Nurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps
summary
Data from Veracode and Cyentia analyzes 132k applications, >1M scans and ~10M findings and shows about 3 in 4 apps have at least one flaw and ~1 in 4 have high severity. Median closed flaws (ignoring still-open cases) is 86 days but survival analysis with open findings gives a median open time ~216 days; apps scanned daily (≈260+ scans/year) hit a ~62 day median. Open‑source flaws are common but >80% are fixed by minor updates and only ~1% exploitable on the executable path; libraries often arrive via transitive dependencies, and language matters (PHP, JavaScript, Java show different dominant flaw types).
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:36Agenda
- 1:53Data
- 3:38Common Application Flaws
- 6:18Common Flaws
- 7:57Common Flaws Density
- 8:47Common Flaws Spread
- 9:30Common Flaws Fixed
- 10:19Application Flaws
- 11:34Language
- 12:35Top 10 Languages
- 14:47PHP
- 15:46ThirdParty vs Inhouse Code
- 18:50Open Source Report
- 19:28How many are you using
- 21:03transitive dependencies
- 22:45More libraries more problems
- 24:37How dangerous are flaws
- 26:54Updating a library
- 27:39Lifecycle of updates
- 28:39How often each update occurs
- 29:31Most updates are small
- 30:43Time
- 31:53Survival Analysis
- 33:25Rate of Scanning
- 34:19Nurture vs Nature
- 35:24Dynamic vs Static
- 36:39Survival Curve
- 37:05Summary
related talks
49mQuantifying the Probability of Flaws in Open Source
46mBenchmarking AppSec Across Industries
38mAppSec is Dead Long Live DevSecOps!
13mIntelligence in AppSec: Use AI to supercharge DevSecOps
40mEmbracing Security - A Changing DevOps Landscape
53m8 Million Findings in One Year: Fresh Look at the State of Software Security
30mAppSec Timeline: Wins, Failures, Promises, and Predictions
30mDevSecOps: How to Level Up IT Security Expertise in Your Organization