Loading...

PODCAST

The Application Security Podcast

Chris Romeo and Robert Hurlbut

The Application Security Podcast is a practitioner-led show for anyone building or securing modern software—and now AI-powered applications. Hosts Chris Romeo and Robert Hurlbut talk with the people shaping application security about AI and LLM security, threat modeling, secure development, OWASP, cloud, DevSecOps, security champions, and building programs that help engineering teams move faster and safer. With more than 300 episodes, the show turns real-world experience into practical guidance for

technology tech news

All Episodes

53:17

Your Opinion on AI Doesn't Matter. Learned Fragility...

The Application Security Podcast ·

2026/10/05

What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E. Schoenfield, CTO of Rezliant and author of Securing Systems, returns to warn about "the illusion of omniscient perfection," the cheerful confidence that makes AI output feel finished, and the "learned fragility" that sets in when nobody understands the code anymore. He, Chris, and Robert debate whether an AI threat model that gets 90% of the way there is a win, h...

en-us

49:11

Why AI Code Review Will Replace Human Review Faster...

The Application Security Podcast ·

2026/09/29

Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company. The founder of Manicode Security returns to explain why AI didn't kill AppSec education but supercharged it, why vague prompting on frontier models turns companies into "token furnaces," and why prompt injection is the one genuinely new vulnerability class of the AI era. He walks Chris and Robert through his full AI coding workflow, from reverse engineering an architecture file to securit...

en-us

44:59

Vulnerability Jail and the AI-Era AppSec Engineer

The Application Security Podcast ·

2026/09/22

Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. Jeevan, Director of Security Engineering at Rippling, returns to unpack how his team polices thousands of engineers shipping 10x more code: a "vulnerability jail" that locks non-compliant teams out of the main branch, AI-reviewed extension requests, and homegrown agents that hunt for entire classes of vulnerabilities instead of one bug at a time. He and Chris debate w...

en-us

36:33

How Agentic AI Fails—and Which Controls Actually Stop It

The Application Security Podcast ·

2026/09/15

Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents. Petra traded emergency medicine for application security and now heads information security at Numan — and she joins Chris Romeo and Robert Hurlbut to make the case for fault tree analysis (FTA), the deductive method that picks up exactly where threat modeling stops. Petra walks through a "wrong customer r...

en-us

48:03

Your AppSec Bottleneck Is a People Problem

The Application Security Podcast ·

2026/09/07

What makes a security champions program successful—and why do so many fail? Lisi Hocke explains how psychological safety, cognitive load, power sources, and community can help create sustainable programs. We also explore reducing security wait times, gaining organizational support, the role of AI, why champions meetings shouldn’t be recorded, and the importance of putting people first. This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. Learn more at Corgea.c...

en-us

43:46

AI Pen Testing Killed Traditional DAST

The Application Security Podcast ·

2026/08/31

Is traditional DAST finally dead? James Berthoty explains how AI pentesting is changing the dynamics of security testing through contextual payloads, autonomous agents, and application-aware vulnerability discovery. We also explore token costs, AI-native security vendors, the future of bug bounties, testing in production, and whether model providers could eventually absorb today’s security tools. This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. Learn more:...

en-us

47:54

AI Security: OWASP Meets Global Standards

The Application Security Podcast ·

2026/08/26

AI security has no shortage of standards—but how do we turn them into practical guidance? Rob van der Veer explains how OWASP, the AI Exchange, and MOSAIC are coordinating global AI security efforts. We also explore responsible AI, agentic red teaming, vulnerability discovery, and how AI could level the playing field between attackers and defenders. This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. Learn more: Corgea.com About Corgea Corgea is an AI-native ...

en-us

40:14

The Future of Open-Source Threat Modeling

The Application Security Podcast ·

2026/08/17

This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. Learn more: Corgea.com You don’t have to let AI do the thinking for you. In this episode, Vikram shares why the smartest teams use AI as an accelerant — not a replacement — and why human judgment still matters most in threat modeling. We dig into the tension among speed, compliance, and real risk, and what it means to “fight the AI” so that critical thinking stays sharp. If you care about AppSec, AI, and the...

en-us

49:09

Isaac Evans - AppSec in the Age of AI

The Application Security Podcast ·

2026/07/28

Send us Fan Mail In this episode, we sit down with Isaac Evans, co-founder and CEO of Semgrep, to talk about how AI is reshaping application security faster than almost anyone expected. Isaac walks us through why CI is losing its place as the central security control point, replaced by deep background jobs that hunt for vulnerabilities using large models and real-time plugins that sit inside coding agents and force them to regenerate code until it meets an organization's security bar. We dig ...

en-us

52:39

José Carlos Chávez - When Museums Get Hacked: OWASP...

The Application Security Podcast ·

2026/07/21

Send us Fan Mail In this episode, we sit down with Jose Carlos Chavez from Okta to break down the OWASP Top 10 for 2025 and what actually changed since 2021. We trace Jose's path from software engineering and observability into security, dig into why broken access control still holds the number one spot despite mature tooling, and ask the question that never seems to get old: why is injection still a top five risk after decades of parameterized queries and ORMs? Jose walks us through the grow...

en-us

48:58

Michael Burch - AI-Enabled Citizen Developers

The Application Security Podcast ·

2026/06/16

Send us Fan Mail AI adoption is accelerating faster than most organizations know how to handle it, and the gap between curiosity and confident use is where things go wrong. Michael Burch, VP of AI Enablement and Acceleration, joins to break down what it actually takes to move teams from "interested in AI" to using it responsibly and effectively in their day-to-day work. He shares why successful adoption depends less on the technology itself and more on trust, clear guidance, and making AI app...

en-us

40:29

Josh Grossman--AI & SAST: Is it a match?

