Developers Struggle with Application Security (and How to Make ...)
summary
Claim: developers struggle because tooling, process, and trust are misaligned and security teams create bottlenecks. Recommended fixes are concrete: treat security like unit tests, surface failures in CI/CD, teach with real repo findings, and prefer immediate feedback over ticket spam. Specific tools and approaches: SCA and DAST for actionable results, shift-left checks that fail fast in CI/CD, use developer-native feedback (CLI/PR bots) and replace production-only pen tests with reproducible dev-time tests.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:04Application Security Problem Overview
- 3:49Problem 1 Benevolent Security Team
- 6:04Problem 2 Silos
- 9:32The GL
- 10:11Chase to Perfection
- 11:12Prioritize
- 12:20Security team
- 13:19Security tools
- 14:32Security terminology
- 15:54Appstack tools
- 16:20Production bias
- 18:27Not awesome
- 20:01Bugs in production
- 21:53Getting started
- 22:04Security tests
- 23:14Mobius
- 24:23Engineers
related talks
28mWhy Developers Struggle with AppSec
46mAre Developers the New Front Line of Security?
40mDevelopers Dislike Security: Ten Frustrations and Resolutions
45mBringing Security Testing To Development: How To Enable Developers To Act As Security Experts
33mWhy Developers Struggle with API Security
47mSecurity is Everybody's Job
17mWhy you fail at Application Security - and how to fix it
26mBeyond Testing: Application Security in the Age of DevOps