The Psychology of DevSecOps
summary
Two large orgs apply behavioral science to AppSec: one implements a Theory of Planned Behavior–based outreach and a gamified training platform that gets ~33% developer engagement and spurred a smaller team to beat a flagship team after Friday-night hackathons; the other builds a Product Intelligence dashboard (score 300–850) that normalizes pen tests, vuln remediation, tooling adoption (40% + 40% of score), champs/badges (15%), and -5% for recent incidents, plus an anonymous DevSecOps culture survey and a psychological contracts approach to set and communicate expectations.
AI-written summary · about
chapters (8)
- 0:00Start
- 9:45The Theory of Planned Behavior
- 12:35Shaping Messaging
- 13:45Shaping Interventions
- 16:54Delivering Interventions
- 21:45Going deeper on Organizational Psychology
- 23:25Types of organizational commitment
- 39:11Additional Research
related talks
52mLeveraging Psychological Needs For Building A Security Culture Amongst Developers
48mDevOps Is Automation, DevSecOps Is People
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
57mBuilding a Modern Security Engineering Organization
42mAppSec is dead. Long live DevSecOps!
31mDevSecOps, or How to Integrate Security into DevOps Practices
33mOrganizational Change Through The Power Of Why - SecDevOps Enablement
49mLessons from DevSecOps Trenches