The Cringe Test: Why AI Can't Do Privacy Threat Modeling for You
Can AI do your privacy threat modeling for you? Dr. Kim Wuyts and Avi Douglen say no, and their answer comes down to something AI doesn't have: the cringe.
Listen to the episodeAll episodes
316 episodes, going back to 2016.
AppSec Has Never Mattered More: The Time to Exploit Is Now Negative
When one AI model can find a vulnerability, another can write the exploit, and the gap between discovery and attack is collapsing.
Listen to the episodeYour Developers Are Letting AI Answer Your Security Findings
Are your developers still reading their security findings, or are their agents answering for them?
Listen to the episodeShadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops
What happens when a protocol goes from idea to everywhere before security can catch up?
Listen to the episodeYour Opinion on AI Doesn't Matter. Learned Fragility Does
What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E.
Listen to the episodeWhy AI Code Review Will Replace Human Review Faster Than You Think
Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company.
Listen to the episodeVulnerability Jail and the AI-Era AppSec Engineer
Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since.
Listen to the episodeHow Agentic AI Fails—and Which Controls Actually Stop It
Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents.
Listen to the episodeYour AppSec Bottleneck Is a People Problem
Most security champions programs don't fail on tooling — they fail on people. Lisi Hocke spent three years as a champion before moving fully into product…
Listen to the episodeAI Pen Testing Killed Traditional DAST
Is traditional DAST finally dead? James Berthoty came back to settle the argument that his last episode started.
Listen to the episodeAI Security: OWASP Meets Global Standards
AI security has no shortage of standards — the problem is turning them into something a team can actually use.
Listen to the episodeThe Future of Open-Source Threat Modeling
You don't have to let AI do the thinking for you. In this episode, Vikram Narayan shares why the smartest teams use AI as an accelerant — not a replacement…
Listen to the episodeIsaac Evans - AppSec in the Age of AI
AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it?
Listen to the episodeJosé Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling?
Listen to the episodeMichael Burch - AI-Enabled Citizen Developers
When every employee can generate working software, who owns the risk? Michael Burch, VP of AI Enablement and Acceleration at Security Journey, explains how…
Listen to the episodeJosh Grossman--AI & SAST: Is it a match?
Traditional SAST is deterministic but shallow; AI can reason about context but may answer differently every time. Can the two approaches make each other better?
Listen to the episodeDwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets
GitGuardian found 29 million hard-coded secrets in public GitHub commits in one year—a 34% increase and its largest jump yet. Why is a supposedly simple problem getting worse?
Listen to the episodeTanya Janca - Secure Vibe Coding
If AI writes all the code and the developer barely reads it, where does AppSec fit?
Listen to the episodeCaroline Wong--The AI Cybersecurity Handbook
AI is multiplying the amount of software organizations produce, but security teams are not multiplying with it.
Listen to the episodeSteve Wilson--OpenClaw and Advanced AI Agents
OpenClaw makes always-on personal AI agents feel inevitable—and exposes how poorly prepared most organizations are for their autonomy.
Listen to the episodeBrad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows
AppSec teams are drowning in repetitive triage while the work that requires judgment keeps piling up.
Listen to the episodeOWASP Candidate Debate - 2025 Edition
What should OWASP become, and which leaders have a credible plan to get it there? In this special 2025 Board of Directors candidate debate, nine candidates…
Listen to the episodeFrancesco Cipollone - Agentic AI Manifesto
Most products labeled as AI agents are little more than chatbots with tools. Francesco Cipollone, founder and CEO of Phoenix Security, explains what makes…
Listen to the episodeSimon Gibbs & Devika Gibbs -- Building Bridges with Games
Security education often struggles because the people in the room are being talked at instead of invited to participate.
Listen to the episode