Skip to content
Sign in
Artwork for The Application Security Podcast
TechnologyNewsTech NewsBusinessEntrepreneurship

The Application Security Podcast

Chris Romeo and Robert Hurlbut

The Application Security Podcast is a practitioner-led show for anyone building or securing modern software—and now AI-powered applications. Hosts Chris Romeo and Robert Hurlbut talk with the people shaping application security about AI and LLM security, threat modeling, secure development, OWASP, cloud, DevSecOps, security champions, and building programs that help engineering teams move faster and safer. With more than 300 episodes, the show turns real-world experience into practical guidance for developers, architects, AppSec professionals, and security leaders.

Play
Open in
  • 28 episodes
  • weekly
  • Avg 45 min
  • English

Episodes 28

NewestOldestLongest
All8Unplayed8In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • S12 · E18
    Sep 23, 2025 · 33 min

    Francesco Cipollone - Agentic AI Manifesto

    Most products labeled as AI agents are little more than chatbots with tools. Francesco Cipollone, founder and CEO of Phoenix Security, explains what makes an agent genuinely agentic and why his team uses multiple specialized models instead of one all-purpose system. He and the hosts unpack the Agentic AI Manifesto's principles, including responsible adoption, human augmentation, transparency, and resisting automation for its own sake. Francesco also shares the practical economics behind multi-agent systems and the difficulty of applying them safely to vulnerability remediation. The conversation cuts through inflated promises while preserving a realistic case for useful automation: agents should increase human capability, remain observable and bounded, and solve a defined problem instead of becoming another vague digital-transformation initiative. The Application Security Podcast is brought to you by Security Journey. About Security Journey Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results. → Learn more about Security Journey Connect with Francesco Cipollone: → Francesco Cipollone on LinkedIn → Phoenix Security Mentioned in this episode: → Phoenix Security → Cursor → ChatGPT Follow the Application Security Podcast: ➜ Home ➜ X ➜ LinkedIn ➜ YouTube ➜ Instagram ➜ Facebook Chapters: 00:00 Meet Francesco Cipollone 02:36 Are you sure Francesco is not a bot? 04:41 Why create an Agentic AI Manifesto? 07:08 Defining a true AI agent 09:21 The agent is not the LLM 09:43 Six models working as specialists 12:12 Why not use one super agent? 15:05 The manifesto's core principles 18:27 Augment people instead of replacing them 21:17 The emerging AI coach role 23:37 Escaping digital-transformation theater 24:23 Transformation never really ends 27:46 Agents and vulnerability remediation 31:27 Closing thoughts

  • S12 · E17
    Sep 16, 2025 · 36 min

    Simon Gibbs & Devika Gibbs -- Building Bridges with Games

    Security education often struggles because the people in the room are being talked at instead of invited to participate. Simon and Devika Gibbs, the duo behind CyberSec Games, explain how tabletop games can turn abstract security concepts into shared experiences that connect developers, security practitioners, and business teams. They trace their path from agile stationery into threat-modeling games, describe what they learned from Elevation of Privilege and OWASP Cornucopia, and discuss the community that helped shape their work. The pair also introduce the Cybersecurity Game Challenge, including who can enter, how ideas are judged, and what winning makes possible. Their larger argument is simple: play lowers barriers, creates conversation, and can make difficult security lessons memorable enough to change behavior. Today's episode is brought to you by Security Journey. About Security Journey Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including the OWASP Top 10. → Learn more about Security Journey Connect with Simon and Devika Gibbs: → Simon Gibbs on LinkedIn → Devika Gibbs on LinkedIn → CyberSec Games Mentioned in this episode: → CyberSec Games → Cybersecurity Game Challenge → Elevation of Privilege → OWASP Cornucopia → Threat Modeling Manifesto → Adam Shostack → EU Cyber Resilience Act Follow the Application Security Podcast: ➜ Home ➜ X ➜ LinkedIn ➜ YouTube ➜ Instagram ➜ Facebook Chapters: 00:00 Meet Simon and Devika Gibbs 02:39 From business analysis to game design 05:36 Printing the Threat Modeling Manifesto 06:27 What is CyberSec Games? 08:38 Games bring people together 11:13 A welcome from the security community 14:34 Building bridges across disciplines 18:00 Discovering Elevation of Privilege 19:35 The return on a simple card deck 22:45 How popular are security games? 26:21 The Cybersecurity Game Challenge 28:43 Judges and community contributors 30:33 What can the winner receive? 32:12 A future security-game reality show 33:29 How and when to enter 35:07 The audience homework assignment

