Navigating the Path to Application Security Manager in 2026

0:00SPEAKER_01:I think uh most brilliant software engineers out there feel like the ultimate career flex is catching that impossible zero day vulnerability.

0:08SPEAKER_00:Oh, absolutely. That's the dream, right?

0:10SPEAKER_01:Right. But according to this massive new 2026 industry blueprint we're looking at today, the people who actually end up running the tech industry, they aren't the ones finding the bugs.

0:20SPEAKER_00:No, they really aren't.

0:21SPEAKER_01:They're the ones who know how to talk the CTO into actually paying to fix them. Welcome to the deep dive.

0:27SPEAKER_00:Thanks for having me. It really is uh a fascinating paradigm shift to explore.

0:32SPEAKER_01:Yeah, and today we're looking at a comprehensive 2026 career guide and course catalog. This is published by Practical DevSeccups.

0:40SPEAKER_00:Right. The How to Become an Application Security Manager and 2026 Guide.

0:44SPEAKER_01:Exactly. And our mission for today's deep dive is to map out the exact blueprint for moving from a technical contributor to a strategic security leader.

0:53SPEAKER_00:Aaron Powell Because it's not a natural jump for a lot of people.

0:56SPEAKER_01:It's really not. So we're cutting through all that generic career advice to find the actual milestones, the methodologies, and most importantly, the specific metrics that matter if you want to sit in that manager's chair.

1:08SPEAKER_00:Aaron Powell And what this document reveals is that the friction between developers who just want to ship code fast and security teams waving red flags.

1:19SPEAKER_01:Aaron Powell The constant battle, yeah.

1:20SPEAKER_00:Yeah, that friction isn't something you can just, you know, code your way out of. It requires a completely different skill set.

1:25SPEAKER_01:Aaron Powell Okay, let's unpack this.

1:27SPEAKER_00:Yeah.

1:27SPEAKER_01:Because the source material claims an app sec manager has to operate in two completely different modes simultaneously.

1:34SPEAKER_00:Aaron Powell They do. It's really the core conflict of the whole role. I mean, first, you have to maintain an incredibly sharp technical edge. Trevor Burrus, Jr.

1:41SPEAKER_01:Right, because you can't be out of touch.

1:42SPEAKER_00:Exactly. You cannot lead a security program effectively if you don't understand the actual ground truth of the code your team is writing.

1:49SPEAKER_01:Makes sense.

1:50SPEAKER_00:But second, and this is the crucial part, you have to be strategically clear enough to sell your security priorities to executive leadership.

1:57SPEAKER_01:Aaron Powell Because you're dealing with what, a CTO or a VP of engineering?

2:01SPEAKER_00:Right. And very often they view AppSec strictly as a bottleneck. To them, it's just something slowing down product delivery and revenue.

2:08SPEAKER_01:Aaron Powell You know, thinking about that dual reality, an analogy comes to mind.

2:12SPEAKER_00:Aaron Powell Oh, that's it.

2:14SPEAKER_01:So if you're an AppSec engineer, you're basically an emergency room doctor.

2:18SPEAKER_00:Aaron Powell Okay. I like where this is going.

2:20SPEAKER_01:Right. A critical vulnerability comes in and your entire focus is purely tactical. You just find the bleed, you stitch it up, and you move to the next patient.

2:29SPEAKER_00:Aaron Powell You're just hyper-focused on the immediate crisis in front of you.

2:32SPEAKER_01:Aaron Powell Exactly. But the app sec manager, they aren't the ER doctor. They're the hospital administrator.

2:38SPEAKER_00:Aaron Powell Well, that's a really great framing. What's fascinating here is if we look at the mechanisms behind that, an administrator doesn't just walk around the ER telling doctors how to hold a scalpel. Trevor Burrus, Jr.

2:49SPEAKER_01:Right. They'd get kicked out of the room.

2:51SPEAKER_00:Exactly. They're building the entire emergency response program. And more importantly, they are proving the return on investment for everything they do.

2:59SPEAKER_01:So it's about the bigger picture.

3:01SPEAKER_00:Trevor Burrus Right. If the hospital administrator wants to buy, say, a$10 million MRI machine, they have to prove to the board that it will reduce patient readmissions by 20%.

3:11SPEAKER_01:Aaron Powell And that translates perfectly to the tech side. The AppSec manager has to prove to the CTO that investing in like secure coding training.

3:21SPEAKER_00:Aaron Powell Or pausing a sprint to fix some architectural flaws.

3:25SPEAKER_01:Right. That doing those things will actually speed up product launch times in the long run.

3:29SPEAKER_00:Aaron Powell Because you're preventing those catastrophic rollbacks later on.

3:33SPEAKER_01:Exactly. They basically have to absorb all that friction between the engineers who need resources and the executive team who just wants to cut costs.

3:41SPEAKER_00:And the source material highlights just how messy that day-to-day reality really is.

3:46SPEAKER_01:Aaron Powell, the daily grind sounds intense.

3:49SPEAKER_00:It is. The text points out that you are constantly triaging these massive vulnerability backlogs. You're running continuous threat modeling sessions.

3:57SPEAKER_01:While also, I imagine, trying not to drive your developers crazy.

4:00SPEAKER_00:Oh, absolutely. You're constantly trying to tune your automated scanners so they don't just overwhelm the devs with false positives.

4:06SPEAKER_01:Because once you lose their trust, it's over.

4:08SPEAKER_00:Exactly. The underlying purpose of the role is managing that specific organizational friction. You have to build a program that catches what actually poses a business risk without slowing the pipeline to a crawl.

4:22SPEAKER_01:Which is, I mean, if you are listening to this right now while staring at a Jira backlog with like 400 unresolved security flags.

4:30SPEAKER_00:Which is a very real scenario for a lot of people.

4:32SPEAKER_01:It really is. But this is exactly why the AppSec Manager role exists. Your job as a manager isn't to manually clear those 400 flags.

4:41SPEAKER_00:No, you'd never sleep.

4:42SPEAKER_01:Right. Your job is to change the culture and the tooling so that 400 flags don't get generated in the next sprint.

4:48SPEAKER_00:Which is a huge structural shift.

4:50SPEAKER_01:It is. And obviously you don't just wake up one day with the ability to manage that kind of complex political and organizational friction.

4:57SPEAKER_00:No, it takes a lot of time.

4:58SPEAKER_01:Yeah. The guide maps out a very specific five to eight year journey to get there.

5:03SPEAKER_00:Aaron Powell And that timeline is critical because it sets realistic expectations, you know, about how long it actually takes to build the technical intuition and the political capital you need to lead.

5:13SPEAKER_01:Aaron Powell Okay. So let's look at the broad strokes before we zoom in. According to the source, years one through three are your foundational years.

5:20SPEAKER_00:Aaron Powell Right. You're a developer or a junior security analyst.

5:24SPEAKER_01:Aaron Ross Powell Yeah, you're just getting your hands dirty with the basics of secure coding, figuring out how the scanners actually function.

5:30SPEAKER_00:Trevor Burrus Building that baseline.

5:32SPEAKER_01:Right. And then jumping ahead to the end, years five through eight, you step into the senior app sec engineer role.

5:39SPEAKER_00:Aaron Powell, which is where you're mentoring junior staff, owning decisions about tool chains, managing vendors, all that high-level stuff.

5:46SPEAKER_01:Aaron Powell But the guide places the most intense focus on the window right in the middle, right? Years three to five.

5:51SPEAKER_00:Yes. The text calls this the security champion or app sec engineer phase. And it explicitly labels it the most critical phase of the entire journey.

6:00SPEAKER_01:Aaron Powell See, I have to push back on this a little bit.

6:02SPEAKER_00:Okay, let's hear it.

6:03SPEAKER_01:Because if I am an incredibly talented coder, let's say I know go and rust inside and out, right?

6:09SPEAKER_00:Aaron Ross Powell A real rock star developer.

6:11SPEAKER_01:Yeah, like I can reverse engineer a complex export in my sleep. Why can't I just bypass this whole champion phase?

6:17SPEAKER_00:It's tempting, I know.

6:19SPEAKER_01:It just feels like why can't I leverage my elite technical skills to jump straight from being a great individual contributor to a senior engineer or manager? It feels like an unnecessary detour to spend two whole years just acting as a liaison. Trevor Burrus, Jr.

6:36SPEAKER_00:Well, it's a very common temptation to try and leapfrog that phase. But the source is adamant that doing so is a massive mistake.

6:44SPEAKER_01:Really a massive mistake.

6:46SPEAKER_00:Oh, absolutely. Let's look at the how and why here. Your technical skills will absolutely get you a seat at the table.

