Absolute AppSec
by Ken Johnson and Seth Law
Latest episode
Episode 338 - w/ Kiston Finney and John Snow - AI Restrictions…
Episode 338 - w/ Kiston Finney and John Snow - AI Restrictions…
About this podcast
A weekly podcast of all things application security related. Hosted by Ken Johnson and Seth Law.
Episodes
The newest 50 of 338 episodes
- Episode 338 - w/ Kiston Finney and John Snow - AI Restrictions, Asset ManagementWhile Ken is out of the office, Seth is joined by Kiston Finney (Chief Risk Officer at Atreides Partners) and John Snow (Managing Director of Enterprise Cloud Architecture at…
- Episode 337 - w/Coffee, Chaos, and ProdSec - AI Guardrails, Risk Prioritization ShiftIn episode 337, the hosts reconvene for their quarterly crossover discussion with Kurt and Cameron from the Coffee, Chaos, and ProdSec podcast to analyze the current state of…
- Episode 336 - Hardware Image Signing, Bot Reduction, AI Code InsecuritiesIn Absolute AppSec Episode 336, the hosts explore hardware-level image signing, bot traffic anomalies, cross-site scripting (XSS) developments, and AI-driven code quality…
- Episode 335 - w/ Ron Perris - Secure Coding with AIIn episode 335 of Absolute AppSec, Seth and Ken sit down with Ron Perris. Ron is Chief Technology Officer at Manicode Security, to discuss the integration of AI into secure…
- Episode 334 - w/ Ryan Lloyd - Mobile Application SecurityIn episode 334 of Absolute AppSec, hosts Ken Johnson and Seth Law interview Ryan Lloyd, Chief Product Officer at GuardSquare, to explore mobile application security and product…
- Episode 333 - LLM Patching Flaws, AI Code Regressions, Bug Bounty EconomySponsored by GuardSquare (guardsquare.com), the discussion of Episode 333 opens with an analysis of a 1Password academic paper evaluating how frontier LLMs perform at autonomous…
- Episode 332 - AI SDLC, Call for Cyber Defense, Rumor as the ExploitIn episode 332, the discussion focuses on how artificial intelligence is reshaping the Software Development Lifecycle (SDLC). The episode analyzes Anthropic's blog post regarding…
- Episode 331 - Being "Mythos" Ready, CRLF-Powered De-sync AttacksSponsored by Guardsquare (guardsquare.com), Episode 331 focuses heavily on the growing role of AI agents in application security and how organizations should build and defend…
- Episode 330 - w/ Jeevan Singh - Vulnerability JailIn this special episode of Absolute AppSec, we cover a topic which started as a solution proposed by Rippling Security's Jeevan Singh: Vulnerability Jail. As Jeevan describes it…
- Episode 329 - AI exploitability, IDOR prevention, Smart TV ProxiesIn this episode, sponsored by GuardSquare (guardsquare.com), Ken Johnson and Seth Law discuss OpenAI's reported Hugging Face security incident, questioning whether the model…
- Episode 328 - Wordpress RCE, Vuln Prioritization, AI memory exfiltrationIn episode 328 of Absolute AppSec, sponsored by GuardSquare (guardsquare.com), Seth and Ken start by highlighting a newly disclosed, pre-authentication WordPress core Remote Code…
- Episode 327 - w/Coffee, Chaos, and ProdSec - ASPM Consolidation, Vuln PrioritizationIn episode 327 of Absolute AppSec, co-hosts Ken Johnson and Seth Law present a highly anticipated quarterly crossover episode with Cameron and Kurt from the Coffee, Chaos, and…
- Episode 326 - AppSec Jobs, Benchmarking LLMs, Open Web StandardsIn episode 326 of Absolute AppSec, sponsored by mobile application security provider GuardSquare (guardsquare.com), the hosts start with a deep-dive into pre-show discussions…
- Episode 325 - Simplified Threat Modeling, Defining A VulnerabilityIn episode 325 of Absolute AppSec, co-hosts Ken Johnson and Seth Law first break down an informal guide to threat modeling, arguing that overly prescriptive frameworks like…
- Episode 324 - Three Week Trap, Malicious ExtensionsIn episode 324 of Absolute AppSec, co-hosts Ken Johnson and Seth Law share a mix of security model critiques. Starting with industry dynamics, Ken recaps his recent presentation…
- Episode 323 - Secrets Logs, Prompt Injection RisksIn episode 323 of Absolute AppSec, co-hosts Ken Johnson and Seth Law focus heavily on core application security vulnerabilities, legacy operational struggles, and the challenges…
