It doesn't take much to be above average
summary
Most small software companies underinvest in security and sit in a defined danger zone: ~40 FTE, ~5 MEUR revenue, yet large gains are cheap and practical. Analysis across hundreds of targets shows common gaps: unclear ownership, no competence mapping, no threat prioritization, and no testing. Practical stack examples: Coverity, Polaris, Veracode, GitHub Advanced Security, SonarQube, Snyk, Black Duck, Detectify, Burp Suite, OWASP ZAP. Bug bounties pay €100–€7,500, yield thousands of reports and hundreds of valid findings.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:53How we learn
- 3:02Pressures and incentives
- 6:07The danger zone
- 6:40Unclear responsibility
- 9:12Lack of security competence
- 11:55Developing security competence
- 16:40Mitigating threats
- 17:52The beginnings of a security program
- 43:19Product Security Program
related talks
41mAim-Ready-Fire
26mTopics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi...
01h 03mBe your own Threatbuster!
01h 00mImproving the Chances of Success in Secure Software Development
30mEffective security on a tight budget
21mWhy Unleashing Your Software Security Potential is Necessary & How to Achieve It
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
35mDevSecOps in practice. Tools vs People!