AppSec tooling & culture tips from AWS & Toyota Motor North America
summary
AWS scales AppSec by training 2,000 Guardians — builders who run threat models, create tickets and mitigations, and speed reviews — while Toyota embeds a three‑pillar SEE team (security brokerage, engineering, education) that hacks an app to teach teams and turns repeated findings into guardrails. Both enforce technical controls (AWS Organizations SCPs, Config + Lambda to remove open port 22 or block public S3, KMS/CMK guidance, WAF, Cloud posture tooling) and track metrics like mean time to resolution to measure success.
AI-written summary · about
chapters (10)
- 0:00Introduction and objective
- 2:47Bridging culture and tooling
- 5:56AWS Guardians program
- 11:35Builder security experience
- 13:31Toyota security approach
- 16:48The C team implementation
- 23:13Preventative maintenance
- 29:34Lessons learned at Toyota
- 32:39Strategic takeaways
- 42:07Conclusion
