How to build continuous security and embed it in your product
summary
Argues security must run at development speed: one company deploys every two minutes so monthly pen tests fail, and JavaScript codebases cost ~$100,000 more in bug bounties than Go in an example. Recommends embedding checks into pipelines, using agents for runtime context so only actionable CVEs get fixed, and combining shift left with shield right detection. Chooses cloud tooling deliberately (migrating to Google Workspace stopped many phishing attacks) and mentions lace work as a vendor example.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:23Why security feels scary
- 3:50Security myths and collaboration
- 5:37Continuous security at speed
- 7:00Embedding security in tools
- 8:25Reducing risks with tech choices
- 10:55Developers as security core
- 11:18DevSecOps and shift left
- 13:02Threat modeling early
- 16:37Cloud security and runtime
- 21:59Why detection matters
- 24:04Actionable vulnerability context
- 26:12Security training for devs
- 28:39Measuring security improvements
- 30:47Key learnings
- 32:12Data-driven security decisions
- 33:17Security in enterprise and startups
- 35:04Recommended reading
related talks
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
46mRugged Software Engineering
52mContinuous Security
57mBuilding a Modern Security Engineering Organization
01h 04mShifting Security Everywhere
07mInterview
29mSecuring Your Web Application Pipeline From Intruders
40mMaking Security an integrated part of the SW Dev Lifecycle