Why Developers Struggle with AppSec
summary
The talk claims developers struggle because security decisions happen without context, appsec tools are built for security teams not engineers, and scans are biased toward production; it names StackHawk, Snyk, FOSSA, npm audit, GitHub package inspection and Dependabot as examples. The fix is concrete: run checks in local dev and CI/CD, use developer‑native SCA and DAST that reproduce findings and surface business context, let teams self‑serve and iterate on one app or service.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:44AppSec Problem Overview
- 2:06Trust Issues
- 8:45If You Don't Have a Security Team
- 10:16Security Websters CSRF: Cross Site Request Forgery
- 11:18There are Good AppSec Dev Tools Out There Developer native tools (in context, how they work)
- 12:18Examining the Production-Bias: People
- 14:48Examining the Production-Bias: Timing
- 18:12Examining the Production-Bias: Context
- 22:14Right Time: Pre-Production
related talks
33mWhy Developers Struggle with API Security
27mDevelopers Struggle with Application Security (and How to Make ...)
37mHow to get developers to want to adopt AppSec
38mDevSecOps Panel "AppSec Would Never Catch Me"
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
30mAppSec in a DevOps World
17mWhy you fail at Application Security - and how to fix it
42mAppSec is dead. Long live DevSecOps!