Application Security Weekly (Video)
by Mike Shema
Latest episode
Human Expertise Will Always Be The Core Of AI Cybersecurity - Andrew…
Human Expertise Will Always Be The Core Of AI Cybersecurity - Andrew…
About this podcast
About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.
Episodes
The newest 50 of 735 episodes
- Human Expertise Will Always Be The Core Of AI Cybersecurity - Andrew Wesie - ASW #408 · 1 h 1 minAI-enabled cyber attackers will check every third-party path into an application at scale and speed. The same process can help defenders just as much, but it's only as effective…
- More Vulns and More Guesswork from Less Data - Jeremiah Grossman - ASW #407 · 1 h 3 minFollowing the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the…
- Securing Modern Financial Systems in the Age of AI - Rashid Feroze - ASW #406 · 55 minProactive security doesn't have to wait for a vuln to be disclosed. Even if a patch isn't available, it's possible to deploy controls and design systems to be resilient against…
- Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 - Ryan Lloyd, Jan Seredynski - ASW #405 · 53 minThe OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification…
- What's Not Found in AppSec? - ASW #404 · 54 minTo celebrate our 404th episode we discuss what's not found in modern appsec and what still exists that should become not found. The conversation starts with a classic problem of…
- Getting Granular with Access, Attributes, and Intent - Alex Olivier - ASW #403 · 1 h 10 minThe principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explains how the AuthZen Working Group has been…
- Going From Bug Bounty Bugs to More Secure Systems - Shlomie Liberow - ASW #402 · 1 h 2 minFinding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a…
- Understanding Prompt Injection In Order to Contain It - Julie Brunias - ASW #401 · 1 h 0 minPrompt injection demonstrates one of the major challenges in securing LLMs and agents -- how do you ensure an agent ignores attackers and only does what you instructed it to do…
- The AI Threat Multiplier: Securing Mobile Apps in the Automated Era - Ryan Lloyd, Jason Cortlund - ASW #400 · 53 minWhile agents and LLMs haven't fundamentally changed core mobile vulnerability types, they have supercharged speed, scale, and accessibility—democratizing threats like automated…
- Security Conversations on AI, Agents, and Emerging Threats from Black Hat 2026 - Michael Leland, Sean Murphy, Idan Plotnik, Ido Geffen - ASW #399 · 1 h 9 minWe showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island Agents can…
- Fixing Software Weaknesses Rather Than Just Finding More Flaws - Nidhi Aggarwal, Gil Geron, Braden Russell - ASW #398 · 1 h 8 minAppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized…
- Applying Zero Trust Principles to Agents - Kieran Human - ASW #397 · 1 h 6 minSandboxing, least privilege, and monitoring are well-established controls in terms of the defenses they provide against unexpected and unauthorized actions. But being…
- Augmenting Threat Intel Analysis with Agents - Sai Kiran Uppu, Chris Wallis, Ramin Farassat - ASW #396 · 1 h 9 minAll sorts of cybersecurity disciplines are adopting agents to help humans save time and automate routine activities. Sai Kiran Uppu describes his work on creating a platform for…
- Using LLMs for Vuln Discovery - Rishi Sharma - ASW #395 · 1 h 9 minFinding flaws has always been a focus of appsec. And now with open source projects and open weight models orgs have modern tools to review code and conduct pentests. Rishi Sharma…
- Prompting for Patches That Fix Vulns Without Adding New Ones - Keith Hoodlet - ASW #394 · 1 h 3 minThere's already an increase in volume of security flaws found by LLMs. And orgs are already turning to LLMs to write code. So, what happens when orgs lean on LLMs to create…
- Inside the OWASP Agent Security Regression Harness Project - Mert Satilmaz - ASW #393 · 1 h 9 minOrgs need to be able to use agents, MCPs, and LLMs in ways that don't lead to unexpected actions and undesirable outcomes. The OWASP Agent Security Regression Harness project is…
- MacOS Security Design Features, Flaws, And Futures - Patrick Wardle - ASW #392 · 1 h 12 minAppsec often frames usability and security as at odds with each other. Apple's software has famously emphasized the importance of usability while also creating a solid security…
