Running an AppSec Program with Open Source

In the closing presentation of the DEF CON Safe Mode AppSec Village, the speaker provides an operational blueprint for designing and scaling an enterprise Application Security program built entirely on open-source tooling. Opening at 00:14, the presenter emphasizes that high-maturity software security is achievable without seven-figure vendor licenses.

At 14:00, the session examines test coverage mapping, spotlighting Code Pulse to correlate testing activities across static, dynamic, and interactive security tools. At 28:00 and 42:00, the speaker addresses API security challenges, demonstrating automated testing frameworks and intentionally vulnerable applications like OWASP Pixi to benchmark detection efficacy.

Concluding at 56:02, the presenter urges security engineers to actively engage with open-source communities, contribute code to OWASP initiatives, and build transparent, developer-aligned security practices across the enterprise. (AI summary — Gemini Flash)