Content Paul is Following

With respect to the technology and processes that your organization already has in place, what is your biggest unmet need or gap in AppSec?

Securing development infrastructure (GitHub, Jenkins, etc.)

Code tampering

Securing Infrastructure-as-Code (Terraform, Kubernetes, etc.)

Source code leakage

Software composition Analysis (Snyk, Whitesource, etc.)

Protecting the app in production

View Results

How do vendor security reviews influence technology purchases?

None, we don't perform vendor security reviews

Very little, our vendor reviews are mostly a box-checking exercises

Sometimes vendor security reviews delay purchases but they don't change outcomes

Vendor security reviews break ties between equal vendors

Vendor reviews make security a key buying criteria

View Results

On average, how many cloud providers do you use? Furthermore, do you see it as risk mitigation to spread your workloads across providers (e.g., not putting all of your eggs in one risk basket), or do you see it as an increased risk (e.g., it's harder to get enterprise control and an enterprise view across your estate?) What factors do you consider when deciding whether to add another provider to that list?

How do you balance user experience with the need to maintain an effective IAM program? Can you share any tips for navigating those trade-offs?

Read More Comments

Have you explored or used any of the free training programs offered by hyperscalers? Which ones should other leaders check out for their own teams?

Read More Comments
Paul Toal, CISO Advisor at Broadcom | Gartner Peer Community