A Cheat Code for Security Programs

Ochaun Marshall, a product security engineer at Google Cloud, opens by separating product security from application and platform security. He argues that a well-built app running on a weak platform is still exposed, so the product that users actually receive should drive security priorities. Systems should be ranked by whether they handle sensitive data or affect user trust, rather than treated as an undifferentiated pile of servers.

The core of the talk is a four-direction framework. Shifting left moves threat modeling, threat intelligence and security reviews into design and build. Shifting right carries product-aware red teaming and monitoring into production, and findings are filed as engineering bugs rather than reports that sit in a document queue. Shifting up brings escalation and leadership support so security does not depend on heroics. Shifting down covers the full stack, from the application through the kernel to firmware.

The closing advice is to make security boring: automate common checks, place them inside developer workflows, avoid slow scans in fast pipelines, and treat security as a shared responsibility. In the Q&A, the speaker discussed risk frameworks, getting leadership buy-in by focusing on revenue-heavy products, and resolving disagreements over severity. Attendees leave with a way to pitch a product security program inside their own organization.