Normalizing AppSec Issues for Contextual Risk-Based Prioritization at Enterprise Scale
summary
Claim: normalizing diverse AppSec findings into a contextual, change-oriented model lets teams prioritize real risk at enterprise scale. Implementation details include parsing git history and PR metadata, automated anomaly detection over commit behavior, and a normalization layer that produces coherent scores across scanners. A real case flags found single malicious commit in PHP core by scoring behavioral anomalies. Scale targets tens of thousands of repos and continuous CI events, and the system routes fixes based on material-change impact rather than raw vuln counts.
AI-written summary · about
chapters (4)
related talks
27mFlipping the Criticality Funnel, A Practical Path to Real Prioritization
57mUsing developer-centric data to predict, prioritize, and improve App Security Outcomes
39mOrganizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization
38mPrioritizing Trust While Creating Applications
54mUsing developer-centric data to improve Application Security Outcomes
27mGet Your Security Priorities Straight! How to Identify Workloads Und...
31mPrioritizing Trust while Creating Applications
43mChanging from Probability to Prioritization Method in Risk Measurement