Informal Security Workshops

Informal security workshops are collaborative, hands-on sessions where developers and security professionals work together to identify, discuss, and address security vulnerabilities in code, systems, or processes. These workshops typically involve activities like code reviews, threat modeling, or penetration testing in a less structured, more interactive format than formal training. They aim to build security awareness, share practical knowledge, and foster a security-first mindset within development teams.

Also known as: Security Workshops, Security Clinics, Security Hackathons, Ad-hoc Security Sessions, Security Brown Bags

Why learn Informal Security Workshops?

Developers should participate in or organize informal security workshops to proactively identify and mitigate security risks early in the development lifecycle, reducing the likelihood of breaches and compliance issues. These workshops are particularly valuable for teams adopting DevSecOps practices, working on sensitive applications (e.g., fintech, healthcare), or seeking to improve their security posture without the overhead of formal certifications. They help bridge the gap between development and security teams, promoting a culture of shared responsibility.

Learning Resources

• docs: OWASP Security Knowledge Framework
• course: SANS Security Awareness Training
• tutorial: DevSecOps Community Workshops
• tutorial: Security Workshop Guide by GitHub
• book: Building Security In: A Workshop Approach (Book)