  • S12 · E16
    Sep 2, 2025 · 35 min

    Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps

    APIs power modern applications, yet many AppSec programs still cannot reliably inventory them, model their threats, or enforce authorization. Akansha Shukla draws on more than a decade in application security and DevSecOps to explain why API security remains immature and what practitioners can do about it. She and the hosts examine the OWASP API Security Top 10, broken object-level authorization, API-specific threat modeling, and the role of posture management. The conversation also asks why foundational controls such as input validation remain difficult despite strong framework support, and whether declarations that shift left is dead reflect reality or marketing. Akansha closes with practical guidance for building developer understanding, integrating security throughout delivery, and treating APIs as first-class elements of architecture rather than invisible plumbing. The Application Security Podcast is brought to you by Security Journey. About Security Journey We provide diverse training content and easy-to-digest lessons to meet individual learner needs. Learners report improving their knowledge as much as 85% on AppSec topics. → Learn more about Security Journey Connect with Akansha Shukla: → Akansha Shukla on LinkedIn → Women4Cyber Mentorship Programme Mentioned in this episode: → OWASP API Security Top 10 → Burp Suite Professional → Women4Cyber Mentorship Programme → OAuth 2.0 Follow the Application Security Podcast: ➜ Home ➜ X ➜ LinkedIn ➜ YouTube ➜ Instagram ➜ Facebook Chapters: 00:00 Meet Akansha Shukla 03:11 Moving from engineering into security 06:13 Why development knowledge matters 09:09 Using the OWASP API Security Top 10 11:55 Authorization and API guardrails 14:46 Threat modeling APIs 17:26 Why teams skip API threat models 18:49 Is the barrier knowledge or process? 21:15 The role of API security posture management 22:25 Why API inventory is still difficult 24:41 Framework support versus real adoption 27:43 Did security make the paved road too hard? 28:14 Why input validation remains unsolved 29:39 Is shift left dead? 33:04 Akansha's key takeaway 34:55 Closing thoughts

  • S12 · E15
    Aug 20, 2025 · 40 min

    Getting Ready for the EU CRA

    The EU Cyber Resilience Act turns product security from a best practice into a market-access requirement, and its effects extend well beyond Europe. Application Security Architect and OWASP SAMM core team member Nariman Aga-Tagiyev explains what manufacturers need to know about product classes, conformity assessments, vulnerability handling, software components, and enforcement. He and the hosts explore why global software companies should care, how the rules apply to commercial uses of open source, and what implementation may look like as regulators and assessors mature. Nariman then connects compliance to practical improvement through OWASP SAMM, BSIMM, DSOMM, and openCRE. His recommendation is to start with a maturity assessment now, identify gaps team by team, and use the regulation as leverage for sustainable security rather than a last-minute paperwork exercise. Connect with Nariman Aga-Tagiyev: → Nariman Aga-Tagiyev on LinkedIn → OWASP SAMM Mentioned in this episode: → EU Cyber Resilience Act → OWASP SAMM → BSIMM → OWASP DevSecOps Maturity Model → openCRE → Linux Foundation Follow the Application Security Podcast: ➜ Home ➜ X ➜ LinkedIn ➜ YouTube ➜ Instagram ➜ Facebook Chapters: 00:00 Meet Nariman Aga-Tagiyev 02:48 From competitive programming to AppSec 05:40 Learning security through software architecture 09:21 Nariman's work with OWASP 09:49 What the EU Cyber Resilience Act changes 13:12 Product classes and conformity assessment 16:15 Will certification work across Europe? 17:17 How complicated is CRA compliance? 18:49 Does the Act reference OWASP SAMM? 20:49 Why should companies care? 21:44 Three perspectives on the regulation 25:40 Assessing readiness team by team 28:20 How the CRA treats open source 30:04 Commercial activity in the supply chain 34:19 How enforcement may develop 36:37 Start with a maturity framework 38:27 Mapping requirements with openCRE 39:49 Closing thoughts

