Application Security Program Evolution

Netflix is evolving its application security program by refining its organizational structure and investment strategies. The program has moved from a shared on-call model for operational services to a more specialized approach. This includes productizing security for the studio ecosystem, standardizing security baselines, and building self-service capabilities. The team is also investing in dedicated functions for "Appsec Reviews and Assessments" to handle critical services that were previously managed via a shared rotation. This evolution aims to improve consistency, scalability, and provide more context-aware, opinionated automated guidance to engineering teams.