Standard Classification: Automate Security, Don't Tell Your Boss
summary
Automates security work with a concrete pipeline: intake, triage, run tests, normalize into Defect Dojo, and push to Jira so results flow instead of piling up. Uses Docker containers and event-driven runs to scan many targets — example: 15 repos over four months, ~5,100 pipeline runs and 25,000 container executions. Shows a team increasing assessments from 44 to 414 (≈10×) while losing staff, argues automation buys breadth and metrics though not a substitute for manual depth.
AI-written summary · about
chapters (11)
- 0:00Introduction to automation
- 1:56The case against traditional
- 4:57Defining the core strategy
- 7:13Defect Dojo and automation
- 9:30Recommended reading
- 10:56Building appsec pipelines
- 14:45Gen 1 pipeline implementation
- 17:36Gen 2 pipeline capabilities
- 18:27Gen 3 pipeline scaling
- 20:27Automation results and impact
- 22:47Visibility and conclusion
related talks
43mBuilding a Secure DevOps Pipeline
32mAutomating Security Compliance at Scale
51mTaking AppSec to 11: Pipelines, DevOps and making things better
38mDesign Approaches for Security Automation
40mDevSecOps Guide to Bulletproof Your Development Workflow
40mAutomation of Security Scanning: Easy or Cheese
36mImproving Security while Reducing Toil with DevSecOps
11mLove Your Security Engineer as Yourself