Using developer-centric data to predict, prioritize, and improve App Security Outcomes
summary
Uses developer tool metadata (GitHub APIs, build and PR logs) to profile projects by build frequency, PR size and reviewer diversity, lines of code, tech diversity and contribution cadence, then flags key person risk and dormant repos. Prototype code (co‑pilot assisted) queries APIs, builds heat maps and delta metrics, and surfaces surprises like massive first‑pass findings (example: 67,000 issues). Outcome: predict and prioritize fragile systems, wake or retire stale projects, and focus tooling where it actually runs.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:04Developer-centric data matters
- 11:23Bias in security tooling
- 20:07Predicting appsec issues
- 34:21People data for security risks
- 40:41Conway’s Law and code
- 45:40Business drivers impact
- 49:55Prioritizing security activities
- 55:35Summary
related talks
54mUsing developer-centric data to improve Application Security Outcomes
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
19mFlipping the script on application security
43mDeveloper Driven Security In High-Growth Environments
17mGamify security best practices to scalably improve engineering culture
50mA data driven approach to application security
28mWhy Developers Struggle with AppSec
18mNormalizing AppSec Issues for Contextual Risk-Based Prioritization at Enterprise Scale