Escaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
summary
Claims concrete results: scanners miss 60% of vulnerabilities undetected and produce ~50% false positives; remediation runs from ~$400–$4,000 historically to tens of thousands in real cases. Practical fixes include LLM-based triage that reduces ~30% of false positives, IDE/CLI/CICD integrations, policy-driven “paved roads” and middleware to standardize fixes, and AI-generated contextual detections for missing logic (session expiry, weak password recovery). Proposed workflow choices: suppress noise for devs, let security own false positives, and prioritize by asset and class of vulnerability.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:24Core security problems today
- 4:15Why scanners miss vulnerabilities
- 9:35AI detecting undetectable flaws
- 13:24False positives plague debate
- 23:03Impossible vulnerability fixing
- 28:06Why shift left fails
- 31:57Dev experience in security
- 39:14Low-hanging security fruits
- 43:56AI reducing false positives
- 52:10Security champions role
- 53:35Dev and security symbiosis
- 57:12Real-world collaboration example
- 1:00:02Q&A
related talks
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
44mApplication Security: Everything we know is wrong
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
39mFrom Auditions to Opening Night: Selecting Security Tools that... (Saurabh Sharma)
30mTopics of Interest: Automatic Vulnerability Remediation: The Trusted and Secure Road ...
47mSecurity is Everybody's Job- 43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
46mRugged Software Engineering