How to 10X Your Company’s Security (Without a Series D)
summary
Summarizes a practical playbook pulled from 50+ talks and dozens of tools and shows concrete wins: continuous PR scanning with fast AST checks using sgrep AST matching to cut noise, an asset graph for rapid impact queries using cartography asset graph that turns days of incident triage into minutes, and automated least-privilege via RepoKit-style permission pruning plus policy-as-code invariants and runbook automation. Gives examples where React migration eliminated XSS and a secure XML wrapper stopped ongoing XXE fixes, reducing recurring ops work.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:44fit into their existing tools and workflow
- 7:05starting a security program
- 9:42track vulnerabilities ideally in the same system such as jira
- 12:37scan new code with static in dynamic analysis tools
- 16:01parse it into an abstract syntax
- 25:16integrate security at the right points
- 30:47aggregate your vulnerabilities over the past couple of quarters
- 34:39use your vulnerability history
- 37:44step one is assess
- 38:35take on one bite-sized project
- 39:19start scaling
related talks
45mHow Leading Companies Are Scaling Their Security
57mBuilding a Modern Security Engineering Organization
21mSecuring a Security Company
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
01h 04mShifting Security Everywhere
25mSecurity First
30mDevSecOps State of the Union
46mApplication security from start to finish