Topic
GDPR, PCI, SOC 2 and the Cyber Resilience Act, and where regulation and engineering actually meet.
Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents.
Listen to the episodeAI security has no shortage of standards — the problem is turning them into something a team can actually use.
Listen to the episodeThe EU Cyber Resilience Act turns product security from a best practice into a market-access requirement, and its effects extend well beyond Europe.
Listen to the episodeDag Flachet joins us to discuss the concept of Kaizen and its application in improving application security.
Listen to the episodeBrett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development.
Listen to the episodeIrfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security.
Listen to the episodeTanya Janka, also known as SheHacksPurple, discusses secure guardrails, the difference between guardrails and paved roads, and how to implement both in application security.
Listen to the episodeJahanzeb Farooq discusses his journey in cybersecurity and the challenges of building AppSec programs from scratch.
Listen to the episodeDavid Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making.
Listen to the episodeDustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions.
Listen to the episodeJason Nelson, an accomplished expert in information security management, joins Chris to share insights on establishing successful threat modeling programs…
Listen to the episodeErik Cabetas joins Robert and Chris for a thought-provoking discussion about modern software security.
Listen to the episodeJustin Collins of Gusto joins Robert and Chris for a practical conversation about running security teams in an engineering-minded organization.
Listen to the episodeChris Hughes, co-founder of Aquia, joins Chris and Robert on the Application Security Podcast to discuss points from his recent book Software Transparency:…
Listen to the episodeDr. Katarina Koerner, a renowned advisor and community builder with expertise in privacy by design and responsible AI, joins Chris and Robert to delve into…
Listen to the episodeChris John Riley joins Chris and Robert to discuss the Minimum Viable Secure Product. MVSP is a minimalistic security checklist for B2B software and business process outsourcing suppliers.
Listen to the episodeKim Wuyts discusses her work in privacy threat modeling with LINDDUN, a framework inspired by Microsoft's STRIDE for security threat modeling.
Listen to the episodeWhat is zero trust, and how does it impact the world of applications and application security?
Listen to the episodeRob van der Veer has a 30-year background in software engineering, building AI businesses, creating software, and assessing software.
Listen to the episodeJ. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals.
Listen to the episodeCan machines make threat modeling faster without stripping away the judgment that makes it useful?
Listen to the episodeAlex Mor is a passionate cybersecurity defender or breaker depending on the time of day, providing expert technical guidance to product teams and building security in their platforms.
Listen to the episodeKen Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use.
Listen to the episodeInfrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application.
Listen to the episodeAdding encryption is easy; designing a system that protects keys, metadata, and users is much harder.
Listen to the episodeMark Loveless - aka Simple Nomad - is a security researcher and hacker. He's spoken at numerous security and hacker conferences worldwide, including Blackhat, DEF CON, ShmooCon, and RSA.
Listen to the episodeBrian Reed is Chief Mobility Officer at NowSecure. Brian has over 30 years in tech and 15 years in mobile, security, and apps dating back to the birth of…
Listen to the episodeWhich ideas from Season 7 deserve another listen? Chris and Robert assemble clips from across the season, creating a fast tour through secure development…
Listen to the episodeRuby on Rails can provide strong security defaults, but a framework cannot make every design decision for its developers.
Listen to the episodeAaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet.
Listen to the episodeSeason six closes by revisiting five conversations that capture the breadth of application security.
Listen to the episodeA system can protect data from attackers and still violate the privacy of the people using it.
Listen to the episodeHow do you discover vulnerable libraries when the names developers use do not match the names in vulnerability databases?
Listen to the episodeWhat changes when security becomes part of delivering software instead of a separate gate?
Listen to the episodeWhat happens when a threat model has to account for patient privacy and clinical harm as well as attackers?
Listen to the episodeIs becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader.
Listen to the episodeSoftware producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product.
Listen to the episodeHow do you know a security control will work when the system around it fails? Aaron Rinehart introduces chaos engineering as a way to test assumptions about…
Listen to the episodePassword advice changes as attackers, hardware, and identity standards evolve. Chris and Robert examine how passwords are guessed, cracked, stored, and…
Listen to the episodeA useful threat model should explain how an attacker could harm the business, not just complete a checklist.
Listen to the episodePart two follows Daniel Ramsbrock into the practical workflow of a web application penetration test.
Listen to the episodeProtecting data from attackers does not answer every question about privacy. Elena Elkina joins Chris and Robert to explain the relationship between…
Listen to the episode