Supercharging Your Security Pipeline

Mikael Nilsson, product security lead for a customer intelligence marketing platform at SAS, explains how his team's development practice moved from waterfall releases to monthly iterations and then to continuous deployment. That change made phased security testing unworkable and pushed scanning into the pipeline. He points to shrinking time-to-exploit figures from a Mandiant report as the reason fixes need to reach production much faster.

The core problem he describes is tool sprawl. Static and dependency scanners, secret scanning, container and cloud posture tools, dynamic testing, bug bounty reports and penetration tests each produce overlapping findings, and sending them straight to developers created duplicate and inconsistent work items. The talk uses DefectDojo, an open-source application security posture management tool, as a reference example of a central place to correlate and deduplicate findings, build an application inventory, triage in bulk and script work through an API. Nilsson stresses that he is not affiliated with the project and is not recommending it over alternatives.

His team now pushes triaged findings into Jira, opens tickets with remediation context, and closes them automatically when a tool stops reporting the issue. Critical exposures on internet-facing services can trigger on-call alerts. The challenges included adopting the central tool late, the developer disruption caused by switching scanners, and heavy Jira customization that forced scripting against the APIs. His practical takeaways are to plan the hierarchy of product types, products, engagements, tests and findings deliberately, and to avoid using Jira for work that is not project management.