Elissa Shevinsky — Static Analysis early and often

Security testing is more likely to happen when it fits the way developers already work. Elissa Shevinsky, then CEO of Faster Than Light, joins Chris and Robert to discuss static analysis, startup lessons, and making security easier to adopt. She explains how her entrepreneurial path led into security and how mentors helped her navigate unfamiliar problems. The conversation then turns to what static analysis can tell developers, when to run it, and why slow or confusing feedback limits its usefulness. Elissa connects security findings with code quality and describes the challenge of communicating their value to people outside security. Her practical theme is to test early and often while reducing the effort required to make testing routine.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Elissa Shevinsky:→ Elissa Shevinsky on LinkedInMentioned in this episode:→ Faster Than Light — historical project repositories→ FindBugs — historical Java analyzer→ Techstars LondonFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Static analysis early and often with Elissa Shevinsky02:01 Elissa’s path into software and security06:26 Lessons from security startups07:51 The value of mentoring09:15 Paying mentoring forward12:52 The Techstars London experience14:15 What static analysis does16:35 Making findings useful to developers17:45 When to run static analysis19:16 Testing in frequent deployment cycles22:23 Making security fit everyday work25:06 Security and code quality25:42 Practical testing habits26:41 Closing advice