AppSec Has Never Mattered More: The Time to Exploit Is Now Negative

When one AI model can find a vulnerability, another can write the exploit, and the gap between discovery and attack is collapsing. Hannah Foxwell, co-founder of BIMP and former product director for Snyk Container, joins Chris Romeo and Robert Hurlbut to argue that the time to exploit is now effectively negative, and that AppSec has never mattered more. Drawing on her path from release manager to DevOps, platform engineering, and container security, Hannah explains why security teams are facing an identity crisis, why a "dark software factory" with no human checks is a dangerous idea, and why so many AI security startups start with red teaming. The conversation also covers the industry's response to the flood of AI-discovered open source vulnerabilities, what leaders should measure beyond speed, and why empathy is still AppSec's most important tool. This episode is sponsored by Origin. Let your agents work. Keep them in sight. About Origin Origin is an endpoint AI observability platform that inventories, observes, and measures the usage of AI agents at scale. It gives organizations a record of what their agents do across endpoints, so security teams can monitor agent activity, investigate unexpected behavior, and enforce their policies. → Learn more about Origin This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. → Learn more about Corgea Connect with Hannah Foxwell: → Hannah Foxwell on LinkedIn → BIMP Mentioned in this episode: → IBM and Red Hat: Project Lightwell → Chainguard's Athena coalition → Linux Foundation: Akrites → Shadow MCP Servers with Vandana Verma Sehgal Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast Chapters: 00:00:00 - Cold open: security teams face an identity crisis 00:00:25 - Meet Hannah Foxwell 00:00:47 - Welcome and Hannah's origin story: from release manager to DevOps 00:06:34 - AI as an architecture partner 00:11:06 - From DevOps and platform engineering to AppSec 00:13:43 - Have we reached AI transformation? 00:15:21 - The dark software factory 00:20:33 - AppSec's identity crisis and the vulnerability tsunami 00:25:14 - Why AI security startups start with red teaming 00:27:31 - Does exploitability still matter? 00:29:07 - The time to exploit is now negative 00:30:16 - AppSec's role when every developer codes with AI 00:33:00 - Security training for agents and stale training data 00:37:54 - Trust, MCP, and layered threats 00:40:30 - Breaking the approval queue bottleneck 00:43:16 - Measuring speed and safety 00:45:41 - One behavior to change 00:47:26 - Wrap up Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast