AI
Why Security Skills Require Investment
Security skills don’t appear on demand. Time, cost, and buy-in are required. Engineers sit on the front lines of secure software, but that knowledge has to be built deliberately. Odumade and Okocha led upskilling efforts across early-stage startups, medium companies, and large enterprises including Accenture, NPR, and Capital One. Their combined experience covers both the failures and the successes of trying to make engineers care about security.
Defining “Secure Enough” Across Company Sizes
Security goals depend on risk tolerance, regulations, and available resources. At small companies, security competes directly with growth, delivery, and sometimes survival. At large enterprises, the pushback comes from current initiatives already in flight, tool sprawl, legacy systems, and hybrid on-prem/cloud environments. Both contexts share a common point: indecision is itself a decision that affects security posture. The goal in both cases is not perfect security but “secure enough” for the organization’s risk profile.
Four Reasons Security Training Fails
Training fails for four reasons: relevance and worth (people think it’s someone else’s job or tools will handle it), alignment and clarity (the why isn’t shared across teams), engagement and delivery (one-size-fits-all approaches produce low retention), and priority and context (training out of sync with current threats or lacking leadership backing). When leadership doesn’t back the training, it’s DOA. When training competes with delivery work and has no protected time, engineers won’t take it.
The SMB Approach: Start Small, Scale With the Org
At a company with fewer than 10 engineers and no dedicated security staff, Odumade ran a phased program built on adult learning principles: relevance, repetition, and reinforcement. The org-wide kickoff framed security as shared responsibility, not just engineering’s problem. Training split into role-specific tracks for product owners, engineering directors, front-end engineers, and cloud engineers. Sessions tied directly to in-flight repos and upcoming tools. Security became part of team rituals rather than a competing priority. A post-launch risk analysis found over 80% of anticipated risks already mitigated.
The Enterprise Approach: Multi-Layer Programs and Measurable Wins
With large distributed teams, legacy systems, and regulatory compliance requirements, Okocha’s enterprise approach layered multiple programs. OWASP Top 10 domain deep dives, role-based secure coding training, and enterprise-wide computer-based training formed the base. Culture-building came through capture-the-flag events, lunch-and-learn sessions, secure coding bootcamps, and security office hours. SAST, DAST, secret scanning, and dependency scanning went into the CI/CD pipeline. Self-service metric dashboards and gamified team leaderboards made progress visible. Early results: a 30% reduction in high-severity incidents and MFA rollout across all new applications.
AI-Generated Code and the Case for Human Oversight
A 2025 Veracode study found that 45% of AI-generated code contained a flaw or bug. Hardcoded secrets were among the specific issues identified. Engineers using AI coding assistants sometimes develop a false sense of security, which has led to data-leak risk from poorly crafted prompts and compliance uncertainty over code licensing. OWASP already runs a dedicated Gen AI security project. Both speakers concluded that AI advances do not remove the need for human security knowledge: someone still has to verify output, fill domain-expertise gaps, and catch what the model misses.
Q&A
What can small organizations do when security tools cost too much? Show the cost of the tool against the cost of not having it; some companies will pay, and those that don’t at least make a conscious decision with full awareness of the implications. ▶ 35:00
How do you get senior leaders to buy into security programs? Metrics and storytelling work best: pure numbers with no agenda, plus context like the statistic that 60% of small companies don’t survive 6 months after a security incident, help push leadership one way or another. ▶ 36:22
With OWASP Top 10, AI risks, and compliance all competing, how do you choose what to train on? At the enterprise level, a centralized security department triages by risk and impact, escalating critical issues like Log4j immediately; at SMBs, using a vendor who tracks current threats and customizing role-specific tracks reduces the burden on whoever is leading security alone. ▶ 39:24
What are the challenges in picking and sustaining the right security metrics? Start from a day-zero baseline, identify your highest-severity vulnerabilities, trace root causes down to the code level (unsecure SQL patterns, outdated libraries), and let that chain define what you measure; the 30% reduction in high-severity incidents came from following exactly that process. ▶ 42:06
Notable Quotes
Bad actors never sleep. Anthony Nduka Okocha · ▶ 5:24
Security is never done. Anthony Nduka Okocha · ▶ 8:32
Consistency beats tools Boomie Odumade · ▶ 31:22
Key Takeaways
- Security training sticks when it connects to real work and has consistent leadership support.
- Role-specific tracks outperform one-size-fits-all programs at both startup and enterprise scale.
- Proactive security costs less than incident response; 80% of risks can be mitigated before release.
About the Speaker(s)
Boomie Odumade is a senior software engineering leader with over 20 years of experience building platforms, scaling teams, and delivering enterprise-grade systems under high-stakes conditions. She has led engineering efforts at organizations including Accenture, NPR, and Capital One, with recent leadership focused on security upskilling at small and medium companies.
Anthony Nduka Okocha is a software engineering manager at Capital One who builds secure, scalable software in the cloud and has championed multiple security education programs for engineers at large enterprises.