Using Developer-Centric Data to Predict, Prioritize, and Improve Application Security Outcomes

This conference talk explores how application security initiatives can be more effective by leveraging developer-centric data rather than imposing security measures from outside the development process. Discover why many security programs encounter resistance when they fail to account for the real-world constraints of software development teams. Learn how the DevSecOps movement, despite its promising start, has often reverted to siloed approaches over the past decade. Explore practical methods for using data about software teams—including their behaviors, lifecycles, and projects—to identify which security initiatives to prioritize for maximum success. The presentation demonstrates how taking a developer-centric approach to security programs can foster meaningful collaboration between security and development teams through shared contextual understanding. Gain insights into creating sustainable application security outcomes that work with, rather than against, the realities of modern software development.