6:52SPEAKER_01:Sure.

6:53SPEAKER_00:But they will not make anyone actually listen to you. In the security champion phase, you are embedded directly inside the development team.

7:00SPEAKER_01:Like you're right there in the trenches with them.

7:02SPEAKER_00:Right. You are sitting in on their sprint planning meetings. This is the exact crucible where you learn the mechanics of influencing without having formal authority.

7:11SPEAKER_01:Because you can't just order them to fix something. You aren't their boss.

7:14SPEAKER_00:Precisely. You learn empathy for the developer's workload. Which is huge. It is. Think about it. If a development team is under immense pressure to ship a feature by Friday, and you find a moderate vulnerability on Thursday, how do you handle it?

7:29SPEAKER_01:I mean, if you demand they stop everything, you instantly become the enemy.

7:33SPEAKER_00:Exactly. You become the guy who broke the launch. The champion phase teaches you how to negotiate that risk.

7:39SPEAKER_01:So what does that negotiation actually look like?

7:41SPEAKER_00:It's learning to say, hey, we can shift this on Friday, but we need to add a web application firewall rule to mitigate the exposure for now. And then we prioritize the actual code fix in Monday's sprint.

7:54SPEAKER_01:Ah, so it's a compromise.

7:56SPEAKER_00:Right. If you skip this phase, you might know exactly how to fix a bug, but you will have zero idea how to convince a stubborn engineering team to collaborate with you.

8:04SPEAKER_01:That makes a lot of sense. It is entirely about learning the human element of security.

8:08SPEAKER_00:Yeah, the soft skills.

8:09SPEAKER_01:And for those who are currently in that one to three year foundational phase and want to, you know, accelerate their progression into this crucial middle stage, the guide outlines a specific training methodology.

8:23SPEAKER_00:Which is really interesting to look at.

8:24SPEAKER_01:Yeah. Practical DevSecOps offers this certified security champion course, the CSC, and it's designed specifically for developers.

8:32SPEAKER_00:It's a great stepping stone.

8:34SPEAKER_01:But what stood out to me isn't the certification itself, but how the training is actually delivered.

8:39SPEAKER_00:It's priced at$599, but And that delivery method is very telling about what the industry actually values right now.

8:45SPEAKER_01:Yeah. It provides 60 days of browser-based lab access and it completely skips multiple choice questions.

8:52SPEAKER_00:Which I love.

8:53SPEAKER_01:Same. It opts instead for over 40 guided hands-on exercises. Like you're working with real tools, burp suite, Ansible, and actually securing CI CD pipelines in a live environment.

9:05SPEAKER_00:And that physical hands-on engagement wires the developer's brain entirely differently than rote memorization.

9:12SPEAKER_01:Definitely. Reading a book isn't the same.

9:14SPEAKER_00:Not at all. Reading a multiple choice question about how a pipeline might be compromised just requires passive recall.

9:20SPEAKER_01:Yeah.

9:21SPEAKER_00:But dropping a student into a live CI CD pipeline and forcing them to figure out how to integrate software composition analysis without breaking the build.

9:29SPEAKER_01:Without making everyone mad, right?

9:31SPEAKER_00:Trevor Burrus Exactly. That simulates the actual friction of the champion role. It forces you to problem solve within the constraints of an active development environment. Trevor Burrus, Jr.

9:40SPEAKER_01:Which perfectly sets you up for the next major hurdle. Because once you've built those communication and problem solving skills as an embedded champion, you have to step up. Right. You eventually have to translate your efforts into a language that the C-suite actually understands.

9:55SPEAKER_00:You have to speak the language of metrics.

9:57SPEAKER_01:The dreaded metrics.

9:58SPEAKER_00:I know, but before we get to the executive level, the guide does list the hard technical skills that hiring managers expect as your baseline in 2026.

10:06SPEAKER_01:Right. The table stakes. They expect deep fluency in SAST, DAST, and threat modeling methodologies. The guide specifically calls out stride and pasta.

10:17SPEAKER_00:Aaron Powell Let's look at how a manager actually uses something like PAST, which stands for the Process for Attack Simulation and Threat Analysis.

10:26SPEAKER_01:It's a great acronym.

10:27SPEAKER_00:It really is. But unlike older models that just list what could go technically wrong, pasta literally starts with the business impact.

10:36SPEAKER_01:Oh, interesting.

