Isaac Evans - AppSec in the Age of AI
AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it?
Listen to the episodeTopic
Software Supply Chain
Dependencies, SBOMs, provenance and the long tail of open source that ships inside everything.
59 episodes
José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling?
Listen to the episodeOWASP Candidate Debate - 2025 Edition
What should OWASP become, and which leaders have a credible plan to get it there? In this special 2025 Board of Directors candidate debate, nine candidates…
Listen to the episodeGetting Ready for the EU CRA
The EU Cyber Resilience Act turns product security from a best practice into a market-access requirement, and its effects extend well beyond Europe.
Listen to the episodeHenrik Plate -- OWASP Top 10 Open Source Risks
Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies.
Listen to the episodeFrançois Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages
François Proulx shares his discovery of security vulnerabilities in build pipelines. Francois has found that attackers can exploit this often overlooked side of the software supply chain.
Listen to the episodeSteve Springett -- Software and System Transparency
Steve Springett, an expert in secure software development and a key figure in several OWASP projects is back. Steve unpacks CycloneDX and the value proposition of various BOMs.
Listen to the episodeMatt Rose -- Software Supply Chain Security Means Many Different Things to Different People
Matt Rose, an experienced technical AppSec testing leader discusses his career journey and significant contributions in AppSec.
Listen to the episodeJames Berthoty -- Is DAST Dead? And the future of API security
James Berthoty, a cloud security engineer with a diverse IT background, discusses his journey into application and product security.
Listen to the episodeMark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding
ZAP supports an enormous share of the application security ecosystem, but who pays for the people keeping it reliable?
Listen to the episodeKyle Kelly -- The Dumpster Fire of Software Supply Chain Security
Kyle Kelly joins Chris to explore the wild west of software supply chain security.
Listen to the episodeChris Hughes -- Software Transparency
Chris Hughes, co-founder of Aquia, joins Chris and Robert on the Application Security Podcast to discuss points from his recent book Software Transparency:…
Listen to the episodeChris John Riley -- MVSP: Minimum Viable Secure Product
Chris John Riley joins Chris and Robert to discuss the Minimum Viable Secure Product. MVSP is a minimalistic security checklist for B2B software and business process outsourcing suppliers.
Listen to the episodeSteve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release
The first OWASP Top 10 for Large Language Model Applications gave developers and security teams a shared threat model for a rapidly changing technology.
Listen to the episodeHasan Yasar -- Actionable SBOM via DevSecOps
Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively.
Listen to the episodeVarun Badhwar -- The Developer Productivity Tax
Varun Badhwar is a three-time founder, a luminary in the cyber security industry, and a clear communicator.
Listen to the episodeMark Curphey and John Viega -- Chalk
Development, operations, and security teams generate oceans of data yet still struggle to answer basic questions about what code is running, who owns it, and which findings matter.
Listen to the episodeKevin Johnson -- Samurai Swords and Zap's Departure
Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date.
Listen to the episodeSteve Giguere -- Cloud AppSec
Cloud security is on an evolutionary path, with newer platforms embracing secure-by-default settings.
Listen to the episodePaul McCarty -- The Burrito Analogy of the Software Supply Chain
"Visualizing the Software Supply Chain" is a project which aims to kick off a discussion about the scope and breadth of the software supply chain.
Listen to the episodeFrançois Proulx -- Actionable Software Supply Chain Security
Software supply chain -- how deep does the problem go? François is here to help us realize how deep the rabbit hole of the supply chain is and enlighten us with strategies to get out of the hole.
Listen to the episodeJB Aviat -- The State of Application Security
What is the state of application security? JB Aviat answered that question by creating the state of application security report based on data from Datadog…
Listen to the episodeTony Turner -- Threat Modeling and SBOM
Have you ever considered using an SBOM to inform your threat modeling? Tony Turner has. Tony joins us to discuss SBOMs, threat modeling, and the importance of Cyber Informed Engineering.
Listen to the episodeDerek Fisher -- The Application Security Handbook
Derek is the author of “The Application Security Handbook. ” He is a university instructor at Temple University, where he teaches software development security to undergraduate and graduate students.
Listen to the episodeMark Curphey -- The future of OWASP
Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight.
Listen to the episodeGuy Barhart-Magen -- Log4j and Incident Response
With nearly 25 years of experience in the cyber-security industry, Guy held various positions in both corporates and startups.
Listen to the episodeBrett Smith -- Security is a Necessary Evil
Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience.
Listen to the episodePatrick Dwyer -- CycloneDX and SBOMs
Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project.
Listen to the episodeOmer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks
CI/CD systems hold code, credentials, and production access, yet many organizations still treat them as internal plumbing rather than a critical attack surface.
Listen to the episodeAlex Mor -- Application Risk Profiling at Scale
Alex Mor is a passionate cybersecurity defender or breaker depending on the time of day, providing expert technical guidance to product teams and building security in their platforms.
