Bootstrapping Your First AppSec Program

The speaker frames application security as a team and a program rather than a stack of scanning tools, aimed at people starting an AppSec function with little or no budget. He argues that the scope includes the code a company writes, third-party libraries and open source dependencies, and that success depends heavily on relationships and leadership. Early hires should combine good communication skills with a working grasp of security, and a small team can grow by learning from the strongest breakers and developers already in the company.

The middle of the talk covers sequencing. He recommends threat modeling before running tools, since it surfaces real exposures such as risky container configuration, and advises rolling out one control at a time with a plan for the whole year. He describes earning buy-in from engineering leaders, starting controls as education rather than blocking gates, and backing them with written policy. He also shares an example where a trimmed, validated list of dynamic scanning findings earned team trust quickly. Embedded security engineers, security champions and lunch-and-learn training are presented as ways to spread knowledge.

He closes with continuous improvement: tuning tools, building metrics that tell a clear story to leadership, and treating engineers as customers. The main takeaway is to start small, earn trust through relationships, and measure progress.