The Application Security Podcast

Latest Episodes:

Isaac Evans - AppSec in the Age of AI Jul 28, 2026

Show notes

AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it? Semgrep co-founder and CEO Isaac Evans explains why deep background analysis and real-time agent plugins may replace universal rule sets with organization-specific security controls. He and Chris explore how security engineering roles will change, why independent verification still matters, and where business-logic flaws may become the next major battleground. The conversation also covers vibe coding at enterprise scale, the limits of reasoning about model behavior, open source in an agent-built world, and why Isaac sees more opportunity than threat even as AI creates a fresh wave of vulnerabilities and cleanup work.

Connect with Isaac Evans:
→ Isaac Evans on LinkedIn
→ Semgrep

Mentioned in this episode:
→ Semgrep
→ DeepSeek
→ Cursor
→ OpenAI Codex
→ Claude Code
→ Boston Dynamics
→ DARPA Robotics Challenge
→ Reflections on Trusting Trust
→ uutils/coreutils
→ Rust

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Isaac Evans
01:11 From cryptography to the DARPA Robotics Challenge
03:43 Founding Semgrep
04:05 How AI is reshaping AppSec
06:15 Attackers, defenders, and model choice
08:02 Regenerating code until it clears the security bar
10:30 Organization-specific rules beat universal rules
14:18 The changing role of the security engineer
17:53 Career advice for security practitioners
19:47 Will foundation models absorb security vendors?
24:18 Getting secure changes across an enterprise
26:40 Trusting Trust becomes the easy problem
27:41 How much should we trust agent-generated code?
29:38 Independent verification and competing models
34:50 Business logic flaws after SQL injection
36:56 Protecting the new wave of citizen developers
39:40 Vibe coding and disposable software
42:05 Open source in an agent-built world
44:10 Can the exponential pace continue?
44:41 Key takeaways and calls to action

José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists Jul 21, 2026

Show notes

Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling? Okta's José Carlos Chávez joins Chris to explain what changed in the 2025 list—and what stubbornly did not. Drawing on his path from software engineering and observability into security, José examines why ownership and root causes matter more than another scanner. They explore the rise of supply-chain and software-integrity failures, the fragile security model around downloaded AI skills and agent permissions, and the continuing need for immutable, trustworthy logging. Along the way, José uses museum heists to make the Top 10 memorable and shows how its categories connect. The result is a practical look at where AppSec teams should focus when familiar vulnerabilities persist and autonomous tools gain more access.

Connect with José Carlos Chávez:
→ José Carlos Chávez on LinkedIn
→ OWASP Coraza

Mentioned in this episode:
→ OWASP Top 10:2025
→ OWASP Coraza
→ Traceable
→ tj-actions/changed-files advisory (CVE-2025-30066)
→ Apache Kafka
→ Istio
→ Falco
→ OpenTelemetry
→ lodash
→ The left-pad incident

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet José Carlos Chávez
01:19 From software engineering to application security
04:54 Observability as a security foundation
10:32 Museums, heists, and teaching the OWASP Top 10
13:50 What changed in the OWASP Top 10 for 2025
17:31 Why broken access control is still number one
24:59 Why injection refuses to disappear
30:05 Supply chain risk vs. software integrity failures
34:11 Can you trust downloaded AI skills?
35:13 When an agent quietly controls your computer
38:29 Immutable logging and incident evidence
43:46 Root causes across the Top 10
49:08 Ownership is the key takeaway
52:07 Closing thoughts

Michael Burch - AI-Enabled Citizen Developers Jun 16, 2026

Show notes

When every employee can generate working software, who owns the risk? Michael Burch, VP of AI Enablement and Acceleration at Security Journey, explains how AI is turning nondevelopers into citizen developers faster than enterprises can build guardrails around them. He and the hosts examine rollouts that hand GitHub and Claude Code to hundreds of employees, the danger of measuring adoption instead of business value, and why prompt libraries alone do not meet people where they work. Michael argues for sandboxed workflows, automated security controls, clear limits, and AI champion programs that quietly carry security practices into every team. The discussion closes on evaluating generated code, token-cost incentives, and the need to define a measurable outcome before buying licenses or opening production access.

Connect with Michael Burch:
→ Michael Burch on LinkedIn
→ Security Journey

Mentioned in this episode:
→ SecureMyVibe
→ Manicode Security
→ The Security Champions Podcast
→ OWASP Low-Code/No-Code Top 10
→ Claude Code

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Michael Burch
02:12 From Army Ranger to AppSec education
05:40 What is an AI-era citizen developer?
06:52 When low-code guardrails disappear
08:49 Giving GitHub to 200 nondevelopers
12:16 The rollout is already underway
13:23 What happens outside the pipeline
17:20 Training gaps and adoption without outcomes
20:03 Measuring ROI instead of usage
22:28 Why prompt libraries are not enough
25:28 Sandboxing citizen developers
28:36 Are organizations waiting for a breach?
29:56 Turn security champions into AI champions
32:00 How AppSec teams need to change
34:58 Guardrails, expectations, and saying no
38:41 Can developers evaluate generated code?
42:40 Token pricing and platform lock-in
44:36 When token usage becomes the wrong incentive
46:17 A practical plan for citizen development
48:28 Closing thoughts

