WhiteHat Security is one of the pioneers in AppSec. As such they were an early advocate for DevSecOps. They have been doing annual surveys of the security and developer space for several years. In this years survey the good news is that we are seeing real progress in DevSecOps adoption by developers and security teams. But all is not roses. Some of the same old issues are still there, including how long it takes us to fix vulnerabilities and security issues.

In this DevOps Chats we speak with Eric Sheridan, Chief Scientist of WhiteHat about the survey results and what they mean. Have a listen to find out Eric's take on the foundings.

Jenkins founder Kohsuke Kawaguchi (KK) and respected DevOps veteran, Harpreet Singh have launched a new company called Launchable https://launchableinc.com

Launchable aims to help you improve your delivery velocity by prioritizing and applying some ML and intelligence to testing. There is still much work to be done but with these two industry luminaries behind it, the expectations are high for something impactful.

The VC community and a blue chip list of investors are already on board.

Yes this means KK is no longer at CloudBees (several CloudBees execs are investors in Launchable)and Jenkins, while he is still an advisory. But with Jenkins now in the capable hands of the CDF and Linux Foundation and CloudBees well established, he felt this was a good time to pursue an issue he thinks needs to be solved.

Hear from KK and Harpreet themselves in this great podcast.

Walkme recently announced a funding round of 90 million dollars bringing their total raise to over $300 million. But according to Rephael Sweary, that is great but the real measure of Walkme's success is their annual reoccurring revenue being over a $100m (which it is) and whether or not that company is helping their customers.

In the case of Walkme, that are business's undergoing digital transformations and are looking to accelerate their digital platform adoption.

Walkme has been a tremendous success no matter what yardstick you use. Listen to Rephael to understand better his view of the world and what is important for the coming times ahead.

DevSecOps has become a real thing over the last few years. The big shift has been making security tools that developers can use. ShiftLeft has been one of the leaders in this movement, recognizing that security had to shift left (hence the name).

I had a chance to sit down right before the holidays with ShiftLeft CEO Manish Gupta about how the shift to developers using security tools is helping to make applications more secure.

Ken Rutsky is on a mission. In addition to being a master cybersecurity marketing ninja, Ken is also the founder of the Cybersecurity Go To Market Dojo. It is the hub of a community of cybersecurity marketers who seek to up their game and bring even more professionalism to cybersec marketing.

Frankly, cybersecurity marketers get a bad wrap. Many of them have great technical chops. Just because they have marketing in their title don't assume they are not technical.

Ken and the group are again putting on a great together on the Sunday of RSAC week. Also they will be doing a Cyber Marketer of the Year awards as well. Alan Shimel is one of the judges. You can find out more at https://www.gotomarketdojo.com/events/rsa2020-marketers-prefresher-happy-hour-the-marketer-of-the-year-awards

The Eclipse Foundation recently launched a new working group for Edge Native (https://edgenative.eclipse.org/). The mission is to deliver open source edge platforms now.

I had a chance to sit down with the guests highlighted below to discuss. Enjoy.

Mike Milinkovich, Executive Director, Eclipse Foundation

Mike serves as the executive editor for the Eclipse Foundation. An influential voice in the open source and Java communities, Mike has worked tirelessly over the last two decades to help establish the open source model for software development. Outside of work, Mike's passions are his family, the family cottage and hockey (as a coach, player and fan) in pretty much that order. When he's not working, or traveling for work, you will probably find him involved in one of those three things.

Kilton Hopkins, CEO and co-founder, Edgeworx

Kilton started programming computers when he was 8 years old. That was 1986. He started a software company a few years later. The world is very different than it was back then, but Kilton is still bringing new tech companies to life.

He currently serves as the Co-Founder and Chief Executive Officer of Edgeworx, which provides the world with an open-source universal edge computing platform called Eclipse ioFog.

Kilton lives in Berkeley, California. He received his MBA from The University of Chicago Booth School of Business in 2010. He likes to meditate, make music, and read about everything scientific.

Sometimes the best way to accomplish something is to choose a path requiring the least friction, or amount of change.

Qualys customers now have that path available to them in bring vulnerability scanning into Google Cloud Platform. Qualys' recent announcement means a one-click configuration change enables vulnerability scans in GCP with the results appearing in both Qualys Cloud Center and GCP Security Command Center.

Join me on this DevOps Chats to explore this announcement with Sumedh Thakar, Qualys President and Chief Product Officer. We discuss Qualys' and Google's collaboration and how this benefits DevOps teams.

The increasing breadth and complexity of the environments we manage are nothing short of breathtaking. Understanding the security risks and applying policies across the cloud, multi-cloud, private clouds, and a plethora of software technologies is a challenge faced by every enterprise.

vArmour recently announced version 5 of the vArmour Application Controller, which opens more significant access to vast amounts of information the Security Graph represents and organizes through its Security Graph and SDK. By streaming cloud, network, and agent information into the Security Graph, enterprises now have a centralized understanding of application relationships across their multi-cloud infrastructure, enabling centralized risk and policy management that is simple, accurate, and secure.

Marc Woolward, vArmour CTO and CISO, and I discuss establishing abd assessing policies becomes more manageable through expanded access to information about software infrastructure, systems, environments across the organization. I hope you'll join Marc and me in this fascinating conversation.

Application security is top of mind now more than ever. For more than a decade, Veracode examined increasing amounts of code as it passes through their source code vulnerability scanning service. During this period, automation is increasingly prevalent, making it easier to run scans more frequently and regularly. But has automation helped?. Is the software we create more secure? We gain key insights about this in Veracode's The State of Software Security Report X (10th edition).

Chris Eng, Chief Research Officer at Veracode, joins us on DevOps Chats. We talk about many insights uncovered in the latest report, such as 50% of applications are accruing security debt over time, the regularity of scanning correlates to vulnerability fix times, and that scanning frequency directly impacts security debt.

There is a wealth of information in the report, and you can get a jump on the key findings on this podcast episode with Chris. Download the full report at https://www.veracode.com/state-of-software-security-report.

Data Privacy is the new front in the compliance wars. For many organizations Data Privacy is a dreaded subject with a maze of governance and compliance issues.

Osano wants to make it easy. Led by serial entrepreneur Arlo Gilbert, it is catching fire as enterprises learn that complying with Data Privacy laws is possible and even affordable.

Have a listen as Arlo and Alan Shimel discuss this important topic.