- Episode 322 - Megalodon, Staged Package Publishing, AI Powered HoneypotsIn episode 322, the co-hosts examine critical vulnerabilities, changing security standards, and adaptive defense mechanisms. They deep dive into the recent "Megalodon" breach…
- Episode 321 - The Future of AppSecIn episode 321 of Absolute AppSec, the co-hosts dive into a sprawling discussion about the future of Application Security amid the heavy noise of artificial intelligence and…
- Episode 320 - Return of @lojikil - LLM Bug Hunting, AI OffSec, Defender BurnoutKen is away, so Stefan Edwards (lojikil) joins Seth to talk all things AppSec. This episode starts by exploring the acceleration of AI on the offensive side of security, enabling…
- Episode 319 - Vercel Breach, Security vs. Compliance, Pull Request Flows w/ AI AgentsEpisode 319 covers a range of industry developments, primarily focusing on the recent Vercel security incident and the evolving landscape of AI-driven compliance. The hosts…
- Episode 318 - Slack Impersonation, Mythos, Vulnerability Research FutureEpisode 318 examines critical vulnerabilities and the evolving impact of AI on the security industry. The episode details a recent sophisticated impersonation and malware attack…
- Episode 317 - (Post-RSAC/BSidesSF), Supply Chain Security, Future of SDLCKen Johnson and Seth Law reflect on the 2026 RSA Conference and BSidesSF, noting an industry-wide "awakening" regarding the high costs and engineering complexities of…
- Episode 316 - w/Coffee, Chaos, and ProdSec - Agentic Development LifecycleIn episode 316 of Absolute AppSec, hosts Ken Johnson and Seth Law participate in a crossover with Kurt Hendle and Cameron Walters from the Coffee, Chaos, and ProdSec podcast to…
- Episode 315 - Risks of "AI-Native" Security Products, Rapid Software DevelopmentIn episode 315 of Absolute AppSec, Ken Johnson and Seth Law discuss the rapidly evolving challenges of securing software in an era of AI-assisted development. The hosts provide…
- Episode 314 - LLM AppSec Disruption, Limitations of AI in Security, AppSec OversightIn this episode, the hosts discuss the seismic shift in the application security landscape triggered by the rise of Large Language Models (LLMs) and Anthropic’s "Claude Code"…
- Episode 313 - AppSec Role Evolution, AI Skills & Risks, Phishing AI AgentsKen Johnson and Seth Law examine the intensifying pressure on security practitioners as AI-driven development causes an unprecedented acceleration in industry velocity. A primary…
- Episode 312 - Vibe Coding Risks, Burnout, AppSec ScorecardsIn episode 312 of Absolute AppSec, the hosts discuss the double-edged sword of "vibe coding", noting that while AI agents often write better functional tests than humans, they…
- Episode 311 - Transformation of AppSec, AI Skills, Development VelocityKen Johnson and Seth Law examine the profound transformation of the security industry as AI tooling moves from simple generative models to sophisticated agentic architectures. A…
- Episode 310 - w/ Mohan Kumar and Naveen K Mahavisnu - AI Agent SecurityIn this episode of Absolute AppSec, hosts Ken Johnson and Seth Law interview Mohan Kumar and Naveen K Mahavisnu, the practitioner-founders of Aira Security, to explore the…
- Episode 309 - w/ Nathan Hunstad - Compliance, Security GovernanceIn this episode of Absolute AppSec, Nathan Hunstad, Director of Security at Vanta, discusses the intersection of security policy, governance, and technical defense. Drawing on…
- Episode 308 - w/Avi Douglen - Privacy, AppSec Conferences, OWASPKen Johnson (cktricky on social media) and Seth Law are happy to announce a special episode of Absolute AppSec with Avi Douglen (sec_tigger on X), long-time OWASP Global Board of…
- Episode 307 - 2025 Retrospective, Supply Chain, MCP and APIsIn episode 307 of Absolute AppSec, hosts Ken and Seth conduct a retrospective on the application security landscape of 2025. They conclude that their previous predictions were…
- Episode 306 - w/ Paul McCarty - Open Source MalwareGiven the spate of recent npm news stories, we've arranged a topical show with software supply-chain security researcher and npm hacker Paul McCarty (find Paul on bsky…