10:37SPEAKER_00:Yeah, the very first step is understanding what the application does for the company's bottom line. So when an AppSec manager uses pasta, they aren't just finding a flaw.

10:47SPEAKER_01:They're contextualizing it.

10:49SPEAKER_00:Yes. They're mapping that flaw directly to how it could disrupt revenue or completely tank customer trust.

10:56SPEAKER_01:So they're saying this isn't just a bug, this is a million dollars walking out the door.

11:00SPEAKER_00:Exactly. That is how you translate a technical threat into a business risk for a CTO.

11:05SPEAKER_01:Wow. And looking at this source, the key performance indicators, the KPIs they emphasize, really struck me. It seems like the industry is shifting away from how many bugs did you find to how fast did you clean up the mess.

11:17SPEAKER_00:That's exactly it.

11:18SPEAKER_01:Does that align with how these managers are actually being evaluated by executive leadership today?

11:23SPEAKER_00:It absolutely aligns. The guide explicitly states that owning and improving these specific KPIs is what separates the managers who last in their roles from the ones who, well, get replaced.

11:35SPEAKER_01:Ouch. So what are the exact metrics?

11:45SPEAKER_00:Okay.

11:45SPEAKER_01:MTTR.

11:46SPEAKER_00:Second, the percentage of your applications covered by automated security testing. Third, the rate of developer adoption for secure coding training.

11:54SPEAKER_01:Which goes back to the culture shift.

11:56SPEAKER_00:Right. And fourth, the reduction in repeat vulnerability classes over time.

12:00SPEAKER_01:If we connect this to the bigger picture and break down that mean time to remediate metric, it really reveals the true scope of the job.

12:07SPEAKER_00:It's everything.

12:08SPEAKER_01:Yeah. Because you don't lower the MTTR across a 500-person engineering department by manually fixing the bugs yourself.

12:14SPEAKER_00:No, that's physically impossible.

12:15SPEAKER_01:Aaron Powell Right. You lower it by improving the other three metrics. You increase automated testing coverage so bugs are caught earlier. You increase developer training adoption so they just stop making the same mistakes in the first place.

12:27SPEAKER_00:Which inherently drives down that fourth metric, their repeat vulnerability classes.

12:31SPEAKER_01:Right. It is a completely interconnected ecosystem.

12:34SPEAKER_00:Aaron Ross Powell And proving that you can manipulate that ecosystem is how you prove you can run a program. Which brings us to a really specific warning in the text regarding how you communicate these metrics.

12:46SPEAKER_01:Oh yeah. The communication part is huge.

12:48SPEAKER_00:Beguide explicitly warns that if you try to explain why a finding matters and you sound like a compliance auditor, you will lose the room every single time.

12:58SPEAKER_01:Oh, nobody likes the compliance auditor. They just show up with a clipboard, tell you that you're failing some obscure internal policy, offer zero practical solutions, and just block all your momentum.

13:09SPEAKER_00:It is infuriating for a development team.

13:11SPEAKER_01:Totally infuriating.

13:12SPEAKER_00:Because a compliance auditor focuses entirely on the rule that was broken rather than the reality of the business. Right. An effective app sec manager, on the other hand, acts as a risk negotiator. Trevor Burrus, Jr.

13:22SPEAKER_01:A risk negotiator. I like that.

13:24SPEAKER_00:Yeah. Instead of saying you violated policy 4.2, you say, look, this authentication flaw leaves our user database exposed to a known exploit that's currently circulating in the wild. Setting the stakes. Exactly. If we launch tomorrow and get breached, the regulatory fines and loss of customer trust will wipe out our Q3 profits. Let's implement a temporary compensating control right now, and then schedule the full architectural fix for the next sprint.

13:52SPEAKER_01:You're offering a path forward instead of just building a brick wall.

13:55SPEAKER_00:Precisely.

13:56SPEAKER_01:And that is the ultimate test of everything you learned back in that champion phase.

13:59SPEAKER_00:It all comes together.

14:00SPEAKER_01:All right, so you have your five to eight year timeline mapped out, you know how to negotiate risk, and you fully own your KPIs. But here is where it gets really interesting.

14:10SPEAKER_00:The fun stuff.

14:11SPEAKER_01:The landscape of technology itself is radically shifting. The Source's 2026 course catalog gives us a fascinating look at the emerging threats a future manager absolutely must be prepared for.

14:21SPEAKER_00:And it is heavily, heavily focused on AI.

