The Cybersecurity-Minded Future, And How Security Champions Get Us There

The talk opens by framing application security as a people problem. The speaker argues that human behavior remains the largest factor in organizational risk, and that AI-based tools will not remove the need for creative human defenders. He treats an AppSec program as a change program, using the diffusion of innovation model to explain why early adopters, or security champions, are needed to carry a message past the enthusiastic minority.

The middle of the talk turns to practice. He recommends building relationships across engineering first, then finding risk, fixing it, and only afterward investing in root-cause analysis and preventative controls. For measurement, he suggests tracking how often teams bring security in early, how thoroughly risk is covered, how quickly issues get fixed, and how much rework prevention saves, translated into cost. He also covers motivation through status, access, power and recognition, and lists common reasons programs fail, such as missing leadership buy-in, negative social proof, handing security work to champions, and running them without resources or fun.

He closes by stressing that culture change takes years, that programs must be tailored to the organization's own culture, and that recruiting new champions is continuous. Audience questions covered attrition, involving HR, and how to grow adoption beyond early adopters.