- Episode 305 - Career Impact of GenAI, SEO/GEO, More Supply Chain AttacksThe latest episode of Absolute AppSec is here, with Ken Johnson and Seth Law checking in during the busy Q4 holiday season to share some fascinating insights on the evolving…
- Episode 304 - More OWASP Top 10, AI Dynamic TestingThis episode, the 304th of Absolute AppSec, features hosts Ken Johnson (@cktricky) and Seth Law (@sethlaw) discussing the crush of Q4 expectations, upcoming training…
- Episode 303 - w/Prof. Brian Glas - OWASP Top 10 2025Prof. Brian Glas (infosecdad on social media) joins Seth Law (sethlaw) and Ken Johnson (cktricky) for a timely episode of Absolute AppSec. Infosec Guru and one of the OWASP Top…
- Episode 302 - OWASP Global AppSec DC predictions, AI Browser Dangers, MCP SecurityEpisode 302 of Absolute AppSec has hosts Ken Johnson and Seth Law speculating on the upcoming Global AppSec DC conference, predicting the announcement of the OWASP Top Ten 2025…
- Episode 301 - AI Browsers, New AI Agent Attacks, Framework ChecklistsIn this episode, Seth and Ken debate OpenAI's Atlas browser, which embeds AI into web browsing. Ken views it as a major privacy concern, potentially accelerating invasive data…
- Episode 300 - THIS! IS! APPSEC!For the 300th (!!!!) episode of the podcast, Seth and Ken reminisce on changes to the industry and overall approach to application security since inception. The hosts discussed…
- Episode 299 - Startup Grind, Will Security Companies DisappearThe duo is back after a short hiatus. Today's episode is inspired by recent articles related to startups, funding, and the grind that happens when building a company or being an…
- Episode 298 - Shai Hulud, Layered Security, New Commandments of Security TeamsIn what is (sadly) becoming a weekly segment, this episode starts with talk of the latest installment of npm package takeovers, dubbed Shai Hulud as discussed in Slack and…
- Episode 297 - True/False Positives, Phishing Package MaintainersThe Absolute AppSec duo returns with an in-depth episode talking about true and false positives, where context matters and business impact must be taken into account in order to…
- Episode 296 - OWASP Top 10, NX Compromise, Security News SourcesKen and Seth kickoff a podcast by reviewing current state of the OWASP Top 10 project, given recent requests and interactions on Absolute AppSec slack from various contributors…
- Episode 295 - DEF CON 33 Recap, Crocs and Socks (and Bots)Seth and Ken return with a new episode summarizing their experience at DEF CON 33 and all things Las Vegas over the past month. This includes panels, talks, workshops, happy…
- Episode 294 - w/ Anshuman Bhartiya - AppSec in the Age of AIJust in time for AppSec sweeps week, Anshuman Bhartiya is joining Seth Law (sethlaw on social media) and Ken Johnson (cktricky) on the Absolute AppSec podcast! With over a decade…
- Episode 293 - AppSec's Reality GapSpurred by a recent article from Venture in Security, this episode delves deep into the practical application of security into an organization's SDLC. Covering a range of issues…
- Episode 292 - Manual Source Code Review, AI Slop in Bug Bounties, AppSec AuthorizationSeth and Ken are _back_ to talk through some recent experiences and news across the industry. To start the episode, Seth highlights the edge cases uncovered during manual code…
- Episode 291 - w/ Sean Varga - OWASP Top 10 of AppSec SalesSean Varga, current regional sales manager with noted ASPM company Cycode joins Ken (@cktricky) and Seth (@sethlaw) to discuss the dawning realization organizations are having…
- Episode 290 - Authentication Fatigue, Browser AI AgentsKen returns after a week's hiatus to review the latest AppSec news with Seth. Specifically, the idea that authentication fatigue exists for both consumers and developers. The…
- Episode 289 - Return of @lojikil - Context MattersWith @cktricky out on a grand tour across the country (or just unable to record for the day), @sethlaw succumbs to the dark side to give @lojikil a platform to talk about recent…
