Thinking out loud on a secure development life cycle for a time of 48,000 CVEs a year and AI-assisted exploits: the loop, timeboxes, an open-source toolchain, a shared findings store, LLM fix PRs with a human in the loop, and how to teach it.
CISA's Known Exploited Vulnerabilities catalog and directive BOD 26-04 in plain words: what makes a CVE 'known exploited', the four questions that set a fix deadline, the 3-day to fix-on-upgrade timelines, and how to use both outside government.
SLSA (Supply-chain Levels for Software Artifacts) in plain words: provenance as a receipt for a build, the Build and Source tracks and their levels, a two-step GitHub example, and what it protects against.
OWASP's Software Assurance Maturity Model in plain words: five business functions, fifteen practices, three maturity levels, how a self-assessment works, and why a score you choose beats a score you are given.
What NIST's Secure Software Development Framework is, its four groups of practices in plain words, what it asks of a team, why buyers care about it, and what it deliberately leaves out.
A short introduction to MITRE ATT&CK for people who build software: how to read an ID like T1552.001, the 15 Enterprise tactics in v20 (including the new Stealth and Defense Impairment), a cheat card for each, and how developers can use it.
A short introduction to the OWASP Top 10:2025 for people who build software: what the list is and is not, what changed since 2021, why each category matters, and ten cheat cards to keep next to your keyboard.
