A Walkthrough: AppSec Tool Selection, Procurement, and Implementation
summary
Five concrete steps guide selection: understand need and landscape, vendor evaluation, procurement, implementation and operationalization, with a vendor evaluation document that includes an executive summary, comparison matrix, cost estimate and licensing. Proofs of concept run about two weeks to a month, often behind an MNDA; expect contract negotiation, discounting and legal/privacy reviews. Implementation requires RACI assignment, runbooks, pilot groups (start with developer-experience teams), dark-launching, and tracking metrics like time-to-notify, fix rate and scanner coverage.
AI-written summary · about
chapters (11)
- 0:00AppSec tooling selection
- 1:27Understanding needs and tech
- 5:25Vendor discovery and evaluation
- 9:21Vendor demos and criteria
- 15:05Proof of concept bake-offs
- 17:19Procurement and business case
- 20:30Securing leadership buy-in
- 24:49Developer awareness and integration
- 27:22Implementation strategies
- 31:40Operationalization and metrics
- 37:43Q&A
related talks
39mFrom Auditions to Opening Night: Selecting Security Tools that... (Saurabh Sharma)
36m5 Steps to Drive Enterprise Software Security
41mAim-Ready-Fire
41mSecurity Touchpoints When Acquiring Soft...
36mOvercoming Obstacles in Operationalizing Security
26mHow to Build an Application Security Program
49mAppSec, Ready, Set, Go!
57mThe Developer's Field Guide to Software Security