BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsides-bristol-2026//speaker//X73TQ3
BEGIN:VTIMEZONE
TZID:Europe/London
BEGIN:DAYLIGHT
DTSTART:20250822T000000
TZNAME:BST
TZOFFSETFROM:+0100
TZOFFSETTO:+0100
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T020000
RDATE:20261025T020000
TZNAME:GMT
TZOFFSETFROM:+0100
TZOFFSETTO:+0000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T020000
RDATE:20270328T020000
TZNAME:BST
TZOFFSETFROM:+0000
TZOFFSETTO:+0100
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:How Not to Roll Out a Security Tool: A Tale of Broken PRs and Regr
 et - James
DTSTART;TZID=Europe/London:20260822T113000
DTEND;TZID=Europe/London:20260822T115000
DTSTAMP:20260812T225245Z
UID:pretalx-bsides-bristol-2026-VKQ9XB@pretalx.com
DESCRIPTION:In DevSecOps\, we all love a vendor shootout. Which scanner ha
 s the best coverage? Which dashboard is the slickest? Which tool flags the
  most CVEs?\n\nBut the truth is that rolling out a security tool is 20% ge
 tting the invoice paid and 80% communication and desperately trying not to
  break everyone’s builds. Get that 80% wrong\, and you don’t get secur
 ity. You just get developers figuring out how to bypass you.\n\nThis talk 
 is a post-mortem of an easy mistake from early in my career. I dropped a s
 hiny new software composition analysis (SCA) tool straight into our CI/CD 
 pipeline before I’d tuned the noise\, agreed on a rollout model\, or giv
 en developers a sensible way to respond. For a few newer microservices\, i
 t was an inconvenience that could be fixed\, but for our core legacy monol
 ith? It was a self-inflicted denial-of-service on delivery.\n\nPRs backed 
 up. Releases stalled. Trust evaporated\, and security instantly became the
  dreaded “Department of No.” Ultimately\, I had to turn the tool off f
 or the monolith so we could get releases out the door.\n\nThe lesson was b
 rutal but simple: I hadn’t secured the pipeline. I had just trained the 
 engineering team to route around me.\n\nWe’ll break down exactly what we
 nt wrong and how to fix it. We’ll look at how to roll out tooling withou
 t the fallout\, how to separate visibility from enforcement\, and how to i
 ntroduce blocking controls that engineers actually respect.
LOCATION:Rookie Track
URL:https://pretalx.com/bsides-bristol-2026/talk/VKQ9XB/
END:VEVENT
END:VCALENDAR