Let Them Eat Cake

The keynote opens by acknowledging the land and then defines small and medium businesses as firms with under a thousand employees and under a billion dollars in annual revenue. The speaker argues that these businesses drive a large share of the economy and spend heavily on technology, yet the security industry is built around large enterprises. Most of them have no IT or security staff, so advice about DevSecOps and shift-left practices is out of reach for them.

The middle of the talk looks at how these businesses buy and run security. Purchasing tends to follow word of mouth and free trials rather than formal evaluation, and buyers want centralized marketplaces for comparison. The speaker describes a "security tax" in which single sign-on and advanced features cost substantially more, using GitHub and common collaboration tools as examples. Typical gaps include missing multi-factor authentication, excessive administrator rights and no logging. Ransomware is presented as a threat that hits small organizations as hard as large ones, since attackers do not screen by size, and AI tools are described as too unreliable to replace human risk assessment.

The closing section turns to software liability regulation. The speaker admits she once opposed it, explains how shared responsibility models can shift blame onto customers, and compares the situation to seat belts, which became mandatory only after decades of availability. The takeaway is that vendors should ship products that are secure by default. Attendees at larger companies were encouraged to press their leadership to make security features more affordable for smaller customers.