DevSecOps is Dead, Long Live DevSecOps
summary
Claim: DevSecOps is failing because teams pile overlapping tools into developer workflows, producing duplicated alerts across Snyk, Lacework, Detectify, SonarQube and swelling backlogs (example: hundreds or “900” new findings) that no one can triage. Built a secure developer experience (SDX) with paved paths and a 30-minute threat modeling course that engineers accept when rolled out by product architects. Recommends diverse security staffing (program managers, tech writers), pragmatic SLA tradeoffs, and fixing UX and accountability instead of more blocking tooling.
AI-written summary · about
chapters (13)
- 0:00Introduction and spoiler
- 1:05DevSecOps is broken
- 3:15Unhealthy DevSecOps programs
- 8:18Fixing DevSecOps together
- 13:20Security Champions and compliance
- 15:26Redefining security programs
- 18:35Security is just QA
- 20:19Secure developer experience
- 23:04Know your customers
- 26:15Security trade-offs and reality
- 29:24Building trust and letting go
- 30:28Security teams and business language
- 31:50Call to action
related talks
23mDevSecOps - By Any Other Name
06mDevSecOps is a Misnomer
30mDevSecOps: More Than Just Pipelines
42mAppSec is dead. Long live DevSecOps!
31mDevSecOps, or How to Integrate Security into DevOps Practices
45mDevSecOps Worst Practices
34mDevSecOps: How to Use DevOps to Make You More Secure
13mUnderstanding DevSecOps: Risk defense across your SDLC