Security vs Dev Experience Threat … or Opportunity
summary
Argues that friction comes from tooling not people and shows a working open source CLI that runs live scans against container images, Terraform, GCP, Kubernetes and EC2 using the same policy expressed as MQL/GraphQL queries so checks map to plan, state and runtime. Demonstrates scans, query-to-assertion conversion and metadata-backed rules, cites a 30‑day exploit window and ~250‑day median fix time, and claims the approach reduces thousands of noisy tickets.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:49Security as bottleneck
- 4:56Modern security challenges
- 8:12Security vs engineering
- 9:57Live demo: security policy automation
- 13:49Unified policies across layers
- 17:22Open-source security code
- 20:33Collaborative security future
related talks
23mTurbocharge your development with agile security
37mPlatform and Security Engineering
39mSecurity in a DevOps World
24mWhy security fails, and how we can solve for it
28mDevSecOps - Security from Scratch
33mSecurity scans for terraform templates
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security