Keynote: Measure Security Effectively

Overview: In this Black Hat Singapore keynote session, conference organizers and George Do, CISO at Gojek and GoTo Financial, explore developer-centric security models and actionable cybersecurity measurement. The introductory remarks highlight the necessity of empowering software developers to own security given extreme personnel ratios and cloud abstraction. George Do then presents strategies for security leaders to escape the organizational perception of being "Mordac, the Preventer of Information Services," arguing that security initiatives must be quantitatively measured against real business risk rather than operated in a bureaucratic vacuum.

Key Topics: - The developer-to-security expert staffing imbalance (often 100:1) and the shift-left security paradigm - Transforming security teams from gating checkpoints into developer-enabling advisors within cloud and infrastructure-as-code environments - Overcoming the organizational perception of security as "Mordac" or "CIS-No" - Establishing quantitative, business-aligned security metrics that demonstrate tangible risk reduction from the trenches to the boardroom

Technical Details: The keynote opens by addressing the structural realities of modern software engineering and enterprise infrastructure. With infrastructure, networking, and cloud configurations now defined entirely as code (IaC), development teams dictate operational velocity. The speaker emphasizes that security teams cannot act as centralized gating bottlenecks because developer-to-AppSec specialist ratios frequently reach 100 to 1. Denying developers access to open-source components merely forces them to write proprietary code that carries equal or greater defect density. To achieve scalable security, organizations must embed AppSec specialists directly into development squads and deploy tooling that mirrors native developer workflows rather than legacy compliance scanners.

George Do takes the stage to address the governance challenge of demonstrating value and moving the security needle from technical trenches to the executive boardroom. Reflecting on leadership roles across NASA, Equinix, Exodus/CenturyLink, and TiVo, Do illustrates the common organizational dysfunction where security is viewed as "Mordac, the Preventer of Information Services" (from the Dilbert comic) or "CIS-No." This occurs when security policies are formulated in isolation without regard for business friction, imposing absurd hurdles—analogous to requiring users to "stare directly at the sun to log in"—that alienate engineering teams and impede operational efficiency.

To counteract this dynamic, Do argues that security leaders must replace subjective compliance checklists with empirical, risk-adjusted metrics. Security programs must measure whether ongoing investments in tooling, personnel, and process engineering actually reduce business-impacting attack surfaces. Meaningful metrics must capture the operational velocity of remediation, the resilience of critical business workflows, and the alignment of defensive controls with regulatory requirements, enabling CISOs to articulate security value effectively to executive boards.

Key Takeaways: Enterprises must transition to developer-first security models where security teams act as supportive enablers rather than obstructive gating authorities. AppSec tooling must integrate directly into existing developer pipelines with minimal friction to achieve adoption across high developer-to-security ratios. Cybersecurity leadership must replace bureaucratic mandates with clear, business-aligned metrics that measure actual risk reduction and maintain executive alignment.

(AI summary — Gemini Flash)