Scaling Appsec at Netflix (Part 2)

This post details the evolution of Netflix's Appsec program, highlighting the shift from a traditional Appsec function to a model focused on strategic security partnerships and automation. It discusses the development of "Secure by Default" controls, "Security Self-Service" guidance, and "Vulnerability Scanning at scale." The post also addresses challenges such as inconsistency in partnerships, operational churn, and the need for more software engineering talent within the Appsec team. It introduces the new "Appsec Reviews and Assessments" function to address the growing volume and support needs of critical security services.