Hosts dig into the stories of AppSec experts and the tools, tactics, and tricks that make them successful.
Internet
Joined August 2016
- Tweets2.3K
- Following1.4K
- Followers2.9K
- Likes788
Let your agents work. Keep them in sight.
Origin inventories, observes, and measures AI agent usage across your endpoints.
Thanks to Origin for sponsoring this week's episode with Hannah Foxwell.
#AppSec #AIsecurity
appsecpodcast.com/origin
No human checks in the software factory?
This week's episode with Hannah Foxwell made the case that's dangerous.
From the archive: Tanya Janca on secure guardrails and how they differ from paved roads.
#AppSec #DevSecOps
appsecpodcast.com/tanya-janc…
Your cycle time can look great while your backlog quietly grows.
Hannah Foxwell's advice: measure saturation, not just speed. You can't go fast unless you can go safely.
#AppSec #VulnerabilityManagement
appsecpodcast.com/appsec-has…
Can you still trust the CVE process when the exploit shows up before the CVE does?
Hannah Foxwell and Chris Romeo on why exploitability is the wrong thing to wait for.
#AppSec #VulnerabilityManagement
appsecpodcast.com/appsec-has…
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design to production: design reviews, AI SAST, dependency and IaC scanning, and autonomous pentesting.
Thanks to Corgea for sponsoring this week's episode.
#AppSec #AIsecurity
appsecpodcast.com/corgea
Before the CVE even has a number, the exploit may already exist.
Hannah Foxwell joins Chris Romeo and Robert Hurlbut on why the time to exploit is now negative, and why AppSec has never mattered more.
#AppSec #AIsecurity
appsecpodcast.com/appsec-has…
Jim Manico told us that human code review is on its way out.
Ahmad Sadeddin's data says agents are already addressing the security findings.
Catch up on Jim's episode.
#AppSec #CodeReview
youtube.com/watch?v=G-0ecWjB…
Design it. Build it. Ship it. Corgea secures it.
AI SAST, design reviews, dependency and IaC scanning, and autonomous pentesting in one platform.
Thanks to Corgea for sponsoring this week's episode with Ahmad Sadeddin.
#AppSec #AISecurity
appsecpodcast.com/corgea
A security review on a PR can run $5 to $25 once you scan every push. Some teams run 100,000 a month.
Ahmad Sadeddin on why AI AppSec budgets are about to get a hard look.
#AppSec #AISecurity
appsecpodcast.com/your-devel…
In May, 2.5 percent of developer replies to Corgea's security comments were written by an agent. Now it's about a third.
Ahmad Sadeddin breaks down the data with Chris Romeo.
#AppSec #AISecurity
appsecpodcast.com/your-devel…
No human uses an em dash.
That's one way Corgea measures it: 35 to 60 percent of developer replies to security comments on PRs are now written by AI agents.
Ahmad Sadeddin joins Chris Romeo on the AppSec Podcast.
#AppSec #AISecurity
youtu.be/AlJMKHCubmI
Before the OWASP MCP Top 10, Vandana Verma Sehgal was spotlighting OWASP projects one video at a time.
Revisit her 2021 episode on the OWASP Spotlight Series.
#AppSec #OWASP
youtu.be/g0KfZtNzmIk
AI writes code faster than anyone reviews the design.
Security Compass models threats continuously.
Thanks to Security Compass for sponsoring this week's episode with Vandana Verma Sehgal.
#AppSec #ThreatModeling
appsecpodcast.com/securityco…
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design reviews to autonomous pentesting.
Thanks to Corgea for sponsoring this week's episode with Vandana Verma Sehgal.
#AppSec #AIsecurity
appsecpodcast.com/corgea
"Authenticate every action, authorize every sensitive action."
Vandana Verma Sehgal's rule for MCP. Long-lived tokens and inherited permissions can give an agent access to your entire account.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Why does MCP need its own OWASP Top 10?
Vandana Verma Sehgal: A malicious tool description gets pulled into the model's context and treated as trusted guidance before anyone even uses the tool.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Your developers are running MCP servers your security team can't see.
Vandana Verma Sehgal, leader of the OWASP MCP Top 10, on shadow MCP, scope creep, and why a secure MCP server should be boring.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Before this week's episode, go back to 2024: Brook Schoenfield on security, stories, jazz, and stage presence on The Security Table.
#AppSec #SecurityArchitecture
youtube.com/watch?v=AJSgUR_0…
AI writes code faster than anyone reviews the design.
Security Compass continuously models threats and translates them into actionable requirements for developers.
#AppSec #ThreatModeling
appsecpodcast.com/securityco….
The Application Security Podcast retweeted
Earlier this week I listened to: Vulnerability Jail and the AI-Era AppSec podcast by @AppSecPodcast and took down a few note and two questions that bordered around trust and accountability in the use of agents.
Today, fortunately at a workstation, I ran into an AI engineer who's also very much interested and is participating in AI governance research and shared my thoughts. Our conversation made me realize I could thread this path further with my curiosity to see how the industry could strike a balance. Or not. 💡