Security work after the slogans.
Relating to DevSecOps treats security as an everyday engineering problem, not a slogan. Ken Toller and Mike McCabe work through budgets, staffing, dashboards, metrics, burnout, and incident response with blunt, grounded discussion.
PRESS PLAY
Relating to DevSecOps is a security and engineering show built around the frictions that appear after the slogans are over. Ken Toller and Mike McCabe talk through DevSecOps as a practical operating problem: how teams plan, measure, staff, budget, detect, respond, and keep people from burning out. The show is especially interested in the gap between what leadership wants to see and what security teams can actually make safer. Dashboards come under pressure. So do one-pane-of-glass platforms, compliance-friendly metrics, end-of-year deadlines, and the habit of buying heavyweight tools before deciding who will use them or what process they serve. Its best material lives in tradeoffs rather than tidy answers. A budget conversation can turn into a question about whether security spend should be hidden inside identity, IT, data, or other categories. A metrics discussion can move from high-risk findings to the neglected lows and mediums that still weaken an environment. A staffing episode can widen into security champions, sales teams carrying the security story, and the danger of making one person feel responsible for an entire company’s security posture. The tone is direct, lightly sarcastic, and conversational. It does not treat fatigue as a side issue; Q4 pressure, PTO planning, and unrealistic end-of-year targets are part of the security system being examined. The show also returns to hands-on AppSec and cloud concerns, including incident response, detection, monitoring, logging, runtime security, static analysis, container tooling, and the operational work required to make any of it useful. Relating to DevSecOps suits discovery because it gives a listener concrete arguments to test against their own organization. It is not polished vendor theater. It is a recurring attempt to separate useful security work from activity that only looks good on a dashboard.
Made for: Suits a listener who works near application security, cloud operations, engineering leadership, or security management and wants practical discussion of organizational tradeoffs. It also fits someone who prefers blunt operational examples over glossy DevSecOps theory.
What sets it apart: The show’s edge is its focus on the awkward middle layer: budgets, staffing, metrics, burnout, dashboards, and tools that may or may not change real security outcomes. It treats DevSecOps as a lived operating problem rather than a finished methodology.
A Podcast dedicated to forging iron clad relationships between developers, engineers, operations, and security practitioners by discussing hot topics in the world of DevSecOps. This podcast aims to air out some of the common gripes, misconceptions, and hardships that these teams face in the real world every day.
A six-month runtime security rollout nobody monitors: Ken Toller and Mike McCabe know why you wince.
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A grounded reminder that Q4 security work needs calendar-aware planning, not heroic endurance.
Q4 lands here as a security workload squeezed by thin calendars, holiday absences, and deadlines that rarely soften just because the team has fewer real workdays.
A clear-eyed leadership conversation about budgets, platform consolidation, and the cost of security findings no one owns.
This PlayNext episode frames security leadership as a discipline of attention. As budgets tighten, teams shift, AI worry builds, and platform dashboards multiply, Ken Toller and Mike McCabe keep returning to the harder question: what actually deserves action?
Power Platform news with practical static.
Relating to DevSecOps Episode #081 centers on Q4 burnout in security, with Mike saying year-end pressure comes from forgotten budgets, fiscal-year closeouts, and holiday PTO.
The hosts discuss vulnerability management and compliance challenges in DevSecOps after returning from security conferences.
Relating to DevSecOps #079 centers on Mike McCabe's argument that CISOs spend too much time on findings, dashboards, and vendor noise instead of root causes.
Relating to DevSecOps examines security budgets as year-end constraints, including the cited 0.7% of revenue industry figure for 2023–2024.
Adding ten security tools to a pipeline can produce a thousand findings and leave developers with unusable security work.
Jeff Bezos argues that teams should trust metrics while testing whether reality matches the dashboard.
This episode discusses incident response, detection, and logging in the context of DevSecOps and application security.