Security Gate: Building a Homegrown SAST Orchestration Platform

on YouTube ↗47m

" summary

Describes building an in-house orchestration platform for SAST and SCA tools after DefectDojo failed under load; the platform runs about 1,500 scans daily across 6,000 projects and stores over 300 GB of raw findings. Covers the scalability problem, the custom orchestration solution and operational experience running large-scale automated vulnerability scanning.

AI-written summary · about

" chapters (14)

1. 0:00Introduction
2. 1:09Why internal SAST
3. 3:39Platform requirements
4. 5:05System architecture
5. 8:15Data model and deduplication
6. 14:41Scaling challenges
7. 17:36Team role separation
8. 19:29Vulnerability duplication and prioritization
9. 24:03UI and vulnerability handling
10. 26:34Rule and severity setup
11. 28:42False positive filtering
12. 30:34Container and secrets analysis
13. 32:02Conclusion and recommendations
14. 41:01Q&A

" related talks

• 30mDefectDojo ProjectTimo Pagel, Stefan Fleckenstein · OWASP 2022 Global AppSec Europe Virtual Event
• 29mFlagship Projects: DefectDojoMatt Tesauro, Aaron Weaver · OWASP 20th Anniversary 2021
• 40mMaking Vulnerability Management Less Painful with OWASP DefectDojoGreg Anderson · AppSec USA 2017
• 43mDevSecOps on steroids - Powered by your Selenium testsMatthias Zax · Selenium Conf 2022
• 27mOWASP DefectDojoMatt Tesauro · OWASP Global AppSec San Francisco 2024
• 43mSUSTO: Systematic Universal Security Testing OrchestrationLuis Saiz · OWASP Global AppSec Amsterdam 2019
• 40mDevSecOps Guide to Bulletproof Your Development WorkflowRicardo Magalhães · Øredev 2025
• 37mDevSecOps Guide to Bulletproof Your Development WorkflowRicardo Magalhães · Heapcon 2024