Brook Schoenfield — Security is a messy problem

Why doesn't an executive mandate and a scanning tool add up to a software security program? Brook Schoenfield joins Chris and Robert to unpack security as a human, technical, and organizational problem that crosses the whole development lifecycle. He describes the limits of policy and testing, then explains how noisy tools lose developer trust. His practical alternative is to begin with high-confidence checks developers can use themselves, supported by deeper specialist testing rather than an impossible promise to find everything. The conversation turns to culture hacking: sharing responsibility, helping teams work through the consequences of their own incidents, and using threat modeling to make security tangible. Brook closes by connecting those habits to iterative improvement and the security of the delivery pipeline itself.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Brook S.E. Schoenfield:
→ LinkedIn
→ Brook's website

Mentioned in this episode:
→ Securing Systems: Applied Security Architecture and Threat Models
→ IOActive

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
05:03 Why a mandate is not a security program
08:32 The appeal and limits of simple answers
09:50 Security crosses every domain
11:41 Getting engineers to want security
16:59 Why security tools lose developer trust
24:10 Layering developer checks and specialist testing
25:55 Putting useful tools in developers' hands
29:15 Fast feedback while writing code
33:00 The program-building lessons so far
34:43 Culture hacking and shared responsibility
40:25 Continuous improvement and delivery-chain security
43:33 What's next in Brook's writing