Why Security Initiatives Are Doomed to Fail & What You Can Do About It
summary
Enterprises buy a CSPM that costs about $1M a year and just spits out more alerts while posture erodes; throughput improves by shaping work around the real constraint (usually a product team outside security) not by hiring or buying tools. Using value streams and Theory of Constraints plus Tameflow methods, a reshaped backlog doubles delivered items (3 → 7 over 12 weeks) and cuts lead time 4w → 1.7w. Protect capacity with 20% risk 20% debt, push fixes into platforms or reassign empowerment (Google monorepo/log4j style) to elevate the constraint.
AI-written summary · about
chapters (9)
- 0:00Intro
- 5:38How work flows
- 7:58Becoming constraint-aware
- 16:12Security in an agile world
- 20:48Chasing predictability
- 23:37Protecting capacity for security
- 28:48Where are we now?
- 33:29Wrap-up
- 35:22Outro
related talks
01h 04mShifting Security Everywhere
53mLessons Learned: A Retrospective on Application Security Failures
51mCloudSec Hero to Zero: Self-Obsolescing Through Prolific Efficiency
43mSoftware Engineering Management at Scale with the Theory of Constraints
25mMaintaining Agility and Security without Impacting Developer Experience
36mOvercoming Obstacles in Operationalizing Security
45mReducing Toil in Your AppSec Program
54mControlled Chaos: The Inevitable Marriage of DevOps & Security