Abstract
We are on a collision course between speed and compliance. Everything happens faster, and we need to respond imminently to changing technologies and expectations. At the same time regulatory pressure is also increasing, and the requirements, on different continents, are getting more technical. Our GRC discipline was built for classical IT infrastructure and driven by legal experts. Today, in an AI fueled software centric world this paradigm is outdated, and too slow to get us there. Hence the emergence of the PRC, Product Risk and Compliance paradigm. PRC bridges the solid AppSec program directly to compliance requirements, leaving the GRC team offside. GRC is built on three pillars, 1: Product risk assessments with threat modeling 2: supply chain risk management 3: process risk management with maturity models such as OWASP SAMM and DSOMM.
Speaker Bio
Dr. Dag Flachet is a Co-Founder at Codific. He holds a doctorate in organizational psychology and serves as a professor and board member at the Geneva Business School, focusing on leadership and digital transformation. An active, long-time contributor to the OWASP SAMM project, and co-lead of OWASP Barcelona chapter. Dag is passionate about empowering teams to build secure-by-design cultures through continuous improvement.