In a technology organisation of over 2,500 engineers across 200+ teams, building cloud-native, mobile, and embedded systems under external scrutiny (SOC 2, NIS2), we set out to create an Application Security function (sometimes named Product Security) that could scale without becoming a bottleneck, alongside an existing InfoSec capability.

This talk shares how we designed AppSec so that teams own the security of their applications, while a central team provides guidance, tooling, and enablement. It covers hiring for both technical skills and empathy, navigating funding challenges, and embedding security into delivery without slowing it down.

We will explore practical elements such as integrating dependency scanning into developer workflows; introducing threat modelling into standard development practices; and managing incidents, penetration testing, and bug bounty programmes. We also built a Security Champions community through training and hands-on initiatives.

Finally, we'll discuss the implications of the introduction of generative AI to the SDLC activities.

A central theme is culture: building trust with engineers and leadership, working collaboratively, and avoiding isolation. This experience offers insights for organisations looking to evolve Application Security as a shared, scalable responsibility in modern software development.