About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.
…
continue reading
Applicationsecurityweekly Podcasts
About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.
…
continue reading
1
How Product-Led Security Leads to Paved Roads - Julia Knecht - ASW #341
1:04:11
1:04:11
Play later
Play later
Lists
Like
Liked
1:04:11
A successful strategy in appsec is to build platforms with defaults and designs that ease the burden of security choices for developers. But there's an important difference between expecting (or requiring!) developers to use a platform and building a platform that developers embrace. Julia Knecht shares her experience in building platforms with an …
…
continue reading
1
How Product-Led Security Leads to Paved Roads - Julia Knecht - ASW #341
1:04:11
1:04:11
Play later
Play later
Lists
Like
Liked
1:04:11
A successful strategy in appsec is to build platforms with defaults and designs that ease the burden of security choices for developers. But there's an important difference between expecting (or requiring!) developers to use a platform and building a platform that developers embrace. Julia Knecht shares her experience in building platforms with an …
…
continue reading
1
Rise of Compromised LLMs - Sohrob Kazerounian - ASW #340
1:06:35
1:06:35
Play later
Play later
Lists
Like
Liked
1:06:35
AI is more than LLMs. Machine learning algorithms have been part of infosec solutions for a long time. For appsec practitioners, a key concern is always going to be how to evaluate the security of software or a system. In some cases, it doesn't matter if a human or an LLM generated code -- the code needs to be reviewed for common flaws and design p…
…
continue reading
1
Rise of Compromised LLMs - Sohrob Kazerounian - ASW #340
1:06:35
1:06:35
Play later
Play later
Lists
Like
Liked
1:06:35
AI is more than LLMs. Machine learning algorithms have been part of infosec solutions for a long time. For appsec practitioners, a key concern is always going to be how to evaluate the security of software or a system. In some cases, it doesn't matter if a human or an LLM generated code -- the code needs to be reviewed for common flaws and design p…
…
continue reading
1
Getting Started with Security Basics on the Way to Finding a Specialization - ASW #339
1:07:50
1:07:50
Play later
Play later
Lists
Like
Liked
1:07:50
What are some appsec basics? There's no monolithic appsec role. Broadly speaking, appsec tends to branch into engineering or compliance paths, each with different areas of focus despite having shared vocabularies and the (hopefully!) shared goal of protecting software, data, and users. The better question is, "What do you want to secure?" We discus…
…
continue reading
1
Getting Started with Security Basics on the Way to Finding a Specialization - ASW #339
1:07:50
1:07:50
Play later
Play later
Lists
Like
Liked
1:07:50
What are some appsec basics? There's no monolithic appsec role. Broadly speaking, appsec tends to branch into engineering or compliance paths, each with different areas of focus despite having shared vocabularies and the (hopefully!) shared goal of protecting software, data, and users. The better question is, "What do you want to secure?" We discus…
…
continue reading
1
Checking in on the State of Appsec in 2025 - Sandy Carielli, Janet Worthington - ASW #338
1:07:15
1:07:15
Play later
Play later
Lists
Like
Liked
1:07:15
Appsec still deals with ancient vulns like SQL injection and XSS. And now LLMs are generating code along side humans. Sandy Carielli and Janet Worthington join us once again to discuss what all this new code means for appsec practices. On a positive note, the prevalence of those ancient vulns seems to be diminishing, but the rising use of LLMs is e…
…
continue reading
1
Checking in on the State of Appsec in 2025 - Janet Worthington, Sandy Carielli - ASW #338
1:07:15
1:07:15
Play later
Play later
Lists
Like
Liked
1:07:15
Appsec still deals with ancient vulns like SQL injection and XSS. And now LLMs are generating code along side humans. Sandy Carielli and Janet Worthington join us once again to discuss what all this new code means for appsec practices. On a positive note, the prevalence of those ancient vulns seems to be diminishing, but the rising use of LLMs is e…
…
continue reading
1
Simple Patterns for Complex Secure Code Reviews - Louis Nyffenegger - ASW #337
38:26
38:26
Play later
Play later
Lists
Like
Liked
38:26
Manual secure code reviews can be tedious and time intensive if you're just going through checklists. There's plenty of room for linters and compilers and all the grep-like tools to find flaws. Louis Nyffenegger describes the steps of a successful code review process. It's a process that starts with understanding code, which can even benefit from a…
