This presentation will share stories I have experienced other the past 12 years in web application security. What works, what doesn't and what the best companies are doing today. You will leave with a deep understanding of the problem, how we got here, and what you can do at your organization to secure your growing web application footprint.