Keynote: 25 Years in AppSec: Looking Back, Looking Forward
summary
Claims 25 years of firsthand AppSec practice including released internal security guidelines (1996) and later work on Microsoft SDL and ship delays show concrete changes: no tooling then, now static analysis, fuzzers, bug bounties and runtime orchestration exist; Amazon uses TLA+ for proving cloud properties; ransomware evolves into professional businesses and attackers change CNC tolerances and PCI scopes; AI helps code review (GPT‑3 examples) and also automates bug hunting; policy pushes 72‑hour incident reporting / 24 hours if ransom.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:30Dr My start in firewall code review
- 2:52Rough architecture
- 5:25The guidelines: perspective on 199
- 6:22Perspective from 1996
- 8:1725 Years Go By Fast: AppSec
- 12:10Technical progress - security
- 14:29Government progress
- 15:56Insecure Design makes the Top 10
- 20:14The more things change...
- 23:43Appsec will change in many ways
- 25:16Al as problem solver (2)
- 27:02Al as problem area
- 29:42Al as problem creator
- 33:06Khashoggi as abuse victim
- 34:22What problem are we solving?
- 35:31Demonstrating Trustworthiness
- 36:38Composition
- 37:51Learning systems
- 38:37Dr Notification & Learning
- 43:20Going forward
related talks
56mKeynote: AppSec: From Outsiders to Allies
39mKeynote - The Abridged History of Application Security
01h 05mKeynote: 50 Shades of AppSec
40mClosing Keynote: New Era of Software with modern Application Security
01h 20mKeynote: BSIMM: A Decade of Software Security
57mKeynote: Maturing Your Application Security Program
49mKeynote: CISO Perspectives
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026