The Application Security Podcast
by Chris Romeo and Robert Hurlbut
Latest episode
We Told the Agent No 11 Times. It Did It Anyway
We Told the Agent No 11 Times. It Did It Anyway
About this podcast
The Application Security Podcast is a practitioner-led show for anyone building or securing modern software—and now AI-powered applications. Hosts Chris Romeo and Robert Hurlbut talk with the people shaping application security about AI and LLM security, threat modeling, secure development, OWASP, cloud, DevSecOps, security champions, and building programs that help engineering teams move faster and safer. With more than 300 episodes, the show turns real-world experience into practical guidance for developers, architects, AppSec professionals, and security leaders.
Episodes
The newest 20 of 317 episodes
- We Told the Agent No 11 Times. It Did It Anyway · 46 min · Season 13 Episode 20Jason Lemkin told the Replit agent eleven times not to touch anything, and it deleted his production database anyway. So who tells an agent no? Rock Lambros, who helps lead the…
- The Cringe Test: Why AI Can't Do Privacy Threat Modeling for You · 51 min · Season 13 Episode 19Can AI do your privacy threat modeling for you? Dr. Kim Wuyts and Avi Douglen say no, and their answer comes down to something AI doesn't have: the cringe. Kim and Avi join Chris…
- AppSec Has Never Mattered More: The Time to Exploit Is Now Negative · 48 min · Season 13 Episode 18When one AI model can find a vulnerability, another can write the exploit, and the gap between discovery and attack is collapsing. Hannah Foxwell, co-founder of BIMP and former…
- Your Developers Are Letting AI Answer Your Security Findings · 49 min · Season 13 Episode 17Are your developers still reading their security findings, or are their agents answering for them? Ahmad Sadeddin, founder and CEO of Corgea, brings data from Corgea's customers…
- Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops · 47 min · Season 13 Episode 16What happens when a protocol goes from idea to everywhere before security can catch up? Vandana Verma Sehgal, leader of the OWASP MCP Top 10, returns to explain why most…
- Your Opinion on AI Doesn't Matter. Learned Fragility Does · 53 min · Season 13 Episode 15What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E. Schoenfield, CTO of Rezliant and author of…
- Why AI Code Review Will Replace Human Review Faster Than You Think · 49 min · Season 13 Episode 14Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company. The founder of Manicode Security returns to explain why AI didn't kill…
- Vulnerability Jail and the AI-Era AppSec Engineer · 45 min · Season 13 Episode 13Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. Jeevan, Director of Security Engineering at…
- How Agentic AI Fails—and Which Controls Actually Stop It · 37 min · Season 13 Episode 12Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at…
- Your AppSec Bottleneck Is a People Problem · 48 min · Season 13 Episode 11Most security champions programs don't fail on tooling — they fail on people. Lisi Hocke spent three years as a champion before moving fully into product security, which means…
- AI Pen Testing Killed Traditional DAST · 44 min · Season 13 Episode 10Is traditional DAST finally dead? James Berthoty came back to settle the argument that his last episode started. James is the founder and analyst behind Latio, and he argues that…
- AI Security: OWASP Meets Global Standards · 48 min · Season 13 Episode 9AI security has no shortage of standards — the problem is turning them into something a team can actually use. Rob van der Veer has spent 34 years in AI and security, founded the…
- The Future of Open-Source Threat Modeling · 40 min · Season 13 Episode 8You don't have to let AI do the thinking for you. In this episode, Vikram Narayan shares why the smartest teams use AI as an accelerant — not a replacement — and why human…
- Isaac Evans - AppSec in the Age of AI · 49 min · Season 13 Episode 7AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it? Semgrep…
- José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists · 53 min · Season 13 Episode 8Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling? Okta's José Carlos Chávez joins Chris to explain what changed in the…
- Michael Burch - AI-Enabled Citizen Developers · 49 min · Season 13 Episode 6When every employee can generate working software, who owns the risk? Michael Burch, VP of AI Enablement and Acceleration at Security Journey, explains how AI is turning…
- Josh Grossman--AI & SAST: Is it a match? · 40 min · Season 13 Episode 5Traditional SAST is deterministic but shallow; AI can reason about context but may answer differently every time. Can the two approaches make each other better? Bounce Security…
- Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets · 45 min · Season 13 Episode 4GitGuardian found 29 million hard-coded secrets in public GitHub commits in one year—a 34% increase and its largest jump yet. Why is a supposedly simple problem getting worse?…
- Tanya Janca - Secure Vibe Coding · 48 min · Season 13 Episode 3If AI writes all the code and the developer barely reads it, where does AppSec fit? Tanya Janca returns to define vibe coding and explain why models trained on insecure public…
- Caroline Wong--The AI Cybersecurity Handbook · 45 min · Season 13 Episode 2AI is multiplying the amount of software organizations produce, but security teams are not multiplying with it. Caroline Wong, author of The AI Cybersecurity Handbook and Chief…
