Retrofitting application security: A trident approach to securing in-flight development
Synopsis
Retrofitting application security into an already active development environment is one of the most complex, yet common, challenges faced by modern organizations. Legacy decisions, technical debt, release pressures, and fragmented tooling often leave development teams with unclear pathways to uplift security posture. This panel will explore a pragmatic, real-world approach to addressing this challenge using a trident strategy: developer education, tooling integration, and remediation support.
Delivered in a structured Q&A format, this session brings together three distinct industry perspectives—consulting, internal leadership, and technical tooling—moderated by Adrian Kitto, CISO at Detexian. The discussion will unpack how to approach application security uplift in a way that is scalable, cost-conscious, and collaborative across engineering and security teams.
Liam O'Shannessy as Executive Director and founder of CyberCX, will represent the consulting lens. Drawing from his experience advising large-scale clients on secure SDLC adoption, Liam will explore what works—and what doesn’t—when embedding AppSec practices into live development pipelines. He’ll speak to the importance of prioritization, coaching, and developer buy-in.
Damian Fasciani, CTO at Rosterfy, brings the internal lens, sharing his first-hand experience navigating the business justification, stakeholder alignment, and technical uplift needed to retrofit both infrastructure and application security in fast-moving digital environments. He’ll offer insight into the tensions between product delivery and risk management, and how to build internal momentum.
Lloyd Peacock, Cyber Technical Lead at OneDot61, provides the tools lens—focusing on how security tooling, including automated testing, configuration scanning, and monitoring, can be pragmatically applied to in-flight projects. Importantly, Lloyd will cut through the noise and marketing fluff to share how tools can genuinely reduce friction and increase assurance, without derailing velocity.
The panel will address practical questions such as: Where do you start when everything is already shipping? How do you measure success? How do you get development teams to embrace the change?
The final 10 minutes will be reserved for audience questions to encourage dialogue and knowledge sharing among peers.
This session is aimed at CISOs, Heads of Engineering, Security Architects, and DevSecOps professionals looking for actionable insights on uplifting security mid-stream—without starting over or slowing down delivery.