Your AppSec Bottleneck Is a People Problem
Most security champions programs don't fail on tooling — they fail on people. Lisi Hocke spent three years as a champion before moving fully into product…
Listen to the episodeTopic
Security Culture
Why developers do or do not adopt security — empathy, blamelessness and influence rather than mandates — and looking after the people doing the work, from burnout to neurodiversity.
33 episodes
Marisa Fagan - Measuring Security Culture
Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value.
Listen to the episodeSean Varga -- OWASP Top 10 for AppSec Sales
We’re discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga.
Listen to the episodeKalyani Pawar -- Shaping AppSec at Startups
Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups.
Listen to the episodeDavid Quisenberry -- Building Security, People, and Programs
David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making.
Listen to the episodeDustin Lehr -- Culture Change through Champions and Gamification
Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions.
Listen to the episodeJay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future.
Is application security dead, or does it need to grow into something larger? CoverMyMeds security leaders Jay Bobo and Darylynn Ross challenge the…
Listen to the episodeEitan Worcel -- Is AI a Security Champion?
Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security.
Listen to the episodeRay Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring
What does an application security leader need to know before stepping into the CISO role?
Listen to the episodeOWASP Board of Directors Debate
Six candidates for the 2023 OWASP Board of Directors debate the choices that shape the foundation and its community.
Listen to the episodeHarshil Parikh -- Deep Environmental and Organizational Context in Application Security
Harshil Parikh is a seasoned security leader with experience building security and compliance functions from the ground up.
Listen to the episodeJeevan Singh -- The Future of Application Security Engineers
Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers.
Listen to the episodeAlex Olsen -- Security champions, empowering developers, and AppSec training
Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department.
Listen to the episodeWolfgang Goerlich -- Security beyond vulnerabilities
J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals.
Listen to the episodeBrenna Leath -- Product Security Leads: A different way of approaching Security Champions
Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects.
Listen to the episodeLeif Dreizler -- Tactical tips to shift engineering right
Leif Dreizler is the manager of the Product Security team at Segment. Leif got his start in the security industry at Redspin doing security consulting work and was later an early employee at Bugcrowd.
Listen to the episode44 mintranscript
Chris Romeo — The State of Security and the Importance of Empathy
Network engineers and application security teams depend on each other, yet often struggle to understand each other’s responsibilities.
Listen to the episode29 mintranscript
Vandana Verma — Support each other
Building a stronger security community means helping more kinds of people participate and succeed.
Listen to the episode37 mintranscript
Geoff Hill — AppSec, DevSecOps, and Diplomacy
Why can a technically sound DevSecOps initiative fail before it changes how anyone works? Geoff Hill joins Chris and Robert to discuss the diplomacy behind application security transformation.
Listen to the episode31 mintranscript
David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React
Where should a small application security team begin when it cannot do everything? David Kosorok joins Chris and Robert with a practical framework: prevent, detect, and react.
Listen to the episode38 mintranscript
Ronnie Flathers — Security programs big and small
Which parts of an AppSec program should change as a company grows, and which should stay the same?
Listen to the episode2 mintranscript
Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec
Why should kindness matter in an industry responsible for protecting money, systems, and sometimes lives?
Listen to the episode44 mintranscript
Matt McGrath — Security coaches
Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong.
Listen to the episode41 mintranscript
Caroline Wong — Self-care and self-aware for security people
A successful security career can still become unsustainable when work crowds out everything else.
Listen to the episode25 mintranscript
Jon McCoy — Hacker outreach
How can hackers and corporate security teams work together when each sees the other through a different set of assumptions?
Listen to the episode32 mintranscript
Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo
Changing security culture requires more than distributing policies or buying another training platform.
Listen to the episode30 mintranscript
Devin McMasters -- Bug Bounty with a Side of Empathy
A bug bounty can create a productive relationship with security researchers—or damage trust on both sides.
Listen to the episode18 mintranscript
Megan Roddie -- Neurodiversity in Security
Could familiar hiring and management practices be keeping talented people out of security?
Listen to the episode33 mintranscript
Magen Wu -- Hustle and Flow: Dealing With Burnout in Security
In a profession that rewards constant vigilance, how do you recognize when dedication has become burnout?
Listen to the episode27 mintranscript
Chris and Robert -- Security Champions
What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective.
Listen to the episode37 mintranscript
Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?
What separates a useful security consultant from someone who merely arrives with answers?
Listen to the episode47 mintranscript
Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change
A security awareness program needs to change daily behavior, not simply record who completed a course.
Listen to the episode50 mintranscript
Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL
How do you keep a secure development lifecycle useful as products, teams, and delivery methods change?
Listen to the episode