The AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
summary
Claims that current practices release 2 million exploitable bugs/year and that enterprise ratios are roughly 1 AppSec per 200 developers drive a practical critique: SAST/DAST/IAST/RASP are slow, noisy and language-limited, pen tests find but don't fix, and centralized AppSec becomes a bottleneck. Secure Code Warrior reports >1M microlearning plays across 400 orgs with spot rates (SQLi ~60% correct, IDOR ~20% correct), and DBS moves from ~40 to 1,500 trained developers by embedding embedded IDE microlearning and ticket-level secure coding guidance.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:52We've used duct tape for too long.
- 5:28Building code is like building a house.
- 17:19We will never have enough AppSec specialists to deal with the amount of code being produced.
- 23:33The right type of training
- 25:00Weaknesses vs Cont
- 26:50Culture of Security Awareness
related talks
38mAppSec is Dead Long Live DevSecOps!
31mTopics of Interest: Scaling AppSec through Education
30mAppSec in a DevOps World
53mFlipping the Script on Application Security
26mHow to Build an Application Security Program
47mSecurity is Everybody's Job
42mAppSec is dead. Long live DevSecOps!
17mWhy you fail at Application Security - and how to fix it