Measuring Developer Security Education Without Vanity Metrics
A practical security engineering field guide to developer security education, covering risk, implementation, evidence, and team leadership.
Nathan Berg
Turning Requirements for Developer Security Education into Delivery Guardrails
A practical security engineering field guide to developer security education, covering risk, implementation, evidence, and team leadership.
Designing Developer Security Education: Trust Boundaries, Failure Modes, and Tradeoffs
A practical security engineering field guide to developer security education, covering risk, implementation, evidence, and team leadership.
Vulnerability Management Cadence for a Home Lab
A scanner run is not a vulnerability management program. The difference is cadence, prioritization, and verification. Even in a home lab, a light but consistent workflow keeps systems patched, redu...
A Practical Risk Model for Developer Security Education
A practical security engineering field guide to developer security education, covering risk, implementation, evidence, and team leadership.
A Practical Failure Exercise for Security Champions
A practical security engineering field guide to security champions, covering risk, implementation, evidence, and team leadership.
Security Champions in Production: Signals That Show the Control Works
A practical security engineering field guide to security champions, covering risk, implementation, evidence, and team leadership.
Implementing Security Champions Without Slowing Delivery
A practical security engineering field guide to security champions, covering risk, implementation, evidence, and team leadership.
Failure Modes in Security Champions: A Design-Level Analysis
A practical security engineering field guide to security champions, covering risk, implementation, evidence, and team leadership.
Supply Chain Security in CI: SBOMs, SLSA, and Sigstore
Software supply chain attacks target the build pipeline, not just the code. Defending against them requires visibility into dependencies, trusted build provenance, and artifact signing. SBOMs, SLSA...