Application Security at High Velocity
summary
Claim: embed security scans into feature-branch CI so developers find and fix issues before merge. Implementation uses GitLab CI to run SAST/DAST, dependency, container, secret and license scans and optionally IAST/fuzzing in review apps. Result: fewer late-stage blockers, portfolio dashboards for execs, and customers report builds dropping from 40–60 minutes to 6 minutes; mature teams are 3x more likely to detect vulnerabilities before merge. Contrasts with legacy scanners like Synopsys, WhiteHat, Micro Focus causing release bottlenecks.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:27Velocity
- 1:19Security
- 2:02DevOps
- 4:144 tiers of threats
- 7:22"Traditional" application security
- 11:52Types of application security
- 13:39Continuous application security
- 15:05Vulnerability information at developer's fingertips
- 16:52DevSecOps
related talks
52mApplication Security at DevOps Speed and portfolio scale
42mContinuous Security: Integrate security tools into your DevOps Pipeline
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
43mApplication Security is a Community Effort
40mDevSecOps Guide to Bulletproof Your Development Workflow
46mSecurity DevOps - Staying Secure In Agile Projects
07mInterview
14mHow Security as Code Transforms Platform Engineering at Scale