Michael Burch - AI-Enabled Citizen Developers
AI adoption is accelerating faster than most organizations know how to handle it, and the gap between curiosity and confident use is where things go wrong.
Listen to the episodeTopic
Careers in AppSec
Getting into application security and going further — origin stories, hiring, mentoring, certifications, and teaching the next generation.
41 episodes
OWASP Candidate Debate - 2025 Edition
In this special episode of the Application Security Podcast we meet nine of the OWASP Board of Directors candidates.
Listen to the episodeMarisa Fagan - Measuring Security Culture
Marisa Fagan, Head of Product at Katilyst and veteran security culture expert joins us today to share practical strategies for building and scaling security…
Listen to the episodeJim Routh -- The CISO Transition to the rest of life
Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity.
Listen to the episodePhillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing
Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking.
Listen to the episodeDerek Fisher -- Hiring in Cyber/AppSec
Derek Fisher, an expert in hardware, software, and cybersecurity with over 25 years of experience is back on the podcast.
Listen to the episodeDavid Quisenberry -- Building Security, People, and Programs
David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making.
Listen to the episodeDevin Rudnicki -- Expanding AppSec
Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role.
Listen to the episodeDustin Lehr -- Culture Change through Champions and Gamification
Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions.
Listen to the episodeMeghan Jacquot -- Assumed Breach Red Team Engagements for AppSec
AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises.
Listen to the episodeBill Sempf -- Development, Security, and Teaching the Next Generation
Robert is joined by Bill Sempf, an application security architect with over 20 years of experience in software development and security.
Listen to the episodeArshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io
Arshan Dabirsiaghi of Pixee joins Robert and Chris to discuss startups, AI in appsec, and Pixee's Codemodder.io.
Listen to the episodeDr. Jared Demott -- Cloud Security & Bug Bounty
Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity.
Listen to the episodeRay Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring
For Security Pros & Business Leaders | Strategic Insights & Leadership Lessons 🔒🌟 When Ray Espinoza joined Chris and Robert on the Application…
Listen to the episodeTanya Janca -- What Secure Coding Really Means
Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world.
Listen to the episodeHasan Yasar -- Actionable SBOM via DevSecOps
Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively.
Listen to the episodeOWASP Board of Directors Debate
The Application Security Podcast presents the OWASP Board of Directors Debate for the 2023 elections. This is a unique and engaging discussion among six candidates vying for a position on the board.
Listen to the episodeKevin Johnson -- Samurai Swords and Zap's Departure
Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date.
Listen to the episodeTony Quadros -- The Life of an AppSec Vendor
Tony Quadros, the AppSec Lumberjack, shares the unique career path that led him to find his passion in Application Security.
Listen to the episodeJeevan Singh -- The Future of Application Security Engineers
Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers.
Listen to the episodeChristian Frichot -- Threat Modeling with hcltm
Christian Frichot, an AppSec hacker, security leader, and developer of hcltm. He discusses the DevOps threat modeling tool he dreamed up and built.
Listen to the episodeRobyn Lundin -- Planning & organizing a penetration test as an AppSec team
Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup.
Listen to the episodeWolfgang Goerlich -- Security beyond vulnerabilities
J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals.
Listen to the episodeAdam Shostack -- Fast, cheap and good threat models
Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security.
Listen to the episodeTimo Pagel -- DevSecOps Maturity Model
Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer.
Listen to the episode54 mintranscript
James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed
Dr. James Ransome is the Chief Scientist for CyberPhos, an early-stage cybersecurity startup.
Listen to the episodeCharles Shirer -- The most positive person in security
Charles is a Senior Security Consultant for Red Siege. He has over 18 years of experience in IT.
Listen to the episode29 mintranscript
Vandana Verma — Support each other
Vandana Verma is a passionate advocate for application security. From serving on the OWASP Board to running various groups promoting security to organizing…
Listen to the episode28 mintranscript
Chris and Robert: A Taste of Hi-5
As the hosts of the Application Security Podcast, we get the opportunity from time to time to mix it up.
Listen to the episode44 mintranscript
Marc French — The AppSec CISO
Marc French is a security person, firearms geek, scuba guy, lousy golfer, and an aspiring blacksmith. We met Marc in the hallway at the Boston Application Security Conference.
Listen to the episode38 mintranscript
Season 5 Finale — A cross section of #AppSec
Threat modeling, secrets, mentoring, self-care, program building, and much more. Clips from Georgia Weidman, Simon Bennetts, Izar Tarandach, Omer Levi…
Listen to the episode38 mintranscript
Ronnie Flathers — Security programs big and small
Ronnie Flathers is a security guy, a pentester, and a researcher. In this conversation, we explore his experiences in building application security programs.
Listen to the episode29 mintranscript
Elissa Shevinsky — Static Analysis early and often
Elissa Shevinsky is CEO at Faster Than Light. She's had a storied career as an entrepreneur with Brave, Everyday Health, and Geekcorps.
Listen to the episode41 mintranscript
Caroline Wong — Self-care and self-aware for security people
Caroline Wong has had a long career in security, starting with eBay and leading to her role today at Cobalt.IO as Chief Strategist.
Listen to the episode5 mintranscript
Tanya Janca — Mentoring Monday — 5 Minute AppSec
Tanya Janca is excited about mentoring. She's started a hashtag on Twitter for mentors to find mentee's, and for mentee's to search for mentors.
Listen to the episode36 mintranscript
Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program
Chris and Robert talk with Adam and John from HackerOne about Bug Bounty. They dive into bug bounty from the programming and security researcher sides to…
Listen to the episode35 mintranscript
Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec
Jessie and Vandana join Chris from Women in #AppSec to discuss the project! They dive into what the project is and how the numerous OWASP Chapters around the world can participate!
Listen to the episode37 mintranscript
Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?
Greetings all! We have a treat for you in this episode. The crew joins Robert and me from the Down the Security Rabbit Hole Podcast.
Listen to the episode37 mintranscript
Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security
In this episode, Robert and I are joined by Tracy Maleeff. Tracy is an InfoSec enthusiast with an MLIS degree. She has mad research and organizational skills. She co-hosts the PVCSec podcast.
Listen to the episode38 mintranscript
Deidre Diamond -- The Soft Skills of AppSec
We are joined by Deidre Diamond, Founder, and CEO @cyber_sn & the Founder of @brain_babe. We discuss employment in the world of application security.
Listen to the episode50 mintranscript
Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL
This is our second interview at ISC2 Security Congress. We are joined by Glenn Leifheit (@gleifhe), an InfoSec and Development Evangelist at Microsoft.
Listen to the episode