About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.
Latest episodes
-
55 min
Securing Modern Financial Systems in the Age of AI - Rashid Feroze - ASW #406
Proactive security doesn't have to wait for a vuln to be disclosed. Even if a patch isn't available, it's possible to deploy controls and design systems to be resilient against how…
-
53 min
Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 - Jan Seredynski, Ryan Lloyd - A…
The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification stan…
-
54 min
What's Not Found in AppSec? - ASW #404
To celebrate our 404th episode we discuss what's not found in modern appsec and what still exists that should become not found. The conversation starts with a classic problem of ap…
-
1 h 10
Getting Granular with Access, Attributes, and Intent - Alex Olivier - ASW #403
The principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explains how the AuthZen Working Group has been approac…
-
1 h 02
Going From Bug Bounty Bugs to More Secure Systems - Shlomie Liberow - ASW #402
Finding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a decad…
-
1 h 00
Understanding Prompt Injection In Order to Contain It - Julie Brunias - ASW #401
Prompt injection demonstrates one of the major challenges in securing LLMs and agents -- how do you ensure an agent ignores attackers and only does what you instructed it to do. Th…
-
53 min
The AI Threat Multiplier: Securing Mobile Apps in the Automated Era - Ryan Lloyd, Jason Cortlund - ASW #400
While agents and LLMs haven't fundamentally changed core mobile vulnerability types, they have supercharged speed, scale, and accessibility—democratizing threats like automated phi…
-
1 h 09
Security Conversations on AI, Agents, and Emerging Threats from Black Hat 2026 - Michael Leland, Ido Geffen, S…
We showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island Agents can independ…
-
1 h 08
Fixing Software Weaknesses Rather Than Just Finding More Flaws - Gil Geron, Nidhi Aggarwal, Braden Russell - A…
AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patchi…
-
1 h 06
Applying Zero Trust Principles to Agents - Kieran Human - ASW #397
Sandboxing, least privilege, and monitoring are well-established controls in terms of the defenses they provide against unexpected and unauthorized actions. But being well-establis…
-
1 h 09
Augmenting Threat Intel Analysis with Agents - Chris Wallis, Sai Kiran Uppu, Ramin Farassat - ASW #396
All sorts of cybersecurity disciplines are adopting agents to help humans save time and automate routine activities. Sai Kiran Uppu describes his work on creating a platform for ag…
-
1 h 09
Using LLMs for Vuln Discovery - Rishi Sharma - ASW #395
Finding flaws has always been a focus of appsec. And now with open source projects and open weight models orgs have modern tools to review code and conduct pentests. Rishi Sharma d…
-
1 h 03
Prompting for Patches That Fix Vulns Without Adding New Ones - Keith Hoodlet - ASW #394
There's already an increase in volume of security flaws found by LLMs. And orgs are already turning to LLMs to write code. So, what happens when orgs lean on LLMs to create patches…
-
1 h 09
Inside the OWASP Agent Security Regression Harness Project - Mert Satilmaz - ASW #393
Orgs need to be able to use agents, MCPs, and LLMs in ways that don't lead to unexpected actions and undesirable outcomes. The OWASP Agent Security Regression Harness project is an…
-
1 h 12
MacOS Security Design Features, Flaws, And Futures - Patrick Wardle - ASW #392
Appsec often frames usability and security as at odds with each other. Apple's software has famously emphasized the importance of usability while also creating a solid security fou…
-
1 h 07
Discovering & Securing Your AI Agent Attack Surface - Jeremy Snyder - ASW #391
While LLMs and agents are new to appsec and everyone else, a lot of AI security requirements translate to well-known API security requirements. Jeremy Snyder helps us frame the OWA…
-
48 min
Defense-in-depth strategies for securing mobile applications - Ryan Lloyd - ASW #390
Mobile applications have unique risks and threat models compared to server-side applications and infrastructure. Consequently, they need different strategies to ensure their busine…
-
1 h 12
Reducing Attack Surface & Evaluating Efficiency in Agents - Itamar Apelblat, David Goldschlag - ASW #389
SquidBleed reveals another vuln that's been lurking for decades, but its real lesson is in managing an attack surface. Regardless of whatever programming language you use, removing…
-
1 h 10
How AI Is Reshaping Identity Security at the Infrastructure Layer - Amit Masand, Neha Duggal, Ev Kontsevoy - A…
Appsec has seen machine identities from daemons and processes to services, microservices, and cloud accounts. And now we have agents. Ev Kontsevoy talks about what it means to have…
-
1 h 06
Why Does It Matter Who or What Created the Code? - Matias Madou - ASW #387
Agents and LLMs are creating and reviewing code. They're a new tool to help developers write software and they're a new abstraction layer for expressing what code should do. But if…