AppSec Clarity Compass
It may feel true, but it's not.
Surrounded by idiots.
You've organized secure coding trainings, written that secure coding guideline, and added all those nice tools, but your software is still not secure? Developers are still hardcoding secrets, don't update their libraries, and are far too slow in fixing vulnerabilities.
Why don't they get it?!
Nobody even cares.
You are the only one pushing security forward. Sure, you have a few allies, but most of them just don't care. They build their nice little features, but nobody cares about the consequences downstream. And when the next incident hits, they expect you to save the day.
Why are they so careless?
You must control them.
Of course you can't just let them run and hope for the best. You must control their actions, otherwise the incidents will pile up. And whose fault is it when you can't save them all? But you know something needs to change. Controlling everything just doesn't scale.
How could you ever trust them?
How can you ever trust them?
Control is like instant gratification. It provides only short-term security. A sustainable and resilient strategy for long-term security must be built on trust.
Letting go of control? That would be insane.
My dog Suschka already crossed hunting mice, cats, squirrels, horses, deer and even a chamois off her bucket list. Moose and camels were marked as party poopers. Reindeer and rabbits are highly wanted.
This summer, a small miracle happened. On an evening walk in Sweden, she spotted a deer and off they went. I was screaming as loud as I could. Usually that doesn't change anything, but this time she paused and looked at me. I called her again and she came. I still can't believe it.
About four years ago, I contacted a dog trainer. She couldn't guarantee I would ever be able to stop Suschka from hunting, but she gave me a grounded hypothesis and a structured experiment for my training.
That's what the Clarity Compass does for you in AppSec.
How can you ever trust them?
Control is like instant gratification. It provides only short-term security. A sustainable and resilient strategy for long-term security must be built on trust.
Letting go of control? That would be insane.
My dog Suschka already crossed hunting mice, cats, squirrels, horses, deer and even a chamois off her bucket list. Moose and camels were marked as party poopers. Reindeer and rabbits are highly wanted.
This summer, a small miracle happened. On an evening walk in Sweden, she spotted a deer and off they went. I was screaming as loud as I could. Usually that doesn't change anything, but this time she paused and looked at me. I called her again and she came. I still can't believe it.
About four years ago, I contacted a dog trainer. She couldn't guarantee I would ever be able to stop Suschka from hunting, but she gave me a grounded hypothesis and a structured experiment for my training.
That's what the Clarity Compass does for you in AppSec.
How can you safely let go of control?
Truth is, you are stuck in a self-created downward spiral.
Within your AppSec system, control creates resistance. Resistance will cause creative workarounds to get around your controls. And of course that leads to even more controls. This approach can't work.
You need to break the cycle.
With Suschka, I established 'bambi' as a promise of really tasty treats. Then we tested it in the field. Can I stop her from digging for mice? Or from hunting cats and squirrels? With deer, we practiced on leash. Eventually, it worked on that summer evening.
In AppSec, you do the same. After the Clarity Compass, you've got all you need to break the cycle: the good security habit you want to build, the strong incentive to make the new behavior rewarding, and a practice to establish it.
It's your starting point, not the end of the journey.
It won't happen overnight, and there is no guarantee it will always work, but at least the chance is no longer zero. Trust is built over time.
How can you safely let go of control?
Truth is, you are stuck in a self-created downward spiral.
Within your AppSec system, control creates resistance. Resistance will cause creative workarounds to get around your controls. And of course that leads to even more controls. This approach can't work.
You need to break the cycle.
With Suschka, I established 'bambi' as a promise of really tasty treats. Then we tested it in the field. Can I stop her from digging for mice? Or from hunting cats and squirrels? With deer, we practiced on leash. Eventually, it worked on that summer evening.
In AppSec, you do the same. After the Clarity Compass, you've got all you need to break the cycle: the good security habit you want to build, the strong incentive to make the new behavior rewarding, and a practice to establish it.
It's your starting point, not the end of the journey.
It won't happen overnight, and there is no guarantee it will always work, but at least the chance is no longer zero. Trust is built over time.
Your Clarity Compass at a glance
How it works
We will discuss your biggest pain point 1:1 to uncover the underlying structural problem. I will come up with a hypothesis and an idea for your first experiment.
Once the hypothesis makes sense to you, I'll prepare your guide and walk you through it in a final call.
For the Clarity Compass, I work with only the AppSec Lead on one problem. No fixed time limit, but a fixed scope.
What happens next
We are attempting to solve a complex problem, so there is no guarantee of a working solution. Your experiment will start small. You will know what data to collect and be able to adjust accordingly.
If you want ongoing support with your experiment, check out the Trail Guide.
If you want hypotheses based on a more holistic picture, consider a Rig Inspection instead.
The deal
We will figure out together how you can break the cycle and design your first experiment. Then it's up to you to actually make your first step toward trust and resilience. You will experience the method to solve complex issues yourself.
Investment:
5,000 USD
Expected duration: 2-4 weeks
Ready to break the cycle?
Awesome. Let's have a campfire talk about your AppSec challenges. Ok, no campfire. Just AppSec.
Still wondering if the Clarity Compass works for you?
