Pause. Smile.
Set expectations.
“This is not a tool talk.
This is a story about a mistake… and how we fixed it.”
“I’m not here as someone who never broke prod.
I’m here as someone who learned the hard way.”
Create suspense.
Friday evening.
Small change.
No one thinks about security.
Slow down.
Make it cinematic.
Everyone has done this.
Pause here.
Let people react.
This is the hook.
Pause here.
Let people react.
This is the hook.
Important mindset shift.
This was not human error.
This was design failure.
Ask audience:
“How long do you think this took?”
Answer: seconds.
“This pipeline was fast…
at delivering risk.”
This is where DevSecOps enters.
DevSecOps is not a team.
It’s placement of responsibility.
“These goals came directly from the incident.”
“We didn’t add one tool.
We added multiple safety nets.”
Ask audience:
“Where is the cheapest place to fail?”
“One blocked commit saved us thousands of dollars.”
“This feels like magic when you demo it.”
“No cloud. No permissions.
Just discipline.”
“These tools are boring.
That’s why they work.”
“If security depends on humans being perfect,
it will fail.”
Seatbelts + airbags analogy.
CI must assume zero trust.
“Security is now enforced, not suggested.”
Transition to CI.
This is the enforcer layer.
Not saying it’s the best.
It was the best *for us*.
“Every stage asks:
Is it safe to continue?”
Short explanation.
No deep YAML dive.
“SQL injection caught before deploy.”
Tools:
- Trivy
- OWASP Dependency-Check
- Snyk
“Our biggest vuln once came from a library.”
Transition to containers.
“These are boring best practices.
Please follow them.”
“Would you store spoiled food in a clean fridge?”
“Nothing enters without inspection.”
Reinforce automation.
No manual approvals.
Context matters more than tools.
Slow down.
This is the takeaway slide.
End strong.
“Don’t add security later.
You’ll forget.
Put it where it can’t be ignored.”