- Discovering & Securing Your AI Agent Attack Surface - Jeremy Snyder - ASW #391 · 1 h 7 minWhile LLMs and agents are new to appsec and everyone else, a lot of AI security requirements translate to well-known API security requirements. Jeremy Snyder helps us frame the…
- Defense-in-depth strategies for securing mobile applications - Ryan Lloyd - ASW #390 · 48 minMobile applications have unique risks and threat models compared to server-side applications and infrastructure. Consequently, they need different strategies to ensure their…
- Reducing Attack Surface & Evaluating Efficiency in Agents - Itamar Apelblat, David Goldschlag - ASW #389 · 1 h 12 minSquidBleed reveals another vuln that's been lurking for decades, but its real lesson is in managing an attack surface. Regardless of whatever programming language you use…
- How AI Is Reshaping Identity Security at the Infrastructure Layer - Ev Kontsevoy, Neha Duggal, Amit Masand - ASW #388 · 1 h 10 minAppsec has seen machine identities from daemons and processes to services, microservices, and cloud accounts. And now we have agents. Ev Kontsevoy talks about what it means to…
- Why Does It Matter Who or What Created the Code? - Matias Madou - ASW #387 · 1 h 6 minAgents and LLMs are creating and reviewing code. They're a new tool to help developers write software and they're a new abstraction layer for expressing what code should do. But…
- Scanner Results Are a Starting Point. Here's What Comes Next. - Federico Kirschbaum - ASW #386 · 1 h 16 minMost AppSec teams are working through more findings than their teams can validate. SAST surfaces thousands of potential issues. DAST generates alert volume that outpaces triage…
- BadHost, Dead CTFs, Exploding NPMs, and the Verizon DBIR - ASW #385 · 45 minWe dedicate an episode to catching up on appsec news with Kalyani Pawar. We see parsing problems that led to the BadHost vuln, which exposed lots of LLMs, MCPs, and agents to…
- AppSec Conversations on Agents, LLMs, and OWASP from RSAC - Scott Clinton, Janet Worthington, Merritt Maxim - ASW #384 · 60 minWe showcase recordings from this year's RSAC. At RSAC Conference 2026, Scott Clinton, Co-Chair and co-founder of the OWASP GenAI Security Project, shares insights from the…
- The State of AI & AppSec - Keith Hoodlet - ASW #383 · 1 h 2 minThis year has been a dichotomy of established secure design fundamentals and burgeoning chaos of LLM-driven vuln discovery. Keith Hoodlet returns to share his latest observations…
- Why Basic Security Practices Still Work - Rob Allen - ASW #382 · 1 h 11 minIf you have to ditch your entire appsec strategy because you expect 2026 to bring more vulns more quickly, then you probably didn't have a good strategy in the first place. Rob…
- Keeping Up With the OWASP GenAI Project - Scott Clinton - ASW #381 · 1 h 9 minSpeed is the most common theme among developers and appsec teams working with LLMs and agents, from trying to keep up with patterns for deploying agents to dealing with more code…
- Top 10 Web Hacking Techniques of 2025 and a Hint for 2026 - James Kettle - ASW #380 · 45 minPortswigger's list of web hacking techniques is a long-running celebration of curiosity and research from the web hacking community. James Kettle shares his thoughts on the…
- The Human Aspect of Red Teams - Brian Fox, Tom Tovar, T. Gwyddon 'Data' Owen - ASW #379 · 1 h 13 minRed team exercises set goals to see if a particular outcome can be accomplished through a simulated attack, but the ultimate outcome should be educating the org about how to…
- Securing Software's Journey with the OWASP SPVS - Cameron W., Farshad Abasi, Rohan Ravindranath, Ido Geffen - ASW #378 · 1 h 9 minIt's one thing to write secure code, it's another to release it into the wild. That code needs to be designed, built, tested, released, and maintained. Farshad Abasi and Cameron…
- AppSec News Roundup on Claude Code Leak, Axios NPM Compromise, Secure Design - Idan Plotnik, Raj Mallempati - ASW #377 · 1 h 8 minSecurity problems aren't changing very much even though security teams are. We catch up on the implications of the Claude Code source leak, the very human lessons from the axios…
- Developing the Skills Needed for Modern Software Development - Keith Hoodlet, Ron Rasin, Shashwat Sehgal - ASW #376 · 1 h 15 minThe future of secure software is going through a mix of skills expected of humans and skills files created for LLMs. We might even posit that appsec as a discipline will fade…
- Why Proactive Security Is Far Better Than Patching - Erik Nost - ASW #375 · 38 minSo much of appsec's efforts can be consumed by vuln management and a race to patch security flaws. But that's more a symptom of the ease of scanning and the volume of CVEs. Erik…
