15 Years of Web Security: the Rebellious Teenage Years
summary
If the goal is actionable facts: web security teams already know how to reduce risk but economic incentives fail them, backed by WhiteHat’s measurements: 6% of sites have SQLi, 47% have XSS, many industries average months to remediate (retail ~227 days average fix; finance ~160), and substantial exposure persists (39% of finance sites have a serious vuln every day). Cyber insurance dwarfs new security spend and is exploding (premiums $3B, 60–70% growth). Also covered: which controls (static analysis, QA, adversarial testing) move which metric, and a vendor guarantee tying findings to financial coverage. Decide based on these numbers.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 2:12Legacy Issues
- 5:43Web Security
- 8:37Threat Modeling
- 10:43Threat Actors
- 12:02Vulnerability Data
- 13:20One Layer Deeper
- 16:27Broad Numbers
- 18:24Time to Fix
- 20:43The Annual
- 23:03Window of Exposure
- 25:20Data Losses
- 26:41Apathy
- 28:20Cyber Insurance
- 31:49Whos Offering Cyber Insurance
- 34:19AppSec Growth
- 35:18Security Guarantees
- 36:33Product Liability
- 40:12Risk Reduction
- 43:32Security Assessment
related talks
01h 03mTen Key Steps for Enhanced Web App Security
30mAppSec Timeline: Wins, Failures, Promises, and Predictions
50mWorrisome Web Vulnerability Trends in the Race to Innovation
59mPractical Security for Web Applications
46mRugged Software Engineering
51mBigger, Faster and More Secure
34mThe State of Web Security
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...