Rippling CISO on Building Security into Product Development

Are you ready to transform security from a roadblock to a strategic advantage? In this podcast hosted by Cassio Sampaio, Rippling Chief Information Security Officer Duncan Godfrey will be speaking on building secure products in the B2B SaaS world. Duncan shares insider insights on building security into product development, managing vulnerabilities, and creating a collaborative partnership between product and security teams that accelerates innovation without compromising protection.

Subscribe to the Product Talk podcast on Spotify and Apple Podcasts and catch every conversation with leading product executives.

---

---

LISTEN ON ITUNES

---

LISTEN ON SPOTIFY

---

---

Show Notes

1. Security is a business enabler, not just a cost center
2. Embed security engineers directly into product teams for deeper collaboration
3. “Shift left” by considering security risks early in the development process
4. Threat modeling is crucial for identifying potential security vulnerabilities
5. Bug bounty programs provide an essential external security testing mechanism
6. Not all vulnerabilities can be reduced to zero – prioritization is key
7. Establish clear SLAs for addressing different severity levels of security issues
8. Compliance should be addressed early, not as an afterthought
9. Automated compliance tools are making regulatory requirements more manageable
10. AI presents both opportunities and challenges for cybersecurity
11. Security teams should be partners, not gatekeepers, to product development
12. Critical (P0) vulnerabilities must be addressed immediately
13. Technical product managers can and should challenge security assessments
14. Building security into product culture is as important as technical controls
15. Cloud migration and AI are transforming how security is approached
16. Contractual data agreements are crucial when using AI tools
17. Security credentials (like SOC 2) can be a competitive advantage
18. Product managers should expect clear, consistent security policies
19. Collaboration between security and product teams requires mutual respect
20. The next generation of workforce will need to embrace AI-augmented tools