Sydney AppSec & DevSecOps Summit 2025

APIs are the lifeblood of modern apps, but as they open doors for rapid innovation, they can also leave us wide open to threats. In this session, we’ll jump into why securing APIs is the next big frontier for AppSec and DevSecOps pros, sharing real-world pitfalls and easy wins to help you stay ahead.

• Unpacking why APIs are prime targets and how attackers exploit them
• Building a strong API security framework with robust authentication and monitoring
• Handling the wild west of third-party integrations without compromising security
• Driving a security-first culture that keeps pace with accelerated API development cycles

Even with the best tooling and processes, DevSecOps efforts can stall if teams haven’t bought into a culture of collaboration and shared responsibility. This panel explores how leaders can break down silos, align objectives, and nurture a security-aware mindset across development, operations, and security teams.

• Bridging the cultural divide between legacy security practices and rapid development cycles.
• Encouraging cross-functional collaboration and championing a “one-team” ethos.
• Reinforcing accountability and ownership of security across every stage of the software lifecycle.
• Scaling DevSecOps initiatives through leadership support, continuous learning, and open

‍

An interactive session where attendees collaborate to handle a simulated security breach in a live application, focusing on rapid response and mitigation.

As state governments bring more services online, the risk of breaches and disruptions grows significantly. This demonstration session walks through a realistic scenario of threat modeling in the public sector, showcasing how to reveal vulnerabilities, prioritise mitigation, and maintain public trust in a high-stakes environment.

• Mapping out governmental systems and critical assets to conduct effective threat modeling
• Identifying unique attack vectors that target public services and infrastructure
• Translating threat modeling insights into actionable security tasks that bolster resilience
• Aligning threat modeling outcomes with compliance mandates and citizen trust objectives

‍

Even the most capable developers can fall prey to hidden pitfalls when integrating cryptography into applications. This demo session shines a spotlight on common missteps—from poorly implemented encryption libraries to dangerous key management shortcuts—and illustrates how to prevent these errors in your own code.

• Identifying classic cryptographic mistakes that put data at risk
• Pinpointing faulty assumptions in encryption key management and usage
• Demonstrating real-world consequences of cryptographic misconfigurations
• Sharing proven best practices to embed robust encryption throughout the development cycle

‍

Discussing strategies for integrating security testing and practices early in the development process to prevent vulnerabilities.

Select a topic of discussion and engage in an interactive roundtable discussion with a group of your like-minded peers.

External libraries and frameworks fuel modern application development. Equally, dependencies are a known source of security risk and often leave organisations vulnerable to breaches and compliance issues. Existing software composition analysis tools are stuck in the past. They overwhelm developers with false positives, interrupt their workflows, and otherwise make it difficult to keep up with the codeashians. In this talk, Cole Cornford will cover the latest innovations to reduce this toil and get you and your organisation up to date. Or at least to n-1. Key Takeaways include:

• The existing state of SCA and why we need to change
• How reachability and cross-correlation can reduce toil
• Streamlining the patching process and escaping circular dependencies
• Managing transitive risk with virtual patching
• Risks with adopting innovative tech

‍

Adopting a DevOps mindset often amplifies delivery speed, but it can leave security lagging behind. This session explores how to embed security considerations directly into the DevOps pipeline, balancing rapid iteration with robust protection against emerging threats.

• Integrating security controls from the earliest phases of code and infrastructure design
• Automating checks and tests to maintain security posture at DevOps velocity
• Defining clear accountability where Dev, Ops, and Security teams intersect
• Transforming cultural barriers into collaborative opportunities for holistic, secure releases

‍

A lively debate on the effectiveness of automated security tools versus manual testing methods in ensuring application security.