…
continue reading
1
Simple Patterns for Complex Secure Code Reviews - Louis Nyffenegger - ASW #337
38:26
38:26
Play later
Play later
Lists
Like
Liked
38:26
Manual secure code reviews can be tedious and time intensive if you're just going through checklists. There's plenty of room for linters and compilers and all the grep-like tools to find flaws. Louis Nyffenegger describes the steps of a successful code review process. It's a process that starts with understanding code, which can even benefit from a…
…
continue reading
1
How Fuzzing Barcodes Raises the Bar for Secure Code - Artur Cygan - ASW #336
1:01:18
1:01:18
Play later
Play later
Lists
Like
Liked
1:01:18
Fuzzing has been one of the most successful ways to improve software quality. And it demonstrates how improving software quality improves security. Artur Cygan shares his experience in building and applying fuzzers to barcode scanners, smart contracts, and just about any code you can imagine. We go through the useful relationship between unit tests…
…
continue reading
1
How Fuzzing Barcodes Raises the Bar for Secure Code - Artur Cygan - ASW #336
1:01:18
1:01:18
Play later
Play later
Lists
Like
Liked
1:01:18
Fuzzing has been one of the most successful ways to improve software quality. And it demonstrates how improving software quality improves security. Artur Cygan shares his experience in building and applying fuzzers to barcode scanners, smart contracts, and just about any code you can imagine. We go through the useful relationship between unit tests…
…
continue reading
1
Threat Modeling With Good Questions and Without Checklists - Farshad Abasi - ASW #335
1:08:00
1:08:00
Play later
Play later
Lists
Like
Liked
1:08:00
What makes a threat modeling process effective? Do you need a long list of threat actors? Do you need a long list of terms? What about a short list like STRIDE? Has an effective process ever come out of a list? Farshad Abasi joins our discussion as we explain why the answer to most of those questions is No and describe the kinds of approaches that …
…
continue reading
1
Threat Modeling With Good Questions and Without Checklists - Farshad Abasi - ASW #335
1:08:00
1:08:00
Play later
Play later
Lists
Like
Liked
1:08:00
What makes a threat modeling process effective? Do you need a long list of threat actors? Do you need a long list of terms? What about a short list like STRIDE? Has an effective process ever come out of a list? Farshad Abasi joins our discussion as we explain why the answer to most of those questions is No and describe the kinds of approaches that …
…
continue reading
1
Bringing CISA's Secure by Design Principles to OT Systems - Matthew Rogers - ASW #334
1:09:09
1:09:09
Play later
Play later
Lists
Like
Liked
1:09:09
CISA has been championing Secure by Design principles. Many of the principles are universal, like adopting MFA and having opinionated defaults that reduce the need for hardening guides. Matthew Rogers talks about how the approach to Secure by Design has to be tailored for Operational Technology (OT) systems. These systems have strict requirements o…
…
continue reading
1
Bringing CISA's Secure by Design Principles to OT Systems - Matthew Rogers - ASW #334
1:09:09
1:09:09
Play later
Play later
Lists
Like
Liked
1:09:09
CISA has been championing Secure by Design principles. Many of the principles are universal, like adopting MFA and having opinionated defaults that reduce the need for hardening guides. Matthew Rogers talks about how the approach to Secure by Design has to be tailored for Operational Technology (OT) systems. These systems have strict requirements o…
…
continue reading
1
AIs, MCPs, and the Acutal Work that LLMs Are Generating - ASW #333
39:06
39:06
Play later
Play later
Lists
Like
Liked
39:06
The recent popularity of MCPs is surpassed only by the recent examples deficiencies of their secure design. The most obvious challenge is how MCPs, and many more general LLM use cases, have erased two decades of security principles behind separating code and data. We take a look at how developers are using LLMs to generate code and continue our sea…
…
continue reading
1
AIs, MCPs, and the Acutal Work that LLMs Are Generating - ASW #333
39:06
39:06
Play later
Play later
Lists
Like
Liked
39:06
