Proactive Security, less buzzword, more action
summary
Argues for shifting effort from adversarial exercises to measurable proactive controls, claiming organizations lack orchestration for patching and showing that two-thirds of workers feel time-poor and only 1% of workweek for training exists. Recommends holding security teams accountable with operational metrics like NPS for security and agreement-based dashboards rather than shame-driven red/yellow/green lists. Shows that context — why a bug persists, whether it’s an architectural change or a quick band‑aid — decides priority, not scanner counts.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:23Finding the good in people
- 2:37Larger foe
- 3:25Failure
- 4:37Validation
- 5:17Being technically correct
- 7:25Being right or wrong
- 8:16Technical controls only
- 10:05Cognitive dissonance
- 13:10People not technology
- 16:09Empathy
- 21:59Critical bugs
- 23:24The audit
- 25:00Larger scale changes
- 28:09The underlying cause
- 29:34The argument
- 31:56Accountability
- 35:26Sisyphus
- 38:23Outro
related talks
25mWhat Does it Mean to Build a Proactive Security...
51mThinking Differently About Security
57mMaking Security Priority Zero
01h 04mShifting Security Everywhere
42mImperfect Security: Doing Less to Achieve Better Security
03mAn infinite set of security tools
38mKeynote: Dumping Traditional Security Teams
49mPragmatic Approaches To Building Secure Software