Keynote: Maturing Your Application Security Program
summary
After consulting with almost 400 teams and finding industry maturity scores averaging 1.1/3 on SAM, the talk lays out three concrete AppSec program states and exact next steps: a zero‑budget path using free tools (ZAP, Burp, secret scanners), repo consolidation, weekly continuous scanning, simple threat model four-question frame, and ModSecurity WAF as a temporary shield; an intermediate path adding a full‑time AppSec hire and good SAST; and an enterprise path that adds champions, RASP, incident playbooks and measurable goals.
AI-written summary · about
chapters (10)
- 0:00AppSec program introduction
- 3:46Security models and flaws
- 7:01Pentesting the important stuff
- 9:52No-budget security maturity
- 18:04Model two: Tools tools and even more tools
- 25:29Better tools and processes
- 33:31Strangling giant spend model
- 37:03Scalable security programs
- 49:59Conclusion and takeaways
- 52:47Q&A: Hiring AppSec and WAF vs RASP
related talks
36m5 Steps to Drive Enterprise Software Security
26mHow to Build an Application Security Program
33mJumpstarting Your Appsec Program
46mJuggling the Elephants: Making AppSec a Continuous Program
49mAppSec, Ready, Set, Go!
31mTopics of Interest: Scaling AppSec through Education
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
57mWhat’s in an AppSec program?