Reducing Toil in Your AppSec Program
summary
Claims that reducing repetitive AppSec work saves money and morale and gives measurable security gains, then shows how. Uses documentation, developer training, IDE plugins, ticketing integration and a central scoring system called Product Intelligence. Startup example cuts 312 annual hours (~$24k) by training, IDE SAST plugin and ticket sync; Target auto-onboards GitHub repos (100-hour build, saves ~8,000 hours ≈ $600k/year), migrates spreadsheets (saves ~$38k) and blocks secrets/Log4j (800 hours investment, ~ $700k saved). 33% SRE toil goal cited.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:29Defining toil
- 3:17Six characteristics of toil
- 6:04Why toil matters
- 10:40Four-step process
- 13:09Identifying toil
- 17:27Discarding unnecessary toil
- 19:55Measuring toil reduction
- 21:23Startup toil reduction
- 25:57Target’s de-toil journey
- 33:13Actionable steps
- 35:23Q&A
related talks
30mAppSec in a DevOps World
47mSecurity is Everybody's Job
26mHow to Build an Application Security Program
36mImproving Security while Reducing Toil with DevSecOps
29mAppSec on a budget
29mDoing More with Less: DevSecOps on a limited budget
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
01h 04mShifting Security Everywhere