How McDonald’s is transforming application security from a reactive blocker into a proactive enabler — without slowing developers down.
by: Samantha De Mont, Senior Manager Application Security
Quick Bytes:
- Security used to be seen as a blocker — reactive, siloed, and often an afterthought in development
- Embedding security champions and layered tools empowers developers to build secure code from the start
- Security is now a proactive partner, enabling faster releases and a stronger, security-first culture at McDonald’s
When people think of application security, most picture the “bad cop” team; dropping vulnerability reports into developers’ inboxes, slowing releases, and generally makes life harder. At least, that’s the perception.
The reality? Security isn’t the villain — it’s the enabler. When integrated early, it empowers developers to build confidently and securely. But understanding it requires a peek behind the curtain. At McDonald’s, security has evolved significantly, shifting toward a collaborative approach to working with developers, not against them — navigating the nuances to build secure-by-design applications.
From outsourcing to embedding security
In the past, much of our code was developed externally, and performing third-party Application Security Testing was a standard part of that process. When reports landed internally, they were passed from person to person, making it difficult to drive timely fixes because security was still seen as someone else’s job. This decentralized approach sometimes reinforced a perception that security was an afterthought.
Today, we’ve embedded security throughout the product development lifecycle — with the Application Security Champions Program at its core. This program meets developers where they are and empowers them to write secure code at speed.
Shifting left without shifting blame
Early integration into the development cycle revealed a key challenge: developers often didn’t have the resources or guidance at their fingertips to confidently address security issues.
Add to that McDonald’s complex organizational matrix — where multiple teams and systems influence how applications are designed and deployed — and even a small remediation effort became anything but simple.
To better understand the challenges developers faced, the Application Security team invited developers to share their pain points. They highlighted silos, limited access to security upskilling resources, and a lack of guidance. One key takeaway emerged: our solution should empower developers, not assign blame.
Developer-focused, full-coverage security
It became clear that developers needed solutions built for the realities of the McDonald’s organizational matrix.
Modern applications are too intricate for a single tool to catch every vulnerability. So, we built a layered, developer-focused approach to protect code from multiple angles.
Think of it like visiting a doctor. When you have a health concern, doctors rarely rely on a single test. Instead, different specialists run various exams, each providing unique insight into your overall health. One test might reveal something unexpected, and fixing one issue can often improve other areas of your system.
Application security works the same way. Different tools target different layers — code-level flaws, runtime vulnerabilities, insecure dependencies, and misconfigured infrastructure — giving developers a complete view of an application’s “health” and helping them build securely from the inside out.
But coverage alone isn’t enough. Beyond layered checks, our tools work alongside developers providing:
- Integrated development environment (IDE) assistance: Vulnerabilities are detected as code is written in an IDE, with real-time recommendations on how to fix them.
- Auto-fixing of pull requests: Simple misconfigurations can be automatically resolved, reducing manual effort of developers.
- Seamless continuous integration/continuous delivery (CI/CD): Automated security checks are conducted allowing developers to push code confidently and without delays.
- Hands-on security training: Gamified, practical exercises that mirror developers’ day-to-day environments, helping them upskill in secure development and deployment best practices.
By combining layered coverage with these developer-focused enhancements, security becomes practical and proactive — addressing issues without passing the blame or leaving developers to figure everything out on their own.
Security reframed
At the end of the day, security works best as a partner. No one wants to push insecure code or explain to leadership how a breach could have been prevented.
By building a security-first culture at McDonald’s, we aim to adapt to the evolving tech landscape and establish a new normal where secure practices are embedded from the start.
Start with security, end with confidence.
Start with Security, End with Confidence was originally published in McDonald’s Technical Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
We all make mistakes, all the time, every day. Often there aren’t any consequences, or the impact is so minor that we don’t even notice. Perhaps not noticing mistakes is good for our self-confidence and well-being, but it’s also a lost opportunity to learn. 
