Security & DevEx: Can We Have Both? • Abby Bangser, Adrian Mouat & Holly Cummins • GOTO 2025
In this panel discussion, Holly Cummins, Abby Bangser, and Adrian Mouat explore the inherent conflict between security and developer experience. They argue that traditional security, often driven by fear and restrictive policies, can lead to 'Shadow IT' and greater insecurity. The solution proposed is a platform engineering approach, which centralizes security expertise to provide secure defaults, infrastructure guardrails, and a clear shared responsibility model, thus enabling development teams to deliver value quickly and safely without needing to become security experts themselves.
The relationship between security and developer experience is often fraught with tension. Security is frequently perceived as a discipline rooted in fear and prevention—its ultimate success is when “nothing bad happens,” a thankless and invisible achievement. This contrasts sharply with development, which is focused on creation and delivering value. This fundamental difference in perspective often positions security as a hurdle, leading to friction and inefficiency.
The Pitfalls of Poorly Implemented Security
When security measures are overly restrictive, they can inadvertently create more risk. A common scenario is the emergence of “Shadow IT,” where developers, blocked from using sanctioned tools, find workarounds that bypass security protocols entirely.
“You actually wind up with more insecurity when you lock down to a point where people can’t do their jobs.” - Abby Bangser
This happens when security teams say “no” without providing viable alternatives, forcing developers to resort to insecure practices like sending screenshots of proprietary code through non-corporate channels just to get their work done.
The Burden of “Shifting Left”
While the “shift-left” movement encourages integrating security earlier in the development lifecycle, it has often been misinterpreted as a mandate for every development team to become security experts. This creates a significant cognitive load, especially in a DevOps model where teams are already responsible for the entire software lifecycle. Expecting a developer to be an expert in application logic, infrastructure, operations, and the vast, ever-changing landscape of security is unrealistic and leads to burnout and mistakes.
Platform Engineering: A Path to Reconciliation
Platform engineering offers a more sustainable model by centralizing expertise and providing a foundation of secure defaults. The goal is not to enforce rules from a central ivory tower but to enable development teams by abstracting away complexity.
A well-designed platform can:
- Provide Secure Defaults: Offer pre-configured, secure infrastructure components like S3 buckets with proper access controls and encryption enabled by default. This removes the burden from developers to know and apply these settings correctly every time.
- Automate Security Tooling: Integrate dependency scanning, static analysis, and other security checks directly into the CI/CD pipeline, providing developers with fast feedback within their existing workflows.
- Establish a Clear Shared Responsibility Model: Much like a cloud provider has a shared responsibility model with its customers, a platform team should have one with its internal development teams. The platform team is responsible for the security of the platform (e.g., the underlying infrastructure, networking, base images), while the application team is responsible for the security in the platform (e.g., their application code, data validation, dependency management).
“What platform engineering is trying to do is create contracts that say my stack is shorter, therefore I can be more informed and more effective within that stack.” - Abby Bangser
This model allows security experts to have an outsized impact by embedding their knowledge into the platform, freeing developers to focus on delivering business value.
Key Focus Areas in Modern Security
- Supply Chain Security: The reliance on open-source software is a major area of concern. The current CVE system can be noisy and inefficient, and securing code written by volunteers is a complex, industry-wide challenge. Platform teams can help by providing curated, secure base images and managing a central repository of approved dependencies.
- Corporate AI Usage: The panel warned against outright banning public AI tools like ChatGPT. This policy often fails, as employees will simply use personal accounts, potentially leaking sensitive corporate data for model training. The more secure approach is to provide sanctioned, enterprise-grade AI tools where data privacy is contractually guaranteed.
Ultimately, the conflict between security and developer experience can be resolved. The key is to move away from a model of enforcement and burden-shifting, and towards one of enablement through a centralized, well-architected platform that makes the secure way the easy way.