Introduction to inner-loop security. Shifting left, but better.

Josh Wallace opens by questioning the familiar shift-left pitch that many application security programs are built around. He traces the term back to a 2001 quality assurance article, arguing its original idea was testing throughout development rather than pushing security scanners onto developers. He then explains how the meaning drifted and critiques common tooling: static analysis, dynamic analysis, software composition analysis and manual penetration testing. Each is assessed for slow feedback, false positives, configuration effort and the time it takes from a developer's day. Security champion programs and developer performance reviews also come in for criticism.

The middle of the talk introduces the inner loop, the cycle from writing code through building, testing and committing locally, before a pull request moves work into the outer loop of CI/CD. Wallace frames slow, noisy steps as tax and waste, and proposes testing for agreed security controls rather than individual vulnerabilities. Those controls can be expressed as fast, automated checks, which he calls security as code, and he suggests that some scanners could then run less often in the pipeline.

He closes by arguing that security activity belongs in the inner loop where feedback is quick and accurate, while the outer loop keeps the checks that must run there. The takeaway for practitioners is to measure the developer impact of each control, reduce waste, and avoid shifting left simply for its own sake.