Doing This One Crazy Thing Will Change Your AppSec Program Forever

The talk starts from the gap between what people assume about software and what it actually contains. The speaker points to repeated high-profile breaches and to the same vulnerability classes persisting in the OWASP Top 10 for about two decades as signs that current application security practice is not answering the basic question of whether a product is secure. Drawing on the economics of information asymmetry, he frames software buying as a market where purchasers cannot see how a product was built or tested.

The proposed alternative is to treat security as a running argument. A team identifies its biggest threat first, chooses a primary and a backup defense, and gathers evidence that the defense works, ideally from automated checks in the delivery pipeline. Testing should cover the fully assembled application, because source-only scans miss runtime libraries and configuration and generate false positives. Rather than counting findings, the speaker suggests tracking how quickly vulnerabilities are fixed and how often new ones are introduced. He also demonstrated runtime protection against expression language injection, the flaw behind the Equifax breach, using an open-source tool.

The closing argument is for security labels, comparable to nutrition facts or crash ratings, that summarize the evidence behind a product so buyers can make informed choices. Software bills of materials are one piece of that picture. Audience questions covered whether ASVS levels could serve as a starting point and how threat modeling and certification fit in. The practical takeaway is to tie each control to a specific threat and check it with evidence, rather than running activities out of habit.