When Application Security “The Wrong Way” Is the Right Thing for Your Organization
summary
Target describes a concrete product security stack: a transparent Product Intelligence score (300–850) that weights findings 45%, security services 35%, culture 10% and incidents 10%, shows rank and actions, and pulls data via APIs into Superset and GitHub/Jira. An exclusive Security Ninjas program limits membership to ~5% (about 170 now), requires 20% time, onboarding plus hands‑on training, and creates an internal hiring pipeline. Spotlight SAST starts broad, then consolidates alerts, adds customizable notifications and backlog integrations to stop spamming teams.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:38Target
- 1:38IT Transformation
- 2:35No Single Metric to Measure Application Security
- 3:46Product Intelligence
- 8:49Transparency
- 10:43Accountability
- 11:39Product Intelligence System
- 13:16Security Guild
- 14:48Target Security Ninja Program
- 16:24What does it mean to be a Security Ninja
- 18:58Knowledge Development
- 19:50Information Sharing
- 20:34Handson Events
- 20:53Engagement
- 21:18Survey Results
- 23:25Testing All The Things
- 24:29Our Goal
- 25:23spotlightsast
- 27:44Product Security Journey
- 27:57Lessons Learned
- 29:36Conclusion
related talks
26mHow to Build an Application Security Program
43mDeveloper Driven Security In High-Growth Environments
57mKeynote: Maturing Your Application Security Program
50mThe Application Security State of the Union
24mConcrete Steps to Create a Security Culture
21mSecuring a Security Company
41mAim-Ready-Fire
01h 00mImproving the Chances of Success in Secure Software Development