Tenants for Going at DevSecOps Speed

The talk addresses someone newly handed a DevSecOps or product security role, facing many applications and a pile of tool output with a small team. Matt Tesauro argues that two foundations come first: an early initial assessment that sets a baseline for measuring progress, and a single source of truth that consolidates findings and adapts as the business changes. He points to OWASP DefectDojo as a platform built for this job.

The core of the talk is a four-stage pipeline of intake, triage, testing, and delivery. Intake improves when teams stop re-requesting the same data and when routine checks run automatically ahead of time. Triage sorts work into a few concrete effort levels based on business criticality and tool accuracy. Testing depends on cadence, since audits, proactive scans, and urgent disclosures compete for the same people. New tools should run quietly before they gate CI/CD, because false positives that break builds quickly erode support. Delivery means speaking each stakeholder's language, whether that is issue tracker entries for developers or charts for executives.

The closing advice is to define scope, build a workflow, iterate constantly, and let feedback shape the program rather than dictating it. Automating repetitive work matters because people remain the scarcest resource.