José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling?
Listen to the episodeTopic
OWASP Top 10
The list that most organisations meet first, how each revision was assembled, and what it is and is not good for.
41 episodes
Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets
GitGuardian found 29 million hard-coded secrets in public GitHub commits in one year—a 34% increase and its largest jump yet. Why is a supposedly simple problem getting worse?
Listen to the episodeSteve Wilson--OpenClaw and Advanced AI Agents
OpenClaw makes always-on personal AI agents feel inevitable—and exposes how poorly prepared most organizations are for their autonomy.
Listen to the episodeAkansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps
APIs power modern applications, yet many AppSec programs still cannot reliably inventory them, model their threats, or enforce authorization.
Listen to the episodeSean Varga -- OWASP Top 10 for AppSec Sales
We’re discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga.
Listen to the episodeHenrik Plate -- OWASP Top 10 Open Source Risks
Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies.
Listen to the episodeAndrew Van Der Stock -- The New OWASP Top Ten
Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode.
Listen to the episodeMark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding
ZAP supports an enormous share of the application security ecosystem, but who pays for the people keeping it reliable?
Listen to the episodeSteve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release
The first OWASP Top 10 for Large Language Model Applications gave developers and security teams a shared threat model for a rapidly changing technology.
Listen to the episodeSteve Wilson -- OWASP Top Ten for LLMs
How do we do security in the world of AI and LLMs? A great place to start is with an OWASP project tasked with creating a standardized guideline for…
Listen to the episodeJet Anderson -- The AppSec Code Doctor
Jet Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines, at speed and scale, without missing a beat.
Listen to the episodeMichael Bargury -- Low Code / No Code Security and an OWASP Top Ten
Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps.
Listen to the episodeMark Curphey -- The future of OWASP
Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight.
Listen to the episodeOmer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks
CI/CD systems hold code, credentials, and production access, yet many organizations still treat them as internal plumbing rather than a critical attack surface.
Listen to the episodeSimon Bennetts -- Using OWASP Zap across an Enterprise
Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix…
Listen to the episodeOWASP Top 10 2021 Peer Review
Chris and Robert conduct a practitioner peer review of the 2021 OWASP Top 10, examining what changed, what moved, and what the new structure communicates to development teams.
Listen to the episodeThinking back, Looking forward - A Balanced Approach to Securing our Software Future
Software security has spent decades alternating between prevention, detection, and response. Kevin Greene joins Chris and Robert to ask what a balanced approach should look like now.
Listen to the episode50 mintranscript
Frank Rietta — The convergence of Ruby on Rails and #AppSec
Ruby on Rails can provide strong security defaults, but a framework cannot make every design decision for its developers.
Listen to the episodeMichael Furman — SameSite Cookies
Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products.
Listen to the episode37 mintranscript
Erez Yalon — The OWASP API Security Project
Why did APIs need a security Top 10 of their own? Erez Yalon joins Chris and Robert to explain the gaps that led to the OWASP API Security project and walk through its original 2019 list.
Listen to the episode25 mintranscript
Simon Bennetts — OWASP ZAP: past, present, and future
How do you make a powerful security testing tool approachable to the developers who need it?
Listen to the episode45 mintranscript
Daniel Miessler -- OWASP IoT Top 10
An IoT product’s attack surface extends well beyond the device in the box. Daniel Miessler explains that broader view while walking Chris and Robert through the 2018 OWASP IoT Top 10.
Listen to the episode32 mintranscript
Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo
Changing security culture requires more than distributing policies or buying another training platform.
Listen to the episode44 mintranscript
Jeff Williams -- The History of OWASP
OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together.
Listen to the episode35 mintranscript
Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec
How can application security become a field where more women enter, contribute, and advance?
Listen to the episode31 mintranscript
Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood
OWASP is widely recognized, but do people understand the community behind its famous Top 10?
Listen to the episode23 mintranscript
Apollo Clark -- Malicious User Stories
How do you turn a security requirement into something a development team can build and test?
Listen to the episode37 mintranscript
David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar
An application can inherit serious vulnerabilities from code its developers never wrote.
Listen to the episode34 mintranscript
Neil Smithline -- OWASP Top 10 #10: Logging
A log file does little good if nobody can use it to detect or investigate an attack.
Listen to the episode25 mintranscript
Katy Anton -- OWASP Top 10 #4 XXE
A feature built into XML processing can become a path to file disclosure, internal requests, or denial of service.
Listen to the episode34 mintranscript
Bill Sempf -- Insecure Deserialization
What happens when data arriving at an application is allowed to recreate objects and trigger unexpected behavior?
Listen to the episode32 mintranscript
Conclusion: OWASP is for everyone
Why does OWASP matter beyond its famous Top 10 list? The Season 2 finale revisits guests who demonstrate the breadth of the foundation’s work.
Listen to the episode23 mintranscript
Tin Zaw -- ModSecurity and #AppSec
A web application firewall can buy time during a vulnerability crisis, but only if somebody understands and maintains its rules.
Listen to the episode20 mintranscript
Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls
Where should the OWASP Proactive Controls go after giving developers a concise defensive counterpart to the Top 10?
Listen to the episode36 mintranscript
Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10
How should the OWASP Top 10 balance data, expert judgment, community feedback, and a format people can actually use?
Listen to the episode45 mintranscript
Jon Mccoy and Jonathan Marcil -- Agile #AppSec
Agile delivery promises fast feedback, but where does application security fit when teams are already moving continuously?
Listen to the episode23 mintranscript
Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing
What can practitioners learn from a new OWASP document, an upcoming conference, and an industry analyst report in one conversation?
Listen to the episode44 mintranscript
Dave Ferguson -- The OWASP Top 10 Proactive Controls
Developers hear plenty about vulnerabilities, but what should they actually build into their applications to prevent them?
Listen to the episode37 mintranscript
Jim Manico -- MORE OWASP!
How can developers turn OWASP’s many projects into practical help with the code they write?
Listen to the episode31 mintranscript
Chris and Robert -- Controversy within the OWASP Top 10 RC
Why did the 2017 OWASP Top 10 release candidate provoke such a strong reaction? Chris and Robert walk through the proposed categories, compare them with…
Listen to the episode31 mintranscript
Chris and Robert -- Introductions and why #AppSec?
In the inaugural episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut introduce themselves, trace the experiences that brought them…
Listen to the episode