Six Years in Review: Transforming Company Culture to Embrace Risk
summary
A six-year program transforms company culture so engineers own risk instead of security chasing them, shifting to a democratized vulnerability management model with four core pillars (owner accountability, self‑service due‑date extensions, transparent prioritization, visible metrics) and added pillars for buy‑in, awareness, ownership and noise reduction. Built artifacts include dashboards that track SLA closures, a Juro integration so ownership autopopulates via Juro integration at Segment, a Slack digest, 42 documents and roadshows across 32 business units. Outcomes: faster P1/P2 remediation, Log4j and later zero‑day response visible on day one.
AI-written summary · about
chapters (13)
- 0:00Introduction and context
- 1:44What is DVM
- 3:24Six-year journey review
- 5:12Four pillars of DVM
- 8:40Securing leadership buy-in
- 13:06Engaging engineering teams
- 17:26Building program awareness
- 20:44Solving ownership challenges
- 24:34Managing program noise
- 30:17Measuring program success
- 32:39Building a culture of trust
- 36:15Future and conclusion
- 37:22Q&A session
related talks
57mThe building blocks of a culture of security
52mLeveraging Psychological Needs For Building A Security Culture Amongst Developers
24mConcrete Steps to Create a Security Culture
24mBeing secure by design: Engineer-led security
37mSecurity Through Transparency: Scaling Your Customer Trust Program
26mBuilding Secure Cultures
44mExceeding Expectations, Inspiring Quality
22mA Dual Approach to Accountability Engineering