Using developer-centric data to improve Application Security Outcomes
summary
Argues that metadata from Dev tools (Git/GitHub APIs, build frequency, PR frequency, reviewer and submitter diversity, lines of code, tech counts) predicts and prioritizes AppSec risk, demonstrates quick prototypes in messy Python with Copilot and points to the free git-qui-stats starter tool. Shows how mapping repos as nodes and edges reveals decaying projects and key-person risk, claims this work runs in an afternoon, surfaces surprising hotspots, and yields actionable priorities that improve resilience and team upskilling.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 4:00Security tooling limitations
- 13:50Developer data for risk prediction
- 24:22Human risk in teams
- 31:46Business models and security
- 37:24Neglected systems danger
- 40:14Asset mapping for prioritization
- 43:02Practical security steps
- 47:34Summary
- 48:44Q&A
related talks
57mUsing developer-centric data to predict, prioritize, and improve App Security Outcomes
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
19mFlipping the script on application security
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
17mGamify security best practices to scalably improve engineering culture
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
55mAh mom, why do I need to eat my vegetables?
53mFlipping the Script on Application Security