- Creating Better Security Guidance and Code with LLMs - Mark Curphey - ASW #374 · 1 h 4 minWhat happens when secure coding guidance goes stale? What happens LLMs write code from scratch? Mark Curphy walks us through his experience updating documentation for writing…
- Making Medical Devices Secure - Tamil Mathi - ASW #373 · 1 h 3 minMedical devices are a special segment of the IoT world where availability and patient safety are paramount. Tamil Mathi explains why many devices need to fail open -- the…
- Modern AppSec that keeps pace with AI development - James Wickett - ASW #372 · 48 minAs more developers turn to LLMs to generate code, more appsec teams are turning to LLMs to conduct security code reviews. One of the biggest themes in all the discussion around…
- Helping Users with Practical Advice to Protect their Digital Devices - Runa Sandvik - ASW #371 · 1 h 0 minJournalists put a lot of effort into collecting information and protecting their sources, but everyone can benefit from having a digital environment that's more secure and more…
- Conducting Secure Code Analysis with LLMs - ASW #370 · 46 minA major premise of appsec is figuring out effective ways to answer the question, "What security flaws are in this code?" The nature of the question doesn't really change…
- Bringing Strong Authentication and Granular Authorization for GenAI - Dan Moore - ASW #369 · 1 h 9 minWhen it comes to agents and MCPs, the interesting security discussion isn't that they need strong authentication and authorization, but what that authn/z story should look like…
- Focusing on Proactive Controls in the Face of LLM-Assisted Malware - Rob Allen - ASW #368 · 1 h 7 minEveryone is turning to LLMs to generate code, including attackers. Thus, it's no great surprise that there are now examples of malware generated by LLMs. We discuss the…
- Building proactive defenses that reflect the true nature of modern software risk - Paul Davis - ASW #367 · 1 h 13 minSupply chain security remains one of the biggest time sinks for appsec teams and developers, even making it onto the latest iteration of the OWASP Top 10 list. Paul Davis joins…
- Lessons from MongoBleed, CWE Top 25, and Secure Coding Benchmarks - ASW #366 · 44 minMongoBleed and a recent OWASP CRS bypass show how parsing problems remain a source of security flaws regardless of programming language. We talk with Kalyani Pawar about how…
- Secure By Design Is Better Than Secure By Myth - Bob Lord - ASW #365 · 54 minNot all infosec advice is helpful. Bad advice wastes time, makes people less secure, and takes focus away from making software more secure. Bob Lord talks about his efforts to…
- The Upsides and Downsides of LLM-Generated Code - Chris Wysopal - ASW #364 · 1 h 10 minDevelopers are adding LLMs to their code creation toolboxes, using them to assist with writing and reviewing code. Chris Wysopal talks about the security downsides of relying on…
- AI-Era AppSec: Transparency, Trust, and Risk Beyond the Firewall - Felipe Zipitria, Steve Springett, Aruneesh Salhotra, Ken Huang - ASW #363 · 1 h 6 minIn an era dominated by AI-powered security tools and cloud-native architectures, are traditional Web Application Firewalls still relevant? Join us as we speak with Felipe…
- Modern AppSec: OWASP SAMM, AI Secure Coding, Threat Modeling & Champions - Sebastian Deleersnyder, James Manico, Adam Shostack, Dustin Lehr - ASW #362 · 1 h 7 minUsing OWASP SAMM to assess and improve compliance with the Cyber Resilience Act (CRA) is an excellent strategy, as SAMM provides a framework for secure development practices such…
- Developing Open Source Skills for Maintaining Projects - Kat Cosgrove - ASW #361 · 1 h 3 minOpen source projects benefit from support that takes many shapes. Kat Cosgrove shares her experience across the Kubernetes project and the different ways people can make…
- Making OAuth Scale Securely for MCPs - Aaron Parecki - ASW #360 · 1 h 7 minThe MCP standard gave rise to dreams of interconnected agents and nightmares of what those interconnected agents would do with unfettered access to APIs, data, and local systems…
- Making TN Critical Infrastructure the Most Secure in the Nation - T. Gwyddon 'Data' ("Gwee-thin") Owen, James Cotter - ASW #359 · 59 minFor OT systems, uptime is paramount. That's a hard rule that makes maintaining, upgrading, and securing them a complex struggle. Tomas "Data" Owens and James Cotter discuss how…
