José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
In this episode, we sit down with Jose Carlos Chavez from Okta to break down the OWASP Top 10 for 2025 and what actually changed since 2021.
Listen to the episodeTopic
OWASP Top 10
The list that most organisations meet first, how each revision was assembled, and what it is and is not good for.
40 episodes
Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets
GitGuardian found 29 million hard-coded secrets leaked in public GitHub commits in a single year, a 34% jump and the biggest spike they've ever recorded.
Listen to the episodeSteve Wilson--OpenClaw and Advanced AI Agents
In this episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut welcome back Steve Wilson, a global leader in AI security and Chief AI…
Listen to the episodeAkansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps
Our guest today is Akansha Shukla, an information security professional with over 10 years of experience in application security, DevSecOps, and API security.
Listen to the episodeSean Varga -- OWASP Top 10 for AppSec Sales
We’re discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga.
Listen to the episodeHenrik Plate -- OWASP Top 10 Open Source Risks
Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies.
Listen to the episodeAndrew Van Der Stock -- The New OWASP Top Ten
Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode.
Listen to the episodeMark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding
Mark Curphey and Simon Bennetts, join Chris on the podcast to discuss the challenges of funding and sustaining major open source security projects like ZAP.
Listen to the episodeSteve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release
Steve Wilson and Gavin Klondike are part of the core team for the OWASP Top 10 for Large Language Model Applications project.
Listen to the episodeSteve Wilson -- OWASP Top Ten for LLMs
How do we do security in the world of AI and LLMs? A great place to start is with an OWASP project tasked with creating a standardized guideline for…
Listen to the episodeJet Anderson -- The AppSec Code Doctor
Jet Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines, at speed and scale, without missing a beat.
Listen to the episodeMichael Bargury -- Low Code / No Code Security and an OWASP Top Ten
Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps.
Listen to the episodeMark Curphey -- The future of OWASP
Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight.
Listen to the episodeOmer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks
Daniel Krivelevich is a cybersecurity expert and problem solver, with 15+ years of enterprise security experience with a proven track record working with…
Listen to the episodeSimon Bennetts -- Using OWASP Zap across an Enterprise
Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix…
Listen to the episodeOWASP Top 10 2021 Peer Review
Robert and I break down the OWASP Top 10 2021 Peer Review Edition. We walk through and give you our insights and highlights of the things that stand out to us and our questions.
Listen to the episodeThinking back, Looking forward - A Balanced Approach to Securing our Software Future
Kevin Greene is the Director of Security Solutions at Parasoft and has extensive experience and expertise in software security, cyber research and development, and DevOps.
Listen to the episode50 mintranscript
Frank Rietta — The convergence of Ruby on Rails and #AppSec
Frank Rietta is the CEO of Rietta.com, a Security Focused Web Application Firm. He is a web application security architect, expert witness, author, and speaker.
Listen to the episodeMichael Furman — SameSite Cookies
Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products.
Listen to the episode37 mintranscript
Erez Yalon — The OWASP API Security Project
Erez Yalon heads the security research group at Checkmarx. With vast defender and attacker experience and as an independent security researcher, he brings invaluable knowledge and skills to the table.
Listen to the episode25 mintranscript
Simon Bennetts — OWASP ZAP: past, present, and future
Simon Bennetts is the project leader for OWASP ZAP. Simon joined Robert at CodeMash to talk about the origin of ZAP, the new heads up display, and ZAP API.
Listen to the episode45 mintranscript
Daniel Miessler -- OWASP IoT Top 10
Daniel Miessler joins Chris and Robert to talk about the upcoming Top 10 list for IoT. You can find Daniel on Twitter @DanielMiessler IoT Project
Listen to the episode32 mintranscript
Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo
We listen in on the #AppSecUSA talk by Chris about Security Culture Hacking. You can find Chris on Twitter @edgeroute
Listen to the episode44 mintranscript
Jeff Williams -- The History of OWASP
Chris talks with Jeff Williams about the History of OWASP and where it came from. You can find Jeff on Twitter @planetlevel
Listen to the episode35 mintranscript
Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec
Jessie and Vandana join Chris from Women in #AppSec to discuss the project! They dive into what the project is and how the numerous OWASP Chapters around the world can participate!
Listen to the episode23 mintranscript
Apollo Clark -- Malicious User Stories
In this episode, Robert speaks about Malicious User Stories and DevOps with Apollo Clark. He discusses how to properly handle user stories in a world being taken over by DevOps.
Listen to the episode37 mintranscript
David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar
David Habusha joins to discuss the OWASP Top 10 A9: Using components with known vulnerabilities. He also dives into the Software Composition Analysis (SCA) market.
Listen to the episode34 mintranscript
Neil Smithline -- OWASP Top 10 #10: Logging
Neil Smithline joins this week to discuss one of the new items on the OWASP Top 10 List, Insufficient Logging and Monitoring.
Listen to the episode25 mintranscript
Katy Anton -- OWASP Top 10 #4 XXE
Katy Anton joins this week to discuss number four on the OWASP Top 10. She dives into what XXE is, how to deal with it, and other new items on the OWASP Top 10 2017.
Listen to the episode34 mintranscript
Bill Sempf -- Insecure Deserialization
Bill Sempf joins to talk about insecure deserialization. We do a deep dive and contextual review of the generalities of deserialization and the specifics of…
Listen to the episode32 mintranscript
Conclusion: OWASP is for everyone
This is the conclusion of Season 02 for the AppSec PodCast. This episode focuses on all the OWASP goodness we’ve experienced this year.
Listen to the episode23 mintranscript
Tin Zaw -- ModSecurity and #AppSec
Tin Zaw, an advocate for ModSecurity, joins Robert and Chris. He dives into its background, the use of rules, and the many advantages.
Listen to the episode20 mintranscript
Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls
Chris and Robert talk to Jim Manico and Katy Anton about the OWASP Proactive Controls project. We have discussed this before, and they are looking for feedback on the upcoming update.
Listen to the episode36 mintranscript
Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10
We talk about the future of the OWASP Top 10. We do this by meeting the new project leadership team, understanding the process for how they do governance…
Listen to the episode45 mintranscript
Jon Mccoy and Jonathan Marcil -- Agile #AppSec
Robert and Chris speak with Jon Mccoy and Jonathan Marcil about using Agile #AppSec in the Secure Development Lifecycle.
Listen to the episode23 mintranscript
Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing
Robert and I try a new format for discussing a few topics per episode. We discuss changes with the Proactive Controls, AppSecUSA, and the Gartner Magic Quadrant for Application Security Testing.
Listen to the episode44 mintranscript
Dave Ferguson -- The OWASP Top 10 Proactive Controls
Dave Ferguson discusses the OWASP Top 10 Proactive Controls in this episode with Chris.
Listen to the episode37 mintranscript
Jim Manico -- MORE OWASP!
We’re here today with Jim Manico, a project lead with OWASP. We dive deep into some of the projects on his plate.
Listen to the episode31 mintranscript
Chris and Robert -- Controversy within the OWASP Top 10 RC
On this episode of the application security podcast, Robert and I jump over a wall. Just kidding. This isn’t Top Gear. This is our second episode of season two of the #AppSec PodCast.
Listen to the episode31 mintranscript
Chris and Robert -- Introductions and why #AppSec?
In the inaugural episode of the Application Security PodCast, Robert and I introduce ourselves to the audience, explain our journeys into the security…
Listen to the episode