developer training. New risk vector is vibe coding (AI‑generated code at scale) that needs guardrails, human review, and prompt‑sharing to be safe.
AI-written summary · about
chapters (6)
- 0:00Introduction and welcome
- 1:44Secure by default progress
- 13:14Vibe coding and AI risks
- 20:38Modern breach blind spots
- 34:16Security training effectiveness
- 40:322025 AppSec predictions
related talks
47mSecurity is Everybody's Job
37mHow to get developers to want to adopt AppSec
40mState of (Absolute) AppSec
24mSecurity by default
38mPrioritizing Trust While Creating Applications
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
31mTopics of Interest: Scaling AppSec through Education