How to Use Your Vulnerabilities to Train Your Developers on Security
summary
Claims that using real vulnerabilities to train developers raises ROI and changes behavior, backed by data from tens of thousands of developers. Demonstrates a hands‑on web sandbox, proxy and test harness, SAST/DAST and HackerOne integration, and an adaptive engine that auto‑assigns lessons. Reports easier fixes for external entities and XSS, harder ones for broken access control and object‑level auth, and frequent incorrect fixes for command/SQL injection. Recommends ongoing monthly training in 20–30 minute chunks and shows the platform working end‑to‑end.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:37Top 2 Vulnerabilities
- 3:37Do programmers in certain programming languages make fewer vulnerabilities
- 4:37Top vulnerabilities that developers fix incorrectly
- 5:31How to create a successful secure coding training plan
- 13:44How to use vulnerabilities to train your developers
- 14:29What are adaptive training plans
- 15:25Demo
related talks
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
37mHow to get developers to want to adopt AppSec
30mAppSec in a DevOps World
44mApplication Security: Everything we know is wrong
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
51mShifting Knowledge Left: Keeping up with Modern Application Security
27mHow Security, Development & Testing can work together to stop ...
57mThe Developer's Field Guide to Software Security