Development-centric security in a Global enterprise
summary
IKEA shifts threat modeling into developer workflows, iterating from specialist-led assessments to a developer-driven model that focuses on feature-level diagrams, measures vulnerability trends not raw counts, and mixes automation (SAST/SCA) with context-aware models. A threat library plus an AWS-inspired threat composer generates suggested actors and mitigations so teams scale threat modeling without blank-canvas paralysis. A security champions program trains devs; one measured win is catching and redesigning a zip-code feature to avoid user enumeration.
AI-written summary · about
chapters (8)
- 0:00Security feels like afterthought
- 3:59Balancing security with development
- 10:23Context-aware vs generic flaws
- 15:46Automating threat modeling
- 21:23Simplifying threat composer
- 27:58Security ownership via threat models
- 33:02Threat modeling features not perfection
- 35:32Q&A
related talks
39mValue driven threat modelling - security by design
29mRedefining Threat Modeling: Security team goes on vacation
52mLessons From The Threat Modeling Trenches
11mThreat modeling state of practice in Dutch organizations
35mValue Driven Threat Modeling
22mEmpowering Developers through Threat Modeling Excellence
27mBridging the Dev-Sec divide: Three tips for agile developers
58mThreat Modeling In And For Your Organization