Why AI Code Review Will Replace Human Review Faster Than You Think
Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company.
Listen to the episodeTopic
Vulnerabilities and Exploits
Injection, XSS, deserialization and the rest of the catalogue — plus bug bounty, disclosure, and what happens after a report lands.
54 episodes
Vulnerability Jail and the AI-Era AppSec Engineer
Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since.
Listen to the episodeAI Pen Testing Killed Traditional DAST
Is traditional DAST finally dead? James Berthoty came back to settle the argument that his last episode started.
Listen to the episodeIsaac Evans - AppSec in the Age of AI
AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it?
Listen to the episodeJosé Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling?
Listen to the episodeBrad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows
AppSec teams are drowning in repetitive triage while the work that requires judgment keeps piling up.
Listen to the episodeJavan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications
What happens when teams add large language models to real applications and discover that familiar AppSec controls are no longer enough?
Listen to the episodeMilan Williams -- AppSec Metrics
Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable.
Listen to the episodeJeff Williams -- Application Detection & Response (ADR)
Jeff Williams, a renowned pioneer in the field of application security is with us to discuss Application Detection and Response (ADR), detailing its…
Listen to the episodePhillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing
Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking.
Listen to the episodeAndrew Van Der Stock -- The New OWASP Top Ten
Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode.
Listen to the episodeJames Berthoty -- Is DAST Dead? And the future of API security
James Berthoty, a cloud security engineer with a diverse IT background, discusses his journey into application and product security.
Listen to the episodeErik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language
Erik Cabetas joins Robert and Chris for a thought-provoking discussion about modern software security.
Listen to the episodeEitan Worcel -- Is AI a Security Champion?
Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security.
Listen to the episodeDr. Jared Demott -- Cloud Security & Bug Bounty
Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity.
Listen to the episodeVarun Badhwar -- The Developer Productivity Tax
Varun Badhwar is a three-time founder, a luminary in the cyber security industry, and a clear communicator.
Listen to the episodeJeff Williams -- The Tech of Runtime Security
Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of…
Listen to the episodeJB Aviat -- The State of Application Security
What is the state of application security? JB Aviat answered that question by creating the state of application security report based on data from Datadog…
Listen to the episodeZohar Shachar -- Bug Bounty from Both Sides
Zohar Shachar joins us to discuss the bug bounty process from both sides. Zohar has spent time as a bug bounty hunter and shares wisdom on avoiding bug bounty-causing issues for your AppSec posture.
Listen to the episodeJames Mckee -- Developer Security
James Mckee is a developer (MCPDEA) and security advocate (CISSP) whose biggest responsibility is leading developer security practices.
Listen to the episodeMichael Bargury -- Low Code / No Code Security and an OWASP Top Ten
Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps.
Listen to the episodeTiago Mendo -- How to scan at scale with OWASP ZAP
Tiago Mendo is a co-founder and CTO of Probely. He has extensive experience in pentesting applications, training, and providing all-around security consultancy.
Listen to the episodeSam Stepanyan -- OWASP Nettacker Project
Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of IT experience and a background in…
Listen to the episodeBrett Smith -- Security is a Necessary Evil
Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience.
Listen to the episodeMazin Ahmed -- Terraform Security
Mazin Ahmed is a security engineer that specializes in AppSec and offensive security.
Listen to the episodeOWASP Top 10 2021 Peer Review
Chris and Robert conduct a practitioner peer review of the 2021 OWASP Top 10, examining what changed, what moved, and what the new structure communicates to development teams.
Listen to the episodeJC Herz and Steve Springett — SBOMs and software supply chain assurance
Software bills of materials promise visibility into dependencies, but visibility alone does not create assurance.
Listen to the episodeAviat Jean-Baptiste — The AppSec report
Jb Aviat is CTO and co-founder at Sqreen. Prior to this, Jb worked at Apple as a reverse engineer, pentester and developer.
Listen to the episodeCaroline Wong — The state of Penetration Testing
Caroline Wong is the Chief Strategy Officer at Cobalt. io. You cannot hack yourself secure. The challenge is that developers get bored with hacking broken pieces of code after a while.
