Your AppSec Bottleneck Is a People Problem
Most security champions programs don't fail on tooling — they fail on people. Lisi Hocke spent three years as a champion before moving fully into product…
Listen to the episodeTopic
Building an AppSec Program
Standing up and growing an application security function — maturity models, champions, metrics, and getting the budget.
38 episodes
Marisa Fagan - Measuring Security Culture
Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value.
Listen to the episodeAram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics
A dashboard full of green indicators can still describe an insecure organization. Aram Hovsepyan, founder and CEO of Codific and an OWASP SAMM contributor,…
Listen to the episodeDag Flachet -- Kaizen for your Appsec Program
Dag Flachet joins us to discuss the concept of Kaizen and its application in improving application security.
Listen to the episodeKalyani Pawar -- Shaping AppSec at Startups
Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups.
Listen to the episodeMilan Williams -- AppSec Metrics
Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable.
Listen to the episodeMO Sadek -- Building an AppSec Program from Scratch
Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox.
Listen to the episodeIrfaan Santoe -- The Power of Strategy in AppSec
Irfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security.
Listen to the episodeJahanzeb Farooq -- Launching and executing an AppSec program
Jahanzeb Farooq discusses his journey in cybersecurity and the challenges of building AppSec programs from scratch.
Listen to the episodeDevin Rudnicki -- Expanding AppSec
Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role.
Listen to the episodeDustin Lehr -- Culture Change through Champions and Gamification
Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions.
Listen to the episodeJay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future.
Is application security dead, or does it need to grow into something larger? CoverMyMeds security leaders Jay Bobo and Darylynn Ross challenge the…
Listen to the episodeEitan Worcel -- Is AI a Security Champion?
Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security.
Listen to the episodeRay Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring
What does an application security leader need to know before stepping into the CISO role?
Listen to the episodeJeff Williams -- The Tech of Runtime Security
Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of…
Listen to the episode9 mintranscript
Farshad Abasi -- Three Models for Deploying AppSec Resources
Application security teams rarely have enough specialists to embed one expert with every development team.
Listen to the episodeJeevan Singh -- The Future of Application Security Engineers
Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers.
Listen to the episodeDerek Fisher -- The Application Security Handbook
Derek is the author of “The Application Security Handbook. ” He is a university instructor at Temple University, where he teaches software development security to undergraduate and graduate students.
Listen to the episodeAlex Olsen -- Security champions, empowering developers, and AppSec training
Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department.
Listen to the episodeBrenna Leath -- Product Security Leads: A different way of approaching Security Champions
Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects.
Listen to the episodeTimo Pagel -- DevSecOps Maturity Model
Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer.
Listen to the episode54 mintranscript
James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed
Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E.
Listen to the episodeDustin Lehr -- Advocating and being on the side of developers
Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of…
Listen to the episodeJim Routh — Secure software pipelines
A secure software pipeline is more than a collection of scanners. Jim Routh joins Chris and Robert to explain how organizations can build repeatable…
Listen to the episodeSebastien Deleersnyder and Bart De Win — OWASP SAMM
How does an organization improve software security without reducing maturity to a checklist?
Listen to the episodeMark Merkow — Secure, Resilient, and Agile Software Development
Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO.
Listen to the episode37 mintranscript
Geoff Hill — AppSec, DevSecOps, and Diplomacy
Why can a technically sound DevSecOps initiative fail before it changes how anyone works? Geoff Hill joins Chris and Robert to discuss the diplomacy behind application security transformation.
Listen to the episode31 mintranscript
David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React
Where should a small application security team begin when it cannot do everything? David Kosorok joins Chris and Robert with a practical framework: prevent, detect, and react.
Listen to the episode38 mintranscript
Ronnie Flathers — Security programs big and small
Which parts of an AppSec program should change as a company grows, and which should stay the same?
Listen to the episode45 mintranscript
Brook Schoenfield — Security is a messy problem
Why doesn't an executive mandate and a scanning tool add up to a software security program?
Listen to the episode44 mintranscript
Matt McGrath — Security coaches
Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong.
Listen to the episode32 mintranscript
Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo
Changing security culture requires more than distributing policies or buying another training platform.
Listen to the episode36 mintranscript
Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program
What does a bug bounty look like from both sides of the relationship? Adam Bacchus and Jon Bottarini of HackerOne compare the responsibilities of the…
Listen to the episode29 mintranscript
Conclusion: All the Pieces You Need for an #AppSec Program
Which practices belong in a complete application security program? The Season 3 finale answers by assembling clips that move from early development…
Listen to the episode43 mintranscript
Jim Routh -- Selling #AppSec Up The Chain
What if the strongest argument for funding application security is better software delivery rather than fear of a breach?
Listen to the episode35 mintranscript
Pete Chestna -- SAST, DAST, and IAST. Oh My!
Buying more scanners does not automatically create a better application security program.
Listen to the episode27 mintranscript
Chris and Robert -- Security Champions
What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective.
Listen to the episode22 mintranscript
Matt Clapham -- The Technical Debt Ceiling
Every software organization accumulates technical debt, but security debt raises the cost and risk of every future change.
Listen to the episode