Dan Lorenc

Software has three speeds: how fast problems get found, how fast they get fixed, and how often you can ship. Nobody owns all three. Finders, maintainers, vendors, and operators are each sewn into the same chain, upstream of some and downstream of others, and they’re reaching machine speed at different times. Finding got there first. Fixing is close behind. Shipping is set by your tests and your change control, and it isn’t moving. Whoever falls behind the stage in front of them becomes the bottleneck, and everything piles up on them.

This talk looks at where that pile lands, at two scales, from both the development and security sides. At the macro scale, security breaks in the slow middle: upstream patching at a crawl has quietly protected everyone downstream, and that dam is going. Development breaks the other way: migration costs have collapsed, and the teams that can’t absorb constant small breaking changes stall while their neighbors sprint. At the micro scale, security breaks at the design of a single component, and development breaks at a single migration, where compatibility now means whether an agent can make the change cheaply.