The road to AppSec Maturity is through Unification

The talk starts from the pressure modern software delivery puts on security teams. Agile development, microservices, open source, containers and infrastructure as code mean software ships more often and in more places, while scanning tools sit in silos. Approvals, triage and remediation follow-up often live in spreadsheets, email and chat. The speaker argues that application and infrastructure security are usually handled separately, even though they affect each other.

The middle of the talk presents a maturity model developed by a practitioner community, called S3M2 in the talk. It rates a program from one to five across people, process and technology. The speaker walks through what each level looks like, from ad hoc manual work to automated policy enforcement and real-time feedback loops. The model is meant for self-assessment rather than a fixed target, since a small organization may reasonably stay at a lower level. Recurring themes include visibility across assets, business context for prioritization, and enforcing service-level agreements across teams.

The closing section lists five capabilities a strong program needs: unified visibility across applications, cloud, containers and the supply chain; risk-based prioritization; remediation inside tools developers already use; automation that scales; and measurement through reporting and tracking. The main takeaway is that maturing an AppSec program depends on unifying tools, environments and workflows. A vendor platform is presented as one option for doing this, and the speaker notes that other approaches also work.