From Auditions to Opening Night: Selecting Security Tools that... (Saurabh Sharma)
summary
Shows a repeatable selection process: baseline finds ~6,000 vulnerabilities with 13 critical fixes a year and a 325‑day mean time to remediate; pick vendor features that map to outcomes, run an opt‑in 30–60 day pilot, measure false positives, detection latency and adoption, and demand one team that “can’t live without it.” Two pilots deliver real wins: runtime alerts go from zero to actionable detection in one day, supply‑chain finds malicious packages with remediation within a week. Pitfalls: aggressive policies, underestimated integration effort, no clear owner, and testing only in staging.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 3:29Identifying security tool problems
- 7:19Pitching tools with data and storytelling
- 10:35Runtime security tool case study
- 13:26Supply chain security tool case study
- 15:15Handling tough crowd questions
- 17:02Pilot design and execution
- 24:29Measuring pilot success
- 29:45Go or no-go decision making
- 30:26Integration bloopers and lessons
- 32:11Sustaining performance post-pilot
- 35:02Key takeaways and wrap-up
related talks
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
33mBattle Tested Application Security
41mAim-Ready-Fire
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
44mApplication Security: Everything we know is wrong
44mA Walkthrough: AppSec Tool Selection, Procurement, and Implementation
45mApplication security loves Agile
37mPlatform and Security Engineering