Dmitry Shmoylov on building security from the ground up

Role

Dmitry Shmoylov heads software security at Kaspersky, driving secure development lifecycle (SDLC/SSDLC) across products whose failures would be especially consequential given elevated privileges.

Investment and culture

Secure development can consume 15–20% of team capacity early and slows delivery, requiring involvement from developers through executives, security champions, standardized security gates, extensive tooling, and an active bug bounty program.

Challenges

High-privilege security products attract attackers; continuous control is essential. Checkbox security is insufficient—consistency release-to-release matters organization-wide.

Secure by design and cyberimmunity

Security must be architectural, not patchwork; KasperskyOS embeds controls at the OS level. Cyberimmunity balances security goals with business constraints so protections focus where exploitation cost to attackers is meaningful.

Lessons

Recent pentests and static-analysis gaps on optimized system code and widely used open-source libraries led to CVE filings and improved detection rules.