The recent popularity of MCPs is surpassed only by the recent examples deficiencies of their secure design. The most obvious challenge is how MCPs, and many more general LLM use cases, have erased two decades of security principles behind separating code and data. We take a look at how developers are using LLMs to generate code and continue our sea…
…
continue reading
1
AI in AppSec: Agentic Tools, Vibe Coding Risks & Securing Non-Human Identities - Mo Aboul-Magd, Brian Fox, Mark Lambert, Shahar Man - ASW #332
1:04:35
1:04:35
Play later
Play later
Lists
Like
Liked
1:04:35
ArmorCode unveils Anya—the first agentic AI virtual security champion designed specifically for AppSec and product security teams. Anya brings together conversation and context to help AppSec, developers and security teams cut through the noise, prioritize risks, and make faster, smarter decisions across code, cloud, and infrastructure. Built into …
…
continue reading
1
AI in AppSec: Agentic Tools, Vibe Coding Risks & Securing Non-Human Identities - Mo Aboul-Magd, Shahar Man, Brian Fox, Mark Lambert - ASW #332
1:04:35
1:04:35
Play later
Play later
Lists
Like
Liked
1:04:35
ArmorCode unveils Anya—the first agentic AI virtual security champion designed specifically for AppSec and product security teams. Anya brings together conversation and context to help AppSec, developers and security teams cut through the noise, prioritize risks, and make faster, smarter decisions across code, cloud, and infrastructure. Built into …
…
continue reading
1
Appsec News & Interviews from RSAC on Identity and AI - Charlotte Wylie, Rami Saas - ASW #331
1:01:48
1:01:48
Play later
Play later
Lists
Like
Liked
1:01:48
In the news, Coinbase deals with bribes and insider threat, the NCSC notes the cross-cutting problem of incentivizing secure design, we cover some research that notes the multitude of definitions for secure design, and discuss the new Cybersecurity Skills Framework from the OpenSSF and Linux Foundation. Then we share two more sponsored interviews f…
…
continue reading
1
Appsec News & Interviews from RSAC on Identity and AI - Rami Saas, Charlotte Wylie - ASW #331
1:01:48
1:01:48
Play later
Play later
Lists
Like
Liked
1:01:48
In the news, Coinbase deals with bribes and insider threat, the NCSC notes the cross-cutting problem of incentivizing secure design, we cover some research that notes the multitude of definitions for secure design, and discuss the new Cybersecurity Skills Framework from the OpenSSF and Linux Foundation. Then we share two more sponsored interviews f…
…
continue reading
1
Secure Code Reviews, LLM Coding Assistants, and Trusting Code - Rey Bango, Karim Toubba, Gal Elbaz - ASW #330
1:09:38
1:09:38
Play later
Play later
Lists
Like
Liked
1:09:38
Developers are relying on LLMs as coding assistants, so where are the LLM assistants for appsec? The principles behind secure code reviews don't really change based on who write the code, whether human or AI. But more code means more reasons for appsec to scale its practices and figure out how to establish trust in code, packages, and designs. Rey …
…
continue reading
1
Secure Code Reviews, LLM Coding Assistants, and Trusting Code - Rey Bango, Karim Toubba, Gal Elbaz - ASW #330
1:09:38
1:09:38
Play later
Play later
Lists
Like
Liked
1:09:38
Developers are relying on LLMs as coding assistants, so where are the LLM assistants for appsec? The principles behind secure code reviews don't really change based on who write the code, whether human or AI. But more code means more reasons for appsec to scale its practices and figure out how to establish trust in code, packages, and designs. Rey …
…
continue reading
1
AI Era, New Risks: How Data-Centric Security Reduces Emerging AppSec Threats - Vishal Gupta, Idan Plotnik - ASW #329
1:03:03
1:03:03
Play later
Play later
Lists
Like
Liked
1:03:03
We catch up on news after a week of BSidesSF and RSAC Conference. Unsurprisingly, AI in all its flavors, from agentic to gen, was inescapable. But perhaps more surprising (and more unfortunate) is how much the adoption of LLMs has increased the attack surface within orgs. The news is heavy on security issues from MCPs and a novel alignment bypass a…
…
continue reading
1
AI Era, New Risks: How Data-Centric Security Reduces Emerging AppSec Threats - Idan Plotnik, Vishal Gupta - ASW #329
1:03:03
1:03:03
Play later
Play later
Lists
Like
Liked
1:03:03
We catch up on news after a week of BSidesSF and RSAC Conference. Unsurprisingly, AI in all its flavors, from agentic to gen, was inescapable. But perhaps more surprising (and more unfortunate) is how much the adoption of LLMs has increased the attack surface within orgs. The news is heavy on security issues from MCPs and a novel alignment bypass a…
…
continue reading