  • S12 · E13
    Aug 5, 2025 · 50 min

    Marisa Fagan - Measuring Security Culture

    Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value. Marisa Fagan, Head of Product at Katilyst and a veteran security-culture practitioner, shares a practical blueprint for piloting and scaling a program that lasts. She explains how to recruit and motivate champions using status, access, power, and stuff, why a pilot should produce both learning and a business case, and which anti-patterns quietly destroy trust. Marisa and the hosts also examine metrics for security culture, the role of qualitative evidence, and how champion models can extend to privacy and accessibility. The episode offers concrete guidance for building participation without turning volunteers into unpaid security staff. The Application Security Podcast is brought to you by Security Journey. About Security Journey We provide application security training for not just your developers, but for all roles in your SDLC. → Learn more about Security Journey Connect with Marisa Fagan: → Marisa Fagan on LinkedIn → Katilyst Mentioned in this episode: → Security Champion Success Guide → OWASP Security Champions Guide → People-Centric Security → Katilyst → Kim Wuyts Follow the Application Security Podcast: ➜ Home ➜ X ➜ LinkedIn ➜ YouTube ➜ Instagram ➜ Facebook Chapters: 00:00 Meet Marisa Fagan 03:02 What security culture means 05:44 Why security champions programs matter 08:36 Starting with organizational context 11:26 Recruiting the right champions 14:58 The components of an effective pilot 18:00 Turning a pilot into a business case 18:52 Motivating champions with SAPS 22:06 Status, access, power, and stuff 25:30 Common program anti-patterns 29:16 Chris's biggest champions-program mistake 32:15 Metrics that demonstrate success 35:02 Qualitative evidence and culture change 37:32 How security careers shape the advice 41:33 Creating space to share challenges 46:10 Beyond security champions 49:04 Closing thoughts

  • S12 · E12
    Jul 22, 2025 · 40 min

    Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics

    A dashboard full of green indicators can still describe an insecure organization. Aram Hovsepyan, founder and CEO of Codific and an OWASP SAMM contributor, explains why vulnerability totals and unexamined CVSS scores often measure activity instead of security outcomes. He introduces the Goal Question Metric framework as a way to begin with an organizational goal, ask what must be understood, and choose measurements that answer those questions. Aram and the hosts distinguish precision, reliability, and accuracy, examine how metrics shape behavior, and identify overlooked indicators that show whether a program is actually moving. They also discuss redesigning executive dashboards and testing a long-standing metric from Chris. The takeaway: a useful metric must support a decision, reflect context, and make its limitations visible. The Application Security Podcast is brought to you by Security Journey. About Security Journey Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results. → Learn more about Security Journey Connect with Aram Hovsepyan: → Aram Hovsepyan on LinkedIn → Codific Mentioned in this episode: → Goal Question Metric framework → LINDDUN → Codific → OWASP SAMM → Kim Wuyts → Security Compass → Toreon Follow the Application Security Podcast: ➜ Home ➜ X ➜ LinkedIn ➜ YouTube ➜ Instagram ➜ Facebook Chapters: 00:00 Why your security dashboard may be lying 01:25 Meet Aram Hovsepyan 02:43 From privacy research to AppSec 06:30 The inspiration behind the talk 09:44 How common security metrics fail 11:35 If every metric is green, are you secure? 13:23 Metrics drive human behavior 16:48 Introducing Goal Question Metric 18:38 Precision, reliability, and accuracy 22:05 Good numbers can answer the wrong question 26:43 Why total vulnerability counts mislead 28:30 The metrics teams overlook 31:52 Measuring movement, not perfection 33:13 Redesigning a security dashboard 35:04 Testing Chris's long-standing metric 38:22 What a useful metric must reveal 40:09 Closing thoughts Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast

  • S12 · E11
    Jul 15, 2025 · 47 min

    Sean Varga -- OWASP Top 10 for AppSec Sales

    We’re discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga. Sean shares the unique challenges and best practices in AppSec sales, like the importance of empathy, understanding customer needs, and community participation. Learn about the OWASP top 10 for AppSec Sales and discover how to achieve success by aligning with customer goals, maintaining detailed living documents, and fostering strong partnerships. FOLLOW OUR SOCIAL MEDIA: ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  • S12 · E10
    Jul 9, 2025 · 37 min

    Sarah-Jane Madden -- What AI means for AppSec

    Sarah Jane Madden joins us to discuss the evolving role of AI in software development. We reflect on the changes and challenges posed by AI, including the potential for over-reliance and the misconception that traditional software engineering practices like the SDLC are obsolete. The conversation explores the nuances of AI-generated code, emphasizing the importance of maintaining foundational engineering skills and a critical understanding of the tools used. Madden shares insights from her keynote at OWASP Barcelona and stresses the need for responsible and thoughtful integration of AI in development workflows. Key takeaways include leveraging AI for efficiency while avoiding complacency and ensuring a deep, ongoing engagement with code and quality practices. Previous Episode with Sarah-Jane Madden: Threat Modeling to Established Teams FOLLOW OUR SOCIAL MEDIA: ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Showing 21–28 of 28 episodes