Security that isn't everyone else's problem
The fastest way to make security fail is to make it friction. Here's how I think about building tools developers actually want to use.
- DevSecOps
- Tooling
- Culture
Every engineer has met the security tool that cries wolf — a wall of red, most of it noise, none of it ranked by what would actually hurt. People learn to ignore it. That's not a tooling problem so much as a respect problem.
Good security tooling respects the developer's attention. It earns the right to interrupt.
Signal over volume
A finding is only useful if it answers three questions: is this real, does it matter here, and what do I do about it. Tools that nail those three get acted on. Tools that dump CVEs without context get muted.
AI helps here, not by finding more, but by explaining better — turning a raw alert into a sentence a busy engineer can act on in ten seconds.
Meet people where they work
The best security control is the one nobody has to remember. Push it into the pipeline, the editor, the pull request — the places work already happens — and adoption stops being a battle.
Secure-by-default beats secure-by-discipline every time, because discipline doesn't survive a deadline.