Beyond Scrum: Evolving Engineering practices for the Security Industry

No ratings

Presented at Elbsides 2025 by

Martina Kohn

Agility isn’t optional in cybersecurity. Engineering teams have to respond to emerging threats, shifting requirements, and constant technical change — often all at once. Many turn to Scrum to manage the chaos, drawn by its promise of speed, predictability, and team cohesion. But over time, that promise can wear thin: Teams suffer meeting overload, sprint fatigue, and a persistent tug-of-war between urgent fixes and long-term investment. At Graylog, we’re experimented with something different: Shape Up, a cycle-based framework designed to give teams high autonomy in a healthier cadence and with clearer boundaries. It’s not a cure-all, but it’s helped us rethink ownership, improve planning, and better balance new feature work with technical debt. This talk is part story, part strategy, and part invitation. I’ll give a quick method overview and share what’s worked (and what hasn’t) - depending on the team, the org and the context. Most importantly, I hope to kick off a conversation around how we structure technical work when the stakes are high, the timelines are short, and the backlog seems bottomless.