Shift left the right way to build secure software
summary
Argues that shifting left has failed in practice with concrete stats: 70% of organizations have security debt and 47% of new flaws become tech debt, most in first‑party code. Shows tooling and workflows used to fix that: autofix pull request with GenAI, dependabot and push protection and campaigns to mass‑fix vulnerabilities. Demonstrates prevention tactics—pre‑commit secrets scanning, unit/regression tests—and a Swiss‑cheese multi‑layer model; cites 7,000 AWS credentials per month leaked to public repos.
AI-written summary · about
chapters (10)
- 0:00Introduction to shift left
- 3:22Why current shift left fails
- 9:01Problems with security teams
- 13:15Defining DevSecOps
- 16:49Swiss cheese security approach
- 18:16Securing developer-written code
- 21:53Role of generative AI in security
- 27:09Managing open source dependencies
- 30:03Handling secrets in code
- 33:15Actionable next steps
related talks
37mDon’t Sh*t-Left: How to Actually Shift-Left
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
01h 04mShifting Security Everywhere
22mShifting left, how security fits into the DevOps story
30mThe 3 Ways of DevSecOps – Making Shift Happen
36mHow to build continuous security and embed it in your product
31mPrioritizing Trust while Creating Applications
38mPrioritizing Trust While Creating Applications