Elissa Shevinsky — Static Analysis early and often

Security testing is more likely to happen when it fits the way developers already work. Elissa Shevinsky, then CEO of Faster Than Light, joins Chris and Robert to discuss static analysis, startup lessons, and making security easier to adopt. She explains how her entrepreneurial path led into security and how mentors helped her navigate unfamiliar problems. The conversation then turns to what static analysis can tell developers, when to run it, and why slow or confusing feedback limits its usefulness. Elissa connects security findings with code quality and describes the challenge of communicating their value to people outside security. Her practical theme is to test early and often while reducing the effort required to make testing routine.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Elissa Shevinsky:
→ Elissa Shevinsky on LinkedIn

Mentioned in this episode:
→ Faster Than Light — historical project repositories
→ FindBugs — historical Java analyzer
→ Techstars London

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Static analysis early and often with Elissa Shevinsky
02:01 Elissa’s path into software and security
06:26 Lessons from security startups
07:51 The value of mentoring
09:15 Paying mentoring forward
12:52 The Techstars London experience
14:15 What static analysis does
16:35 Making findings useful to developers
17:45 When to run static analysis
19:16 Testing in frequent deployment cycles
22:23 Making security fit everyday work
25:06 Security and code quality
25:42 Practical testing habits
26:41 Closing advice