How to get developers to want to adopt AppSec
summary
Claims a practical framework: translate vulnerabilities into engineering ownership and KPIs, prioritize fixes by business impact not CVSS, and integrate security tests in CI so regressions fail like functional bugs. Recommends runtime and static tools with SDK/CLI and IDE hooks, gives a concrete fix (replace open redirect URL param with a service enum to stop SSRF), values proof of exploitation screenshots/request‑response, and aims for less than 10% false positives to avoid losing developer trust.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:48Engineers resist AppSec
- 8:42Cost of ignoring vulnerabilities
- 10:06Education for adoption
- 13:23Automated testing early
- 17:16Prioritizing with product teams
- 20:28Effective AppSec tools
- 27:56Evaluating tools with vulnerable apps
- 28:40Takeaways for adoption
- 29:40Q&A
related talks
17mWhy you fail at Application Security - and how to fix it
28mWhy Developers Struggle with AppSec
27mDevelopers Struggle with Application Security (and How to Make ...)
47mSecurity is Everybody's Job
53mPractical tips for web application security in the age of agile and DevOps
31mHow to get everyone to get on board with software security: practical tips and suggestions.
40mMaking Security an integrated part of the SW Dev Lifecycle
20mHow to Use Your Vulnerabilities to Train Your Developers on Security