Tanya Janca
where else to find them
what they talk about
all 9 in the filters
where they keep going back
- BSidesSF3 editions2020–2026
- NDC Security2 editions2024–2025
- RSA Conference2 editions2023–2024
all 14 in the filters
on a stage with
- Dwayne Budzakonce
- Erez Yalononce
- Harvinder Dhamionce
all 7 in the filters
who talks about the same things
- Laura Bell13 talks
- Siren Hofvander5 talks
- Matt Tesauro19 talks
- Chris Romeo7 talks
- Peter Chestna5 talks
- Michael Kaufmann5 talks
| title | conference | date |
|---|---|---|
| Threat Modeling Developer Behaviour: The Psychology of Bad Code | NDC Toronto 2026 | 2026-05-05 |
Argues that many AppSec failures are predictable cognitive patterns (present bias, automation bias, bystander effect) and catalogs ten developer anti-patterns… | ||
| The AppSec Poverty Line: Minimal Viable Security (Tanya Janca) | BSidesSF 2026 | 2026-03-21 |
Defines an “AppSec Poverty Line” as the smallest set of controls under‑resourced teams must implement: input validation, parameterized queries, output… | ||
| 30 Tips for Secure JavaScript | XtremeJS 2025 | 2025-12-02 |
Thirty concrete JavaScript practices and a few extras, with exact do/avoid rules: use encodeURIComponent/decodeURIComponent for URL parts, prefer… | ||
| Security Champion Worst Practices | The Diana Initiative 2025 | 2025-08-04 |
Claims that over half fail and that clear goals, measurables and sustainable pace fix most problems. Evidence comes from surveys of a few thousand people… | ||
| 30 Tips for Secure JavaScript | NDC Oslo 2025 | 2025-05-19 |
Thirty concrete JavaScript rules: use a framework that outputs safe markup, avoid inline scripts and dangerous APIs like eval, innerHTML, document.write and… | ||
| Keynote: Maturing Your Application Security Program | NDC Security 2025 | 2025-01-20 |
After consulting with almost 400 teams and finding industry maturity scores averaging 1.1/3 on SAM, the talk lays out three concrete AppSec program states and… | ||
| Security Champion Worst Practices | NDC Security 2025 | 2025-01-20 |
Security champion programs sound promising but over half of programs fail because goals, support and scope are vague. Practical fixes: set one or two concrete… | ||
| Securing the Digital Supply Chain: What we should do for Supply Chain Security in DevSecOps? | BSides Edmonton 2024 | 2024-09-23 |
Panel lists concrete attack examples (polyfill typosquatting, Log4j, CrowdStrike outage) and practical fixes: use SCA that reports reachable vulnerabilities… | ||
| Who Hurt You? Earning the trust of developers | OWASP Global AppSec San Francisco 2024 | 2024-09-23 |
Argues that developer buy‑in is the linchpin: trust shortage creates attrition, slows innovation, and blocks fixes; specific fixes include secret scanning and… | ||
| Seatbelts for Web App (Security Headers) | RSA Conference 2024 | 2024-05-06 |
Claims that a few browser headers can stop many attacks, with demos and real-world scans (Report URI shows low adoption). Concrete fixes: HSTS with preload to… | ||
| Purple is the New Black: Modern Approaches to Application Security | NDC Security 2024 | 2024-01-09 |
Practical checklist for modern app security: adopt zero trust and assume breach design, log everything and feed serverless and workflow logs into a SIEM, front… | ||
| DevSecOps: More Than Just Pipelines | Conf42 DevSecOps 2023 | 2023-11-30 |
Argument: DevSecOps requires more than dumping scanners into CI/CD; it treats the three DevOps ways — flow, fast accurate feedback, continuous learning — as… | ||
| Catching up with | RSA Conference 2023 | 2023-04-24 |
Claims that interns find secrets in an hour, and demonstrates free tools and a public case where exposed credentials were found in late 2021. Describes API… | ||
| DevSecOps Worst Practices | RSA Conference 2023 | 2023-04-24 |
Claims 15 recurring DevSecOps failures uncovered from work with over 300 large enterprises: vendors promise zero false positives yet scans take hours and break… | ||
| Secret Hunting | BSidesSF 2023 | 2023-04-22 |
Secrets are easy to find with free scanners like truffle hog and Chekov using regex and entropy checks, and juniors or interns routinely unearth multiple live… | ||
| Shifting Security Everywhere | Global AppSec Dublin 2023 | 2023-02-15 |
Argues that shifting left alone fails and shows concrete alternatives: create short one-hour threat models, add lightweight secure design checks to project… | ||
| Adding DAST to CI/CD, Without Any Losing Friends | Conf42 DevSecOps 2022 | 2022-12-01 |
Adding a dynamic application security scanner straight into CI/CD without tuning inflates builds (one minute ballooning to nine minutes — a 900% slowdown)… | ||
| Transforming Security Champions | RSAC 2022 | 2022-06-06 |
Presenter: Tanya Janca, CEO and Founder, We Hack Purple, Director of DevRel and Community, Bright
With security teams being vastly outnumbered, many… | ||
| Building Security Champions | Global AppSec US 2021 Virtual | 2021-11-08 |
Scaling security by building a champions program instead of hiring dozens requires a concrete recipe: recruit engage teach recognize reward with manager buy… | ||
| Building Security Champions | BSides Vancouver 2021 | 2021-06-07 |
There are 3.5 million unfilled cyber jobs, so the claim is that a security champions program scales security capacity with big ROI by teaching and delegating… | ||
| Colorful AppSec - Red, Blue, or Purple? | RSAC 2021 | 2021-05-17 |
Red teams run realistic attack exercises that go beyond bug bounties to probe APIs, mobile apps, infrastructure and business logic, uncovering risks that lack… | ||
| Purple is the New Black: Modern Approaches to Application Security | BSidesSF 2020 | 2020-02-23 |
Combines defence, offence, automation, empathy and continuous learning into a practical app-sec playbook: adopt zero trust and assume breach mindsets; secure… | ||
| Security Learns to Sprint: DevSecOps | BSidesSF 2020 | 2020-02-23 |
Argues that security stops being the bottleneck by matching DevOps cadence: break security work into sprints, make critical security bugs break the build, and… | ||
| nothing matches | ||