Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change

A security awareness program needs to change daily behavior, not simply record who completed a course. In this recorded conference talk, Chris Romeo shares lessons from building a large-scale application security education and culture program at Cisco. He explains why developers need practical knowledge, why security culture must be deliberate and sustainable, and how an organization’s own history can make lessons relevant. Chris walks through program design choices, including a recognizable theme, learning paths, activities, and ways to keep people involved. He also distinguishes useful gamification from superficial rewards and describes how visible achievements can reinforce learning. The talk offers a blueprint for connecting education, community, and repeated practice so security becomes part of how people develop software.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Chris Romeo:→ Chris Romeo’s presentationsMentioned in this episode:→ Slides on SpeakerDeck→ Cisco Security NinjaFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 AppSec awareness and sustainable security culture01:16 Why application security matters when software is everywhere05:11 Helping developers do the right thing06:05 Teaching developers to think about security10:26 Designing deliberate and sustainable culture change14:06 Learning from organizational history and designing a program27:42 Activities that turn learning into practice41:21 Gamification and reinforcing security habits