Data-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
summary
A structured nine‑month survey of 26 AppSec champions programs claims concrete benchmarks: mature programs show a 1:50 ratio of AppSec staff to developers, deploy multiple scanners (SAST DAST SCA), and typically take about one year build time to reach broad impact. Most programs grow organically without formal mandates, recruitment is largely volunteered, communication mixes Slack with formal newsletters, ROI is mostly anecdotal (about 42% report success), and program resets are common.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:14My Background
- 2:28Presentation Overview
- 3:17Survey Overview
- 6:41Candidates for Survey
- 8:38Survey Questions
- 10:52Organizational Background
- 15:27Time Investment
- 19:33Program Attributes Do you have defined roles and standardis?
- 22:59Return on Investment
- 26:16Relevance for AppSec Leaders
related talks
26mTopics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi...
34mDecrease Your Stress and Increase Your Reach with Appsec Champions
01h 00mImproving the Chances of Success in Secure Software Development
48mGrowing A Security Champion Program Into A Security Powerhouse
57mWhat’s in an AppSec program?
57mKeynote: Maturing Your Application Security Program
01h 01mSecurity Champion Worst Practices
26mHow to Build an Application Security Program