14:24SPEAKER_01:It is. The guide highlights a course called the Certified AI Security Professional, or CISP. It's$1039, and it goes way beyond the basic web vulnerabilities we're used to.

14:36SPEAKER_00:We're past cross-site scripting here.

14:38SPEAKER_01:Way past it. It covers large language model security, model attacks, and defending against threats mapped by MITRE Atlas.

14:45SPEAKER_00:Now, MITRE Atlas is an incredibly important framework for anyone stepping into this space right now.

14:50SPEAKER_01:Can you break that down a bit?

14:52SPEAKER_00:Sure. It stands for Adversarial Threat Landscape for Artificial Intelligence Systems.

14:56SPEAKER_01:That's a mouthful.

14:57SPEAKER_00:It is, but just like we have frameworks mapping how hackers attack traditional networks, ATLS maps the specific, unique ways adversaries manipulate machine learning models.

15:07SPEAKER_01:That's a whole new playbook.

15:08SPEAKER_00:Exactly.

15:09SPEAKER_01:Yeah.

15:09SPEAKER_00:We are talking about data poisoning, where attackers subtly corrupt the training data so the AI behaves maliciously down the line.

15:15SPEAKER_01:Oh wow.

15:16SPEAKER_00:Or model evasion techniques where they trick the AI into ignoring malicious input.

15:20SPEAKER_01:That is wild. And what really caught my eye in the catalog is this upcoming course, the certified MCP security expert?

15:27SPEAKER_00:Ah yes. The CMCPSC.

15:29SPEAKER_01:Right. It focuses on assessing and hardening MCP servers, defending against tool poisoning, prompt injection, and defending against agentic AI.

15:39SPEAKER_00:There's a lot of jargon in there.

15:40SPEAKER_01:Yeah, we definitely need to unpack some of this because it represents a monumental shift. What exactly is an MCP server and how does tool poisoning actually work in practice?

15:50SPEAKER_00:Okay, so MCP stands for Model Context Protocol. Okay. As AI agents become more autonomous, they need standard ways to connect to data sources and development environments. MCP servers facilitate that connection.

16:03SPEAKER_01:So it's like a bridge.

16:04SPEAKER_00:Exactly. But that bridge creates a massive new attack surface. Let's look at tool poisoning.

16:09SPEAKER_01:Right. How does that work?

16:10SPEAKER_00:Imagine an autonomous AI agent is tasked with reviewing pull requests on GitHub.

16:15SPEAKER_01:Okay. Sounds helpful.

16:16SPEAKER_00:Right. Until an attacker submits a malicious pull request that contains a hidden prompt injection designed specifically to exploit the AI's underlying logic. Oh man. So when the AI agent reads that code, the hidden prompt tricks the AI into using its access tools to execute unauthorized commands on the MCP server.

16:35SPEAKER_01:Aaron Powell Wait, really? Like what kind of commands?

16:37SPEAKER_00:Aaron Powell It could be exfiltrating your proprietary source code or even injecting a backdoor into the system. And the human developer never saw it happen.

16:45SPEAKER_01:Trevor Burrus Because the AI did it.

16:46SPEAKER_00:Aaron Powell Exactly. And traditional AbSec scanners are completely blind to it because it isn't a traditional software bug. It is an attack on the AI's cognitive logic.

16:55SPEAKER_01:Aaron Powell That is genuinely terrifying. We are moving from a world where we just secure code written by humans to securing the autonomous AI agents that are executing tasks and generating code completely on their own.

17:08SPEAKER_00:Aaron Powell It's a completely new frontier.

17:09SPEAKER_01:Trevor Burrus And it's why the guide emphasizes that ambitious professionals need to straddle both traditional DevSecOps and these emerging AI threats. You can't just be an expert in one or the other anymore.

17:20SPEAKER_00:You really can't. And practical DevSecOps actually offers massive bundle savings for this, like saving$299 if you bundled the traditional DevSecOps professional course with the new AI security professional course.

17:33SPEAKER_01:Aaron Powell Which brings up the pragmatic realities of achieving this level of expertise. The guide features an FAQ section addressing what hiring managers actually require for these highly specialized roles.

17:43SPEAKER_00:Aaron Powell, do I need a degree?

17:46SPEAKER_01:Aaron Powell Right. If you're putting in the time to master secure CICD pipelines, pasta threat modeling, mitrey Atlas AI defenses, do you need a formal computer science degree to actually get your foot in the door?

