I don’t always do AppSec testing, but when I do, it’s in production
summary
Argues production AppSec is cheaper, faster and more accurate than pre-prod by running low‑overhead agents that modify Java classes at runtime to insert trust boundaries around dangerous calls, do dynamic sampling and consume a fraction of 1% resource overhead. Claims live agents detect both known CVEs and unknown flaws (reports finding Log4Shell early and a CVSS 9.9 issue in Netflix Genie), provide flow‑map observability, block SQL injection at execution time, and replace SAST/DAST/SCA plus parts of the WAF; product is shipping for Java.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:09Why test in production
- 3:37Load testing evolution
- 7:27Security testing lagging behind
- 8:57New AppSec testing approach
- 10:20How the solution works
- 14:23Closing and benefits
related talks
52mApplication Security at DevOps Speed and portfolio scale
28mApplication Security: Inside Out
59mWhy Your AppSec Experts Are Killing You
52mAppSec at DevOps Speed and Portfolio Scale
40mState of (Absolute) AppSec
44mApplication Security: Everything we know is wrong
19mApplication Security at High Velocity
45mAutomated Security Testing in a DevOps world