Sh*t left security: Retro on AppSec failures

Are your security tools causing more harm than good for developers? Are they too noisy, aggressive, and not developer-friendly? Has your shift-left strategy truly enabled you to catch security vulnerabilities earlier, move fast, and ship secure code? Is DevSecOps already obsolete? Does shift-left really address existing security debt? Despite shifting left, do you still face numerous critical vulnerabilities? Sounds familiar?

Is your AppSec team overwhelmed with useless alerts? Are AppSec engineers creating more meaningless work for development teams just because a tool reports a vulnerability? But wait, didn't my AppSec vendor promise their product would eliminate vulnerabilities and that quarterly business reviews would help resolve security issues? Were they all wrong? Reactive AppSec, alert fatigue, fragmented tooling, and security gating blocking deployments—has shift-left turned into "sh*t left" within your organization?

In the first part of this presentation, I will discuss the AppSec failure stories, limitations of the shift-left approach and key factors hindering its effectiveness. In the second part, I’ll provide insights on how to set your AppSec program up for success, whether Shift left is enough, strategies on burning down vulnerabilities, eliminating bug classes rather than JIRA tickets.

Outline

At Conclusion, I would do a recap of key requirements & open the floor for questions.