Matt Tesauro -- #AppSec Pipeline as Toolbox

How can a small AppSec team make sense of thousands of applications and a growing pile of security work? Matt Tesauro explains the AppSec Pipeline project as a toolbox for organizing and automating the work, rather than a single prescribed product. He describes the pressure that led him and Aaron Weaver to map intake, triage, testing, and delivery, then connect tools around those stages. The conversation examines DefectDojo’s role in tracking findings and effort, baseline testing across applications, and the value of reusable containers. Matt also explains how teams can adapt the pieces to their own development practices and where to begin. The result is a practical view of automation that supports decisions about both technical risk and limited team capacity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Tesauro:
→ Matt Tesauro on LinkedIn
→ OWASP AppSec Pipeline project

Mentioned in this episode:
→ OWASP DefectDojo
→ OWASP Dependency-Check
→ ZAP
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The AppSec Pipeline toolbox with Matt Tesauro
00:59 Matt’s security origin story
02:34 Discovering the OWASP community
04:31 Why the AppSec Pipeline project began
05:58 Scaling a small security team with automation
07:11 Tools that fit into the pipeline
08:59 Tracking work and resource tradeoffs
10:31 DefectDojo’s place in the process
12:18 Baseline testing across an application portfolio
14:14 A toolbox teams can adapt
15:30 Getting started: intake, triage, testing, and delivery
18:43 OWASP and sharing practical experience