Keynote

The keynote opens with a note that the views are personal rather than those of the speaker's employer, then frames the talk as a look at application security beliefs that proved mistaken. The speaker argues that success stories tend to skip what went wrong, and that unexamined assumptions about how controls behave are often the real source of risk.

The middle covers four beliefs the speaker has dropped. First, that organizations will take up application security purely out of principle: security competes for limited engineering time and budget, and change tends to come from breaches, compliance rules, software bill of materials requirements and customer contract demands. Second, that every developer should become a security expert through broad principles training; targeted, code-level guidance in the languages teams actually use is more practical. Third, that only developers belong in the field, when auditors, product managers and writers are needed too. Fourth, that certifications have little value, overlooking how useful they are for people without degrees.

The closing thread is that the speaker had assumed others shared their background and priorities. The takeaway is to seek out people who disagree, take negative feedback seriously, and recognize that this work is a long effort best done together.