The Application Security Podcast ·

2026/06/02

AI coding tools are accelerating development fast, but they’re also exposing the limits of traditional AppSec tooling. Josh Grossman, CTO of Bounce Security and longtime AppSec consultant, joins the podcast to break down AGHAST, his new open-source security tool that combines static analysis with AI to uncover business logic flaws and authorization issues that traditional scanners miss. FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTub...

en-us

45:27

Dwayne McDaniel -- Secrets Sprawl and How AI is...

The Application Security Podcast ·

2026/05/14

GitGuardian found 29 million hard-coded secrets leaked in public GitHub commits in a single year, a 34% jump and the biggest spike they've ever recorded. Dwayne McDaniel joins to break down why AI coding tools, MCP servers, and a false sense of security in private repos are making the problem worse, and what it'll actually take to fix it. Check out the report here - https://www.gitguardian.com/files/the-state-of-secrets-sprawl-report-2026. Dwayne McDaniel is a Principal Developer Advocate who...

en-us

47:57

Tanya Janca - Secure Vibe Coding

The Application Security Podcast ·

2026/04/30

AI isn’t just helping developers anymore; it’s writing the code, and that changes everything. In this episode, Tanya Janca breaks down “vibe coding,” the hidden security risks behind it, and how teams need to rethink AppSec from the ground up. If you’re building with AI, this is the wake-up call you can’t afford to miss. Tanya Janca, AKA SheHacksPurple, is an author, founder, trainer, speaker, software developer, but most of all, a nerd obsessed with security. She speaks and teaches secure co...

en-us

44:53

Caroline Wong--The AI Cybersecurity Handbook

The Application Security Podcast ·

2026/04/21

Caroline Wong, author of The AI Cybersecurity Handbook and Chief Strategy Officer at Axari, is back! Caroline shares how AI is rapidly changing AppSec, driving massive increases in code, accelerating risk, and challenging traditional security practices. The conversation covers AI-generated code, trust and explainability, and how security teams must adapt to keep up. FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/...

en-us

49:30

Steve Wilson--OpenClaw and Advanced AI Agents

The Application Security Podcast ·

2026/04/15

In this episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut welcome back Steve Wilson, a global leader in AI security and Chief AI and Product Officer at Exabeam, as well as founder of the OWASP Gen AI Security Project. Steve shares how his AI assistant was “hacked” using a simple phishing attack, highlighting a major shift in security—AI agents behave more like humans than traditional software. The conversation explores how this changes the threat model, why AppSec i...

en-us

42:19

Brad Geesaman - Redefining AppSec with AI: Shrinking...

The Application Security Podcast ·

2025/10/28

Brad Geesaman, Principal Security Engineer at Ghost, joins the podcast today to explore how AI and large language models are transforming the world of application security. The discussion starts with the concept of "toil"—the repetitive, exhausting work that drains AppSec teams as they struggle to keep up with mountains of security findings and alerts. Brad shares his insights on how LLMs can provide meaningful leverage by handling the heavy lifting of triage, classification, and evidence gat...

en-us

68:09

OWASP Candidate Debate - 2025 Edition

The Application Security Podcast ·

2025/10/15

In this special episode of the Application Security Podcast we meet nine of the OWASP Board of Directors candidates. Each candidate discusses their unique qualifications, experiences, and vision for OWASP's future. Topics include enhancing OWASP's impact, improving outreach and education, securing funding, and engaging local chapters. Don't miss this insightful debate as these candidates share their strategies to help secure a brighter future for OWASP. FOLLOW OUR SOCIAL MEDIA: ➜Twi...

en-us

33:19

Francesco Cipollone - Agentic AI Manifesto

The Application Security Podcast ·

2025/09/23

Francesco Cipollone, the CEO of Phoenix Security, shares his extensive experience in AI and security, discussing the crucial difference between true AI agents and glorified chatbots. Learn why Phoenix Security utilizes six different LLMs instead of a single super agent. Understand the sobering economics behind AI implementation and the importance of adopting AI responsibly. Get practical advice on integrating AI agents to enhance, not replace, human capabilities, while touching on the Agentic...

en-us

36:03

Simon Gibbs & Devika Gibbs -- Building Bridges with...

The Application Security Podcast ·

2025/09/16

Simon and Devika Gibbs, the innovative minds behind Cybersec Games, join us on the episode today. Discover how the Gibbs duo are revolutionizing the way we teach and learn security concepts through interactive gaming. Learn about their journey from developing stationary for agile teams to delving into the world of threat modeling games like Elevation of Privilege. We talk about the power of gamification in cybersecurity education, and get the inside scoop on their Cybersecurity Game Challenge...

en-us

312 results

Similar Podcasts

Lead With AI

Tamara Nall

The Automated Daily

TrendTeller

My Weird Prompts

Daniel Rosehill

LessWrong (Curated & Popular)

LessWrong

脈報

思思主播