Listen to the episodeWill Ratner -- Centralized container scanning
Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries…
Listen to the episodeKen Toler -- Blockchain, Cloud, and #AppSec
Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use.
Listen to the episode36 mintranscript
Ochaun Marshall -- IaC and SAST
Infrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application.
Listen to the episodeJeroen Willemsen -- Security automation with ci/cd
Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security.
Listen to the episodeThinking back, Looking forward - A Balanced Approach to Securing our Software Future
Software security has spent decades alternating between prevention, detection, and response. Kevin Greene joins Chris and Robert to ask what a balanced approach should look like now.
Listen to the episodeVandana Verma -- OWASP Spotlight Series
Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series.
Listen to the episodeDr. Anita D’Amico -- Do certain types of developers or teams write more secure code?
Dr. Anita D’Amico is the CEO of Code Dx, which provides Application Security Orchestration and Correlation solutions to industry and government.
Listen to the episode42 mintranscript
Liran Tal — Cloud native application security, what’s a developer to do?
Cloud-native development gives engineers control over more of the stack, but it also gives them more security decisions to get wrong.
Listen to the episodeJC Herz and Steve Springett — SBOMs and software supply chain assurance
Software bills of materials promise visibility into dependencies, but visibility alone does not create assurance.
Listen to the episode50 mintranscript
Frank Rietta — The convergence of Ruby on Rails and #AppSec
Ruby on Rails can provide strong security defaults, but a framework cannot make every design decision for its developers.
Listen to the episodeAaron Davis — LavaMoat — solving JavaScript software supply chain
Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet.
Listen to the episodeDrew Dennison – Security should make the computer sweat more
Drew Dennison is the CTO & co-founder of r2c, a startup working to profoundly improve software security and reliability to safeguard human progress.
Listen to the episode41 mintranscript
Jeremy Long — It’s dependency check, not checker
How do you discover vulnerable libraries when the names developers use do not match the names in vulnerability databases?
Listen to the episode36 mintranscript
Niels Tanis — 3rd Party Risk in a .NET World
How much behavior do you inherit when you add one library to a .NET application? Niels Tanis joins Chris and Robert to examine third-party risk beyond checking a dependency for known vulnerabilities.
Listen to the episode34 mintranscript
Maya Kaczorowski — Container and Orchestration Security
Containers can improve your security story, but not simply because they are called containers.
Listen to the episode38 mintranscript
Season 5 Finale — A cross section of #AppSec
Season 5 covered application security from tools and threat models to mentoring, self-care, coaching, dependency risk, and program design.
Listen to the episode34 mintranscript
Liran Tal — The state of open source software security
Developers may want to own security, but what helps them turn that intention into safer software? Liran Tal joins Chris and Robert to examine Snyk's 2019 State of Open Source Security research.
Listen to the episode3 mintranscript
Liran Tal — Open Source Security — 5 Minute AppSec
Why should developers care about open source security when they already have features, testing, accessibility, and performance to manage?
Listen to the episode51 mintranscript
Steve Springett — An insiders checklist for Software Composition Analysis
An SCA tool can find vulnerable libraries and still leave important software supply-chain questions unanswered.
Listen to the episode5 mintranscript
Steve Springett — OWASP Dependency Track — 5 Minute AppSec
What does OWASP Dependency-Track add beyond a conventional software composition analysis scanner?
Listen to the episode37 mintranscript
Tommy Ross — The BSA Framework for Secure Software
Software producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product.
Listen to the episode44 mintranscript
Jeff Williams -- The History of OWASP
OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together.
Listen to the episode31 mintranscript
Erlend Oftedal -- What You Require, You Must Also Retire
A JavaScript library can keep working long after its security problems become public.
Listen to the episode29 mintranscript
Conclusion: All the Pieces You Need for an #AppSec Program
Which practices belong in a complete application security program? The Season 3 finale answers by assembling clips that move from early development…
Listen to the episode37 mintranscript
David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar
An application can inherit serious vulnerabilities from code its developers never wrote.
Listen to the episode48 mintranscript
Steve Springett -- Dependency Check and Dependency Track
Finding a vulnerable library in one build is only the beginning: how do you find every affected application across an organization?
Listen to the episode30 mintranscript
Brian Andrzejewski -- Containers Again
Containers make deployment repeatable, but insecure images, excessive privileges, and unmanaged secrets can travel with them.
Listen to the episode45 mintranscript
Jay Beale -- Docker Security and AppSec
Does moving an application into Docker make it safer, or simply change the risks you need to manage?
Listen to the episode22 mintranscript
Matt Clapham -- The Technical Debt Ceiling
Every software organization accumulates technical debt, but security debt raises the cost and risk of every future change.
Listen to the episode