James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed

Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E. Schoenfield join Chris and Robert to discuss their book Building in Security at Agile Speed and the organizational work behind sustainable software security. They explain why practitioners need enough technical fluency to collaborate with developers, how leaders can recognize when a program is becoming self-sufficient, and which behaviors reveal that security has spread beyond a central team. The conversation returns repeatedly to people, trust, incentives, and measurement. It closes by challenging assumptions about penetration testing and showing how continuous delivery requires security practices that evolve with the development system rather than sit outside it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with James Ransome and Brook S. E. Schoenfield:
→ James Ransome on LinkedIn
→ Brook Schoenfield on LinkedIn

Mentioned in this episode:
→ Building in Security at Agile Speed
→ Core Software Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building security at agile speed
02:49 James Ransome’s security origin story
05:11 The book and the problem it addresses
08:08 Why this book and why now
15:59 Technical fluency for security leaders
21:36 When a security program becomes self-sufficient
24:48 Organic adoption and signs of maturity
30:36 Behaviors leaders can measure
34:19 People, process, and tools
37:07 Building trust across the organization
46:58 Penetration testing in continuous delivery
50:12 Final lessons from the authors