2026-02-16 –, Auditorium
In the security industry, we often take well-established development practices, such as the DevOps infinity loop, add a layer of security, and label it "DevSecOps." However, this approach frequently overlooks a critical issue: layering complex security processes onto efficient development processes can create inefficiency. In this talk, I argue that true innovation in security comes not from tooling or automation alone, but from mastering the underlying process first. By drawing an analogy to simple machines — where incremental improvements led to the evolution of tools like levers, wheels, and pulleys — I will illustrate how optimizing foundational processes leads to scalable, effective security practices. Attendees will leave with practical insights on reducing inefficiencies and fostering consistent improvement in their security workflows.
1. Introduction: The Problem with Complexity in Security
- The security industry often adopts development frameworks, such as DevOps, and layers security onto them, creating frameworks like DevSecOps.
- The issue: security processes are frequently complex and inefficient compared to streamlined development processes.
- Key point: You can't automate something that is inefficient. Applying generative AI or advanced tooling to broken processes won’t fix them.
- Outcome: This leads to frustration, bottlenecks, and unmet security goals.
2. The Analogy: Security Processes as Simple Machines
- Introduction to simple machines: lever, wheel, pulley, etc.
- Simple machines represent fundamental tools that evolve through mastery and incremental improvement.
- Just as a lever becomes more efficient when transformed into a wheel or pulley, security processes must evolve through optimization.
- Example: A long, inefficient SAST (Static Application Security Testing) scan taking two days doesn’t fit into a two-week sprint. Simply automating it doesn’t solve the problem; instead, the process itself must be optimized.
3. Evolution of Security Processes through Consistency and Optimization
- Consistency is key: innovation stems from mastery and consistent refinement, not from one-time application of advanced tools.
- Case study: Improving SAST scans
- Initial state: A full SAST scan that takes two days to complete.
- Optimization: Breaking the scan into targeted components, running incremental scans, or using real-time feedback tools.
- Result: A faster, more efficient process that integrates seamlessly into the development lifecycle.
- Key takeaway: The goal is not to add complexity but to create efficiency through iteration.
4. The Futility of Applying AI to Broken Processes
- Generative AI and other advanced technologies can enhance efficient processes but cannot fix broken ones.
- Example: Applying AI to prioritize vulnerabilities from an inefficient scanning process will still result in a flood of low-value alerts.
- Solution: Fix the underlying process first, then enhance it with automation and AI.
5. Practical Steps to Achieve Process Mastery
- Identify inefficiencies: Audit current security processes to find bottlenecks and pain points.
- Apply incremental improvements: Start with small changes and measure their impact.
- Leverage automation only after optimization: Use tools to enhance an already efficient process.
- Foster a culture of continuous improvement: Encourage teams to regularly review and refine processes.
6. The Path Forward: Consistency as a Driver of Innovation
- Innovation doesn’t come from adding complexity; it comes from consistently improving simple, well-understood processes.
- Just as simple machines evolved over time into more complex but efficient systems, security processes must evolve through incremental mastery.
- Final analogy: A poorly applied lever remains inefficient regardless of how much force is applied; a well-crafted pulley system, however, can lift tremendous weight with minimal effort.
7. Key Takeaways for the Audience
- Stop trying to automate inefficiency: Focus on optimizing the underlying process first.
- Consistency drives innovation: Regular, incremental improvements lead to breakthroughs.
- Simplicity is powerful: Don’t overcomplicate security; instead, seek mastery of foundational processes.
8. Closing Thoughts and Call to Action
- Challenge to attendees: Audit one core security process in your organization and identify an inefficiency. Implement one small, consistent change and measure the impact.
- Final words: True security innovation comes not from flashy tools but from mastering the basics and improving them consistently over time.
Ken is the Head of Security at Filecoin Foundation and a security practitioner that focuses on software security from applications, to cloud and web3 technologies. He is also the host and producer of Relating to DevSecOps, a podcast focused on cultivating security relationships in organizations. With 15+ years of experience in the security industry, he has had the opportunity to serve in many roles from hacking on governments to building robust security programs from the ground up. In his spare time, he builds drones, sings karaoke, and makes things out of wood.