Why AI Code Review Will Replace Human Review Faster Than You Think
Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company.
Listen to the episodeTopic
Secure Development
Writing software that resists attack: secure defaults, guardrails, paved roads, code review, and training that developers will sit through.
34 episodes
Vulnerability Jail and the AI-Era AppSec Engineer
Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since.
Listen to the episodeIsaac Evans - AppSec in the Age of AI
AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it?
Listen to the episodeTanya Janca - Secure Vibe Coding
If AI writes all the code and the developer barely reads it, where does AppSec fit?
Listen to the episodeSarah-Jane Madden -- What AI means for AppSec
Sarah-Jane Madden joins Chris and Robert to ask what AI actually changes in software development—and what foundational practices still matter.
Listen to the episodeTanya Janca -- A Secure SDLC from a Developer's Perspective
Security expert Tanya Janca discusses her new book "Alice and Bob Learn Secure Coding" and shares insights on making security accessible to developers.
Listen to the episodeMehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements
Mehran Koushkebaghi, a seasoned engineering expert, delves into the intricacies of systemic security.
Listen to the episodeTanya Janca -- Secure Guardrails
Tanya Janka, also known as SheHacksPurple, discusses secure guardrails, the difference between guardrails and paved roads, and how to implement both in application security.
Listen to the episodeTanya Janca -- What Secure Coding Really Means
Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world.
Listen to the episodeHarshil Parikh -- Deep Environmental and Organizational Context in Application Security
Harshil Parikh is a seasoned security leader with experience building security and compliance functions from the ground up.
Listen to the episodeKim Wuyts -- The Future of Privacy Threat Modeling
Kim Wuyts discusses her work in privacy threat modeling with LINDDUN, a framework inspired by Microsoft's STRIDE for security threat modeling.
Listen to the episodeRobyn Lundin -- Planning & organizing a penetration test as an AppSec team
Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup.
Listen to the episodeChris Romeo -- The Security Journey Story
In this episode of the Application Security Podcast, Chris Romeo walks through the origin story of Security Journey and shares some experiences taking a security startup from bootstrap to acquisition.
Listen to the episodeKen Toler -- Blockchain, Cloud, and #AppSec
Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use.
Listen to the episodeDima Kotik -- Application Security and the Zen of Python
Dima Kotik is an Application Security Engineer at Security Journey and has been programming in Python for years.
Listen to the episodeAaron Rinehart -- Security Chaos Engineering
Aaron Rinehart is expanding the possibilities of chaos engineering to cybersecurity.
Listen to the episodeVandana Verma -- OWASP Spotlight Series
Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series.
Listen to the episodeJim Routh — Secure software pipelines
A secure software pipeline is more than a collection of scanners. Jim Routh joins Chris and Robert to explain how organizations can build repeatable…
Listen to the episodeNeil Matatall — Content Security Policy
Neil Matatall is a product security engineer at GitHub. He focuses on designing and engineering user experiences solutions related to authentication and account recovery.
Listen to the episodeElie Saad — OWASP WSTG, Cheat Sheets, and Integration
Elie Saad is an application security engineer, leading three different OWASP projects.
Listen to the episodeMark Merkow — Secure, Resilient, and Agile Software Development
Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO.
Listen to the episode34 mintranscript
Steve Lipner — The Past, Present, and Future of SDL
How did Microsoft's Security Development Lifecycle become a repeatable engineering practice rather than a one-time security push?
Listen to the episode37 mintranscript
Tommy Ross — The BSA Framework for Secure Software
Software producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product.
Listen to the episode29 mintranscript
Niels Tanis -- A Slice of the Razor with ASP.Net Core
Framework defaults can prevent common vulnerabilities, but developers still need to understand when their code bypasses those protections.
Listen to the episode22 mintranscript
Stephen de Vries -- Threat Modeling with a bit of #Startup
What developers need from a threat model is often a clear set of requirements they can implement.
Listen to the episode25 mintranscript
Sean Wright -- Google Chrome and the Case of the Disappearing HTTP
What changed when Chrome began labeling ordinary HTTP pages as not secure, and why did that decision provoke resistance?
Listen to the episode27 mintranscript
Chris and Robert -- Security Champions
What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective.
Listen to the episode20 mintranscript
Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls
Where should the OWASP Proactive Controls go after giving developers a concise defensive counterpart to the Top 10?
Listen to the episode36 mintranscript
Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10
How should the OWASP Top 10 balance data, expert judgment, community feedback, and a format people can actually use?
Listen to the episode47 mintranscript
Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change
A security awareness program needs to change daily behavior, not simply record who completed a course.
Listen to the episode27 mintranscript
Chris Romeo -- Security Community at Any Scale
How can a company build a security community when it has only a few interested people and little budget?
Listen to the episode48 mintranscript
Matt Clapham -- Development Security Maturity
Can you learn enough about a development team’s security practices in an hour to give it useful direction?
Listen to the episode44 mintranscript
Chris and Robert -- The Activities of the Secure Development Lifecycle
Which activities turn a secure development lifecycle from an aspiration into repeatable work?
Listen to the episode31 mintranscript
Chris and Robert -- Introductions and why #AppSec?
In the inaugural episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut introduce themselves, trace the experiences that brought them…
Listen to the episode