Topics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi...
summary
Nine months of structured research surveys 26 companies and produces concrete findings: mature programs use SAST DAST SCA, most take about a year to build, and the common staff to developer ratio lands around 1:50 to 1:100 ratio. Many programs lack formal training and rewards, ROI rarely has reliable metrics, and communication mixes Slack with formal town halls. The dataset focuses on large enterprises and reveals emergent best practices and measurable tradeoffs for scaling champions programs.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:28AppSec Champions
- 3:51Structured Research Approach
- 11:03Survey Questions
- 13:06Abstract Champion Program
- 15:39Tool Pipeline Usage
- 17:22Time to Build Program
- 19:19Roles Standards
- 20:29Communication
- 21:14Gamification
- 21:43Achieving your desired outcome
- 22:12The numbers side
- 22:41Key findings
- 24:03Relevance to you
related talks
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
01h 00mImproving the Chances of Success in Secure Software Development
01h 01mSecurity Champion Worst Practices
16mSecurity Champions The What, Why, and How
39mInternal AppSec Awareness and Education
41mAim-Ready-Fire
46mWe Pwn the Night: Growing & Leading an 31337 security research team
44mA Warrior's Journey Building a Global AppSec Program