Keynote

The keynote argues that software security practitioners should think about software trust over the next decade and learn to explain their work in the terms a business uses. The speaker traces the industry's history, from firewalls and intrusion prevention through early paid code reviews and static analysis, and then argues that the usual vocabulary of threats and controls does not reach executives, who talk about customers, products and revenue.

The middle of the talk focuses on adversaries. The speaker suggests building attacker personas, using bug bounty results and external attack surface findings as signals, and linking vulnerabilities to the adversaries likely to exploit them rather than to raw severity scores. A risk matrix is recast around negative impact and the level of effort and cost to mitigate, which makes it easier to request budget. Other suggestions include setting acceptable thresholds, tracking measures such as whether teams feel more capable after security interactions and how often known issues become incidents, and presenting the case to a CFO in financial numbers.

The closing section lists skills the speaker expects to matter: checking the output of AI tools, threat intelligence, data storytelling, secure coding training and security architecture, which is described as an open gap. The talk ends with an invitation to a community survey and a dashboard toolkit. The practical takeaway is to describe risk in financial terms and to study the customers and attackers around a product.