Listen to the episodeMichael Furman — SameSite Cookies
Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products.
Listen to the episodeElie Saad — OWASP WSTG, Cheat Sheets, and Integration
Elie Saad is an application security engineer, leading three different OWASP projects.
Listen to the episodeZsolt Imre — Fuzz testing is easy
Fuzz testing can sound specialized and difficult, but Zsolt Imre argues that teams can start small and learn quickly.
Listen to the episode41 mintranscript
Jeremy Long — It’s dependency check, not checker
How do you discover vulnerable libraries when the names developers use do not match the names in vulnerability databases?
Listen to the episode37 mintranscript
Erez Yalon — The OWASP API Security Project
Why did APIs need a security Top 10 of their own? Erez Yalon joins Chris and Robert to explain the gaps that led to the OWASP API Security project and walk through its original 2019 list.
Listen to the episode31 mintranscript
David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React
Where should a small application security team begin when it cannot do everything? David Kosorok joins Chris and Robert with a practical framework: prevent, detect, and react.
Listen to the episode44 mintranscript
Bill Wilder -- Running Azure Securely
Moving an application to Azure changes which security controls you operate yourself and which ones the platform can provide.
Listen to the episode30 mintranscript
Jim Manico -- The Extremely Unabridged History of SQLi and XSS
Why are SQL injection and cross-site scripting still with us after years of knowing how to prevent them?
Listen to the episode44 mintranscript
Jeff Williams -- The History of OWASP
OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together.
Listen to the episode37 mintranscript
Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop
Can an intentionally broken online shop help change an organization’s security culture?
Listen to the episode36 mintranscript
Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program
What does a bug bounty look like from both sides of the relationship? Adam Bacchus and Jon Bottarini of HackerOne compare the responsibilities of the…
Listen to the episode27 mintranscript
Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer
Finding vulnerabilities is only part of improving software security; the harder work is changing how people build and operate applications.
Listen to the episode30 mintranscript
Devin McMasters -- Bug Bounty with a Side of Empathy
A bug bounty can create a productive relationship with security researchers—or damage trust on both sides.
Listen to the episode37 mintranscript
David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar
An application can inherit serious vulnerabilities from code its developers never wrote.
Listen to the episode48 mintranscript
Steve Springett -- Dependency Check and Dependency Track
Finding a vulnerable library in one build is only the beginning: how do you find every affected application across an organization?
Listen to the episode35 mintranscript
Pete Chestna -- SAST, DAST, and IAST. Oh My!
Buying more scanners does not automatically create a better application security program.
Listen to the episode34 mintranscript
Bill Sempf -- Insecure Deserialization
What happens when data arriving at an application is allowed to recreate objects and trigger unexpected behavior?
Listen to the episode30 mintranscript
Brian Andrzejewski -- Containers Again
Containers make deployment repeatable, but insecure images, excessive privileges, and unmanaged secrets can travel with them.
Listen to the episode24 mintranscript
Aditya Gupta -- The Exploitation of IoT
Why can an IoT product look secure in one component and still fail as a complete system?
Listen to the episode36 mintranscript
Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10
How should the OWASP Top 10 balance data, expert judgment, community feedback, and a format people can actually use?
Listen to the episode44 mintranscript
Dave Ferguson -- The OWASP Top 10 Proactive Controls
Developers hear plenty about vulnerabilities, but what should they actually build into their applications to prevent them?
Listen to the episode31 mintranscript
Chris and Robert -- Controversy within the OWASP Top 10 RC
Why did the 2017 OWASP Top 10 release candidate provoke such a strong reaction? Chris and Robert walk through the proposed categories, compare them with…
Listen to the episode39 mintranscript
Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore
A useful threat model should explain how an attacker could harm the business, not just complete a checklist.
Listen to the episode37 mintranscript
Mike Landeck -- Security Must Meet the Needs of the Business
Security advice only helps when it connects to the needs of the people building and running the business.
Listen to the episode32 mintranscript
Daniel Ramsbrock -- Web Application Pen Testing – Part 2
Part two follows Daniel Ramsbrock into the practical workflow of a web application penetration test.
Listen to the episode