Improving the Chances of Success in Secure Software Development
summary
Research of more than 300 teams and a live program across ~700 teams constructs concrete enablers: a security index that scores apps into bronze/silver/gold/platinum, standardized tools (SCA, static analysis) plus annual or event-driven threat modeling, and ~500 embedded security engineers inside teams. Results: teams with strong practices show higher engagement and about 3% more ARR; median fixes range from hours to months depending on leadership. The Visma Security Program and its visibility, autonomy, budgeting and role assignments mostly work but produce ups and downs.
AI-written summary · about
chapters (9)
- 0:00Secure software development intro
- 4:15Why security feels overwhelming
- 12:43Security prioritization influences
- 25:47Making security actionable
- 33:28Adapting security processes
- 39:27Allocating time and budget
- 42:33Measuring security performance
- 47:47Lessons learned and research
- 49:34Q&A: Reluctant engineers
related talks
21mWhy Unleashing Your Software Security Potential is Necessary & How to Achieve It
36m5 Steps to Drive Enterprise Software Security
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
44mA Warrior's Journey Building a Global AppSec Program
26mTopics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi...
26mHow to Build an Application Security Program
38mChampioning Security for your Agile Development
47mSecurity is Everybody's Job