Running Your Application Security Program Like a Marathon
summary
Draws concrete parallels: mental training maps to persistent program building, seven marathons becomes proof that steady pacing wins, and specific tooling choices matter — SAST DAST SIEM plus CI/CD and SCA pipelines drive measurable remediation like vulnerability density and time‑to‑fix. Uses threat modeling, security dashboards, incident response plans and a security‑champion program as built artifacts. Notes surprising specifics (race shoes retired after one or two events; wearables for pacing) and cites the six World Marathon Majors as an aspirational metric.
AI-written summary · about
chapters (15)
- 0:00Marathon mindset in security
- 2:09Mental prep for security goals
- 5:45Short and long-term goals
- 8:13Long-term security vision
- 10:41Essential security tools
- 13:33Security training methods
- 15:45Threat modeling parallels
- 18:13Continuous monitoring
- 20:25Adapting to threats
- 23:36Security program pitfalls
- 26:09Community in security
- 28:15Enjoying the journey
- 30:48Collaborative security mindset
- 33:16Key takeaways
- 34:21Q&A
related talks
57mKeynote: Maturing Your Application Security Program
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
33mBattle Tested Application Security
27mSecurity Learns to Sprint: DevSecOps
46mJuggling the Elephants: Making AppSec a Continuous Program
26mHow to Build an Application Security Program
52mContinuous Security
36m5 Steps to Drive Enterprise Software Security