“Our products are already SbD”

Reality: The incentives and steady stream of breaches make that unlikely.

While some manufacturers have made genuine progress reducing recurring classes of coding error, the industry as a whole has not. It's important to separate effort from outcomes — hiring an appsec team and acquiring tools are necessary but not sufficient to reduce customer harm.

Start with customer field studies (C-10), threat models (C-08), and the cost of your recurring classes of coding error (Q-02).

Discussion prompts

• How do you measure the security outcomes your customers actually experience regarding your products?
• What recurring classes of defect appear in your products most often? What is the root cause?
• How might a field study of your customers' security experience change your product roadmap? What would you do differently?