Josh Grossman--AI & SAST: Is it a match? Jun 02, 2026

Show notes

Traditional SAST is deterministic but shallow; AI can reason about context but may answer differently every time. Can the two approaches make each other better? Bounce Security CTO Josh Grossman explains why he built AGHAST, an open-source framework that combines static discovery with LLM analysis to investigate authorization, business-logic, and organization-specific risks. He walks through reducing false positives, importing SARIF, controlling token costs, and deciding where AI-assisted checks belong in developer workflows and CI. Josh also shares how he used Claude Code to build most of the project while retaining the architecture, product judgment, and code-review responsibility himself. The episode closes with AGHAST's roadmap, supported languages, practical adoption advice, and a guided demonstration of the tool.

Connect with Josh Grossman:
→ Josh Grossman on LinkedIn
→ OWASP AGHAST

Mentioned in this episode:
→ OWASP AGHAST
→ Semgrep
→ Cursor
→ Claude Code
→ SARIF
→ NDC Security
→ Black Hat
→ DEF CON
→ ISACA
→ Manicode Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Josh Grossman
01:11 Why Josh built AGHAST
04:22 Will AI disrupt AppSec tooling?
06:09 How AGHAST combines static analysis and AI
08:48 Deterministic rules and pure AI checks
10:23 Reducing SAST false positives
11:49 Using SARIF from existing scanners
12:46 Building AGHAST with Claude Code
14:14 The product specification and human judgment
17:48 How much code did the AI write?
19:05 The architect and product-manager mindset
21:08 Token economics becomes its own industry
22:54 Authorization and business-logic checks
25:55 Context makes custom rules valuable
28:15 Where AGHAST belongs in the workflow
30:11 Languages, frameworks, and COBOL
32:10 The AGHAST roadmap
34:20 Key takeaway and call to action
36:56 Training and conference appearances
37:29 AGHAST demonstration

Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets May 14, 2026

Show notes

GitGuardian found 29 million hard-coded secrets in public GitHub commits in one year—a 34% increase and its largest jump yet. Why is a supposedly simple problem getting worse? Principal Developer Advocate Dwayne McDaniel explains what the 2026 State of Secrets Sprawl report reveals about public and private repositories, AI coding tools, MCP server templates, and developer-targeted supply-chain attacks. He and Chris unpack why standing credentials persist, how private repositories create false confidence, and why frontier models may improve without solving the organizational problem. The conversation moves from detection to governance: short-lived identity, ownership, feedback loops, and the political will to remove embedded keys. Dwayne's core challenge is blunt—organizations already have better authentication patterns, so what will make them finally use them?

Connect with Dwayne McDaniel:
→ Dwayne McDaniel on LinkedIn
→ State of Secrets Sprawl 2026

Mentioned in this episode:
→ GitGuardian State of Secrets Sprawl Report 2026
→ LangChain
→ OpenRouter
→ DeepSeek
→ Mistral AI
→ Perplexity
→ Ox Security
→ SPIFFE
→ CNCF
→ AWS STS
→ OpenID Connect
→ GitHub Octoverse
→ Claude Code

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dwayne McDaniel
00:39 Dwayne's path into secrets security
02:23 How GitGuardian builds the report
05:10 Where the private-repository data comes from
06:20 Twenty-nine million leaked secrets
09:15 Why the problem persists
12:37 Secrets, identity, and standing privilege
15:21 Three ways AI makes leakage worse
16:39 Explosive growth in AI-service credentials
17:57 MCP templates teach insecure authentication
20:08 Is Claude Code getting safer?
22:55 Hope for frontier models
24:36 What will the OWASP Top 10 become?
27:27 AI-assisted attacks target developers
30:29 Old supply-chain attacks at machine speed
33:06 What are organizations protecting now?
35:39 Private repositories are six times riskier
38:48 Moving from the problem to solutions
39:21 Does the organization have the will to fix it?
40:53 Governance and short-lived credentials
44:51 Closing thoughts

Tanya Janca - Secure Vibe Coding Apr 30, 2026

Show notes

If AI writes all the code and the developer barely reads it, where does AppSec fit? Tanya Janca returns to define vibe coding and explain why models trained on insecure public code do not understand secure design by default. She and the hosts build a practical secure-vibe-coding framework: explicit requirements, human-led threat modeling, reusable security prompts, iterative review, SAST, and independent testing. Tanya shares hard-earned examples of Claude removing error handling, models confidently reviewing their own insecure output, and developers accepting enormous finding backlogs for code they did not enjoy writing. The discussion also examines whether security tooling will consolidate into AI platforms, how AppSec must be reimagined, and why continuous, embedded guidance matters more than occasional training. Tanya closes by introducing her DevSecStation podcast.

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ SecureMyVibe
→ DevSecStation

Mentioned in this episode:
→ SecureMyVibe
→ OWASP Top 