Josh Grossman--AI & SAST: Is it a match?
AI coding tools are accelerating development fast, but they’re also exposing the limits of traditional AppSec tooling.
Listen to the episodeTopic
API Security
REST and GraphQL, authentication and authorization, and the object-level access control failures that dominate real breaches.
25 episodes
Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets
GitGuardian found 29 million hard-coded secrets leaked in public GitHub commits in a single year, a 34% jump and the biggest spike they've ever recorded.
Listen to the episodeAkansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps
Our guest today is Akansha Shukla, an information security professional with over 10 years of experience in application security, DevSecOps, and API security.
Listen to the episodeMatin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements
Matin Mavaddat discusses his perspective on security as a systemic concern, developed from his background in requirements engineering and systems architecture.
Listen to the episodeJeff Williams -- Application Detection & Response (ADR)
Jeff Williams, a renowned pioneer in the field of application security is with us to discuss Application Detection and Response (ADR), detailing its…
Listen to the episodeAndrew Van Der Stock -- The New OWASP Top Ten
Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode.
Listen to the episodeJames Berthoty -- Is DAST Dead? And the future of API security
James Berthoty, a cloud security engineer with a diverse IT background, discusses his journey into application and product security.
Listen to the episodeMukund Sarma -- Developer Tools that Solve Security Problems
Mukund Sarma, the Senior Director for Product Security at Chime, talks with Chris about his career path from being a software engineer to becoming a leader in application security.
Listen to the episodeJoshua Wells -- Application Security in the Age of Zero Trust
What is zero trust, and how does it impact the world of applications and application security?
Listen to the episodeNick Aleks and Dolev Farhi -- GraphQL Security
Dolev Farhi is a security engineer and author with extensive experience leading security engineering teams in complex environments and scales in the Fintech and cyber security industries.
Listen to the episodeBrett Smith -- Security is a Necessary Evil
Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience.
Listen to the episodeNeil Matatall -- AppSec at Scale
Neil Matatall is an engineer with a background in security. He has previously worked at GitHub and Twitter and is a co-founder of Loco Moco Product Security Conference.
Listen to the episodeOWASP Top 10 2021 Peer Review
Robert and I break down the OWASP Top 10 2021 Peer Review Edition. We walk through and give you our insights and highlights of the things that stand out to us and our questions.
Listen to the episode42 mintranscript
Liran Tal — Cloud native application security, what’s a developer to do?
Liran Tal is an application security activist and long-time proponent of open-source software.
Listen to the episodeDmitry Sotnikov – REST API Security – there is no silver bullet
Dmitry Sotnikov serves as Chief Product Officer at 42Crunch – an enterprise API security company.
Listen to the episodeGrant Ongers — Gamification of threat modeling
Grant Ongers is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package.
Listen to the episodeZsolt Imre — Fuzz testing is easy
Zsolt is the founder and CTO of GUARDARA with more than 15 years of experience in cybersecurity, both on the offensive and defensive side. Zsolt explains fuzz testing, who does it, and why.
Listen to the episode37 mintranscript
Erez Yalon — The OWASP API Security Project
Erez Yalon heads the security research group at Checkmarx. With vast defender and attacker experience and as an independent security researcher, he brings invaluable knowledge and skills to the table.
Listen to the episode47 mintranscript
Geoff Hill -- Rapid Threat Model Prototyping Process
Geoff Hill joins Chris and Robert to talk about Rapid Threat Model Prototyping Process. You can find Geoff on Twitter @Tutamantic_Sec
Listen to the episode31 mintranscript
Tony UV -- Threat Libraries in the Cloud
Tony UV joins Robert to discuss all things threat libraries in the cloud. You can find Tony on Twitter @t0nyuv
Listen to the episode31 mintranscript
Jim Manico -- The #OWASP Cheat Sheet Project
Jim Manico joins us to discuss some of the changes with the OWASP Cheat Sheets and their plans for that project's future.
Listen to the episode47 mintranscript
Robert Hurlbut -- Threat Modeling
On this week's episode of the #AppSec Podcast, Chris and Robert are at #AppSecUSA. We hear a conference talk done by Robert on the topic of Threat Modeling.
Listen to the episode45 mintranscript
Jon Mccoy and Jonathan Marcil -- Agile #AppSec
Robert and Chris speak with Jon Mccoy and Jonathan Marcil about using Agile #AppSec in the Secure Development Lifecycle.
Listen to the episode44 mintranscript
Dave Ferguson -- The OWASP Top 10 Proactive Controls
Dave Ferguson discusses the OWASP Top 10 Proactive Controls in this episode with Chris.
Listen to the episode31 mintranscript
Chris and Robert -- Controversy within the OWASP Top 10 RC
On this episode of the application security podcast, Robert and I jump over a wall. Just kidding. This isn’t Top Gear. This is our second episode of season two of the #AppSec PodCast.
Listen to the episode