Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change

A security awareness program needs to change daily behavior, not simply record who completed a course. In this recorded conference talk, Chris Romeo shares lessons from building a large-scale application security education and culture program at Cisco. He explains why developers need practical knowledge, why security culture must be deliberate and sustainable, and how an organization’s own history can make lessons relevant. Chris walks through program design choices, including a recognizable theme, learning paths, activities, and ways to keep people involved. He also distinguishes useful gamification from superficial rewards and describes how visible achievements can reinforce learning. The talk offers a blueprint for connecting education, community, and repeated practice so security becomes part of how people develop software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo’s presentations

Mentioned in this episode:
→ Slides on SpeakerDeck
→ Cisco Security Ninja

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec awareness and sustainable security culture
01:16 Why application security matters when software is everywhere
05:11 Helping developers do the right thing
06:05 Teaching developers to think about security
10:26 Designing deliberate and sustainable culture change
14:06 Learning from organizational history and designing a program
27:42 Activities that turn learning into practice
41:21 Gamification and reinforcing security habits