Secure Product Lifecycle (SPLC) as a Service
summary
Adobe builds a centralized automation platform that runs code scans on commit or on a schedule, parses results, injects findings into JIRA, and mails concise summaries so engineering workflows stay unchanged. A two-person security team plus a distributed security champions network scales the Secure Product Lifecycle to thousands of engineers and millions of lines of code. Static analysis is offered as static analysis as a service with phased rollouts and achieves 100% buy-in, reducing overhead and enabling measurable reporting and compliance.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:27Adobe
- 1:16Experience Cloud
- 2:05Technology and People
- 4:41Problem
- 6:37Process
- 7:52Service Lifecycle
- 9:51Security Champions
- 13:16Security Newsletters
- 17:53Marketing Version
- 18:58Recap
- 22:52The World Before Automation
- 23:37Static Analysis as a Service
- 24:35Digital Marketing
- 26:23Automation Platform
- 27:49Automation Workflow
- 30:38Roll Out
- 32:29Summary
related talks
28mSecurity as a Service: Work where You Engineers Live
20mSecure Software Development Lifecycle
51mScaling Product Security with a Product Security Lead Program
34mFrom development to release: Protecting the software supply chain
50mCase Study: 10 Steps to Agile Development without Compromising Enterprise Security
22mBuilding SSDLC in an Enterprise Environment
53mLessons Learned: A Retrospective on Application Security Failures
31mSaaS release engineering: balancing speed, safety & scale