Threat Modeling Developer Behaviour: The Psychology of Bad Code
summary
Argues that many AppSec failures are predictable cognitive patterns (present bias, automation bias, bystander effect) and catalogs ten developer anti-patterns (copy‑paste Stack Overflow, vibe‑coding with AI, skipping tests/docs). Recommends concrete fixes: secure defaults, CI gates that require passing tests, IDE/pre‑commit scans, dashboards for security debt, and using a RAG server plus enforced review checklists for AI outputs. Cites an industry study showing ~96% of code reviews take under one second to illustrate the fake‑review problem.
AI-written summary · about
chapters (20)
- 0:00Threat modeling dev behavior
- 2:15Why devs fail in security
- 7:11Behavioral economics for secure coding
- 12:47Why insecure behavior matters
- 13:09Three behavioral interventions
- 18:07Secure defaults in dev
- 20:15Security in SDLC
- 24:51Rethinking security training
- 30:06Ten insecure dev behaviors
- 31:28Vibe coding and AI risks
- 35:22Deadlines and insecure shortcuts
- 36:48Forum code without context
- 38:55Shiny tech obsession
- 39:59Avoiding documentation
- 42:28Skipping testing
- 44:14Committing untested code
- 46:20Overengineering and status
- 48:01Ignoring compiler warnings
- 51:08Fake reviews and moral licensing
- 53:15Conclusion
related talks
53mOptimistic Security
01h 02mSo long secure coding... Hello secure development!
52mHow to Transform Developers into Security People
27mDevelopers Struggle with Application Security (and How to Make ...)
52mLessons From The Threat Modeling Trenches
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
50mThreat Modeling With Architectural Risk Patterns
26mSmarter Code, Sneakier Risks: Supply Chain Security in the Age of AI