Ronnie Flathers — Security programs big and small

Which parts of an AppSec program should change as a company grows, and which should stay the same? Ronnie Flathers joins Chris and Robert to compare security work in a fast-moving smaller company with the challenges of a large enterprise. He explains the advantages of a consistent technology stack and close developer relationships, then explores what breaks when one team can no longer know every application or manager. The discussion covers developing security champions, meeting teams where they work, and making incremental improvements instead of chasing an overnight transformation. Ronnie grounds the comparison in four principles: visibility and transparency, enabling rather than hindering, iterative progress, and management through metrics. The starting point is understanding what exists before deciding how to secure it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ronnie Flathers:
→ LinkedIn
→ Ronnie's blog

Mentioned in this episode:
→ Darknet Diaries
→ OWASP Juice Shop
→ Agile Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:59 Xbox hacking and Ronnie's security beginnings
04:50 Consulting and early mentorship
08:44 Security catching up with software delivery
11:54 Growing security skills in developers
13:11 Champions who want to participate
16:52 Embedding security with engineering teams
18:37 Advantages of a smaller company's technology stack
22:52 Why large-company security cannot do everything
24:25 Working with development processes
25:47 First priorities in a smaller company
29:04 Making progress with resistant teams
30:55 Enterprise visibility and management through metrics
33:24 Four foundations of an AppSec program