17:59SPEAKER_00:Aaron Powell The industry consensus, as reflected in this 2026 guide, is no.

18:04SPEAKER_01:No degree required.

18:05SPEAKER_00:Aaron Ross Powell I mean, uh a formal degree in computer science or cybersecurity is certainly helpful for building that foundational knowledge, right?

18:11SPEAKER_01:Yeah.

18:11SPEAKER_00:But it is absolutely not a hard barrier to entry anymore. Trevor Burrus, Jr.

18:14SPEAKER_01:Means you're just moving too fast.

18:16SPEAKER_00:Exactly. In a landscape moving this quickly, demonstrated hands-on experience and credible lab-based certifications carry far, far more weight.

18:24SPEAKER_01:Because they show you can actually do the work.

18:26SPEAKER_00:Right. An executive hiring and app sec manager cares much more about whether you have a proven track record of lowering mean time to remediate in a live environment than where you spent four years studying theory.

18:37SPEAKER_01:And honestly, the compensation reflects just how difficult and specialized that skill set is.

18:43SPEAKER_00:It really does.

18:43SPEAKER_01:According to the text, the salary for an application security manager in the United States ranges from$130,000 to$200,000.

18:52SPEAKER_00:And that's just the baseline.

18:53SPEAKER_01:Yeah, it notes that senior roles at large enterprises or within high-stakes environments like fintech companies often exceed that range entirely.

19:02SPEAKER_00:It is a highly compensated position because you are solving one of the most difficult structural problems in modern business. Which is how to allow an organization to move incredibly fast without catastrophically breaking its own infrastructure.

19:15SPEAKER_01:So what does this all mean? If we synthesize everything we've pulled from this 2026 practical DevSecOps guide, the main takeaway is this: becoming an AppSec manager is an intensely deliberate process.

19:27SPEAKER_00:It's not an accident.

19:28SPEAKER_01:No, you do not just wait around, collect random technical certifications, and rely on your tenure to get a promotion.

19:34SPEAKER_00:It is about deliberately building your capacity to run an interconnected program.

19:38SPEAKER_01:Exactly. It's about learning to use frameworks like pasta to translate deeply technical risks into clear, actionable business strategies. It's about understanding how metrics like MTTR actually prove your effectiveness to a CTO. And above all, it's about mastering the art of developer relationships. You have to endure the friction of the security champion phase to learn how to influence people so that when you finally do have the authority to pause a product launch, the engineering team actually trusts your judgment.

20:10SPEAKER_00:Instead of just viewing you as a roadblock.

20:12SPEAKER_01:Exactly.

20:13SPEAKER_00:You know, as we look toward the future of this role, I want to leave you with a thought grounded in the reality of where these metrics are actually heading.

20:19SPEAKER_01:Oh, righty.

20:20SPEAKER_00:We discussed how the course catalog explicitly highlights defending against agentic AI and the rise of autonomous agents generating code.

20:29SPEAKER_01:Yeah.

20:30SPEAKER_00:Historically, the primary friction an app sec manager has had to navigate is human.

20:34SPEAKER_01:Right, convincing a stressed-out human developer to rewrite their code.

20:38SPEAKER_00:But what if the hospital doctors are AI agents writing thousands of lines of code a second? Your traditional metrics are going to fundamentally break.

20:46SPEAKER_01:Oh wow. Yeah, because of the speed.

20:48SPEAKER_00:That is the crucial shift. If an AI agent introduces a vulnerability at machine speed, and your mean time to remediate relies on human intervention to review and approve the fix.

21:00SPEAKER_01:Your MTTR is going to absolutely skyrocket.

21:03SPEAKER_00:Exactly. The friction is no longer human, it is algorithmic. So as a future AppSec manager, will your primary challenge be negotiating risk with a human CTO? Or will it be designing autonomous security policies that can manage, govern, and constrain autonomous AI developers without breaking the build? Wow. It is an entirely new paradigm for security leadership.

21:24SPEAKER_01:That reframes the entire timeline we just discussed. I mean, if the developers are moving at machine speed, the security program has to as well. Well, thank you for joining us on this deep dive. Keep asking those hard questions, keep challenging the mechanisms driving your own career, and keep a close eye on how you manage the friction in your own organization. Whether you are the one finding the vulnerabilities or the one building the program to solve them.

21:46SPEAKER_01:See you next time.