Leveraging Psychological Needs For Building A Security Culture Amongst Developers
summary
Argues that shifting developer behavior by satisfying autonomy, competence, relatedness reduces human risk, not buying more tools. Integrates scanning (SAST/SCA/container scans, triggered on Jenkins), hands‑on remediation sessions, threat‑modeling pilots, a newsletter and Confluence KB, and a Security Champions Network run by a two‑person core team. Runs 20 recurring onboarding meetings weekly for 40 teams initially, measures success by annual survey (NPS 47, ~62% apply learning, two‑thirds share knowledge), and reports durable relationships and sustained uptake over five‑plus years.
AI-written summary · about
chapters (11)
- 0:00Building security culture
- 3:13Security challenges and gaps
- 6:28Good security culture
- 13:40Core values for security
- 18:43Psychological needs in motivation
- 25:10Breaking team barriers
- 26:34Guidance and relationships
- 33:01Peer learning and community
- 37:37Working without support
- 40:10Measuring security impact
- 43:43Q&A
related talks
53mThe Psychology of DevSecOps
24mConcrete Steps to Create a Security Culture
01h 04mShifting Security Everywhere
52mHow to Transform Developers into Security People
43mSecurity Kaizen for developers
25mWhat Does it Mean to Build a Proactive Security...
20mBuilding security culture on infrastructure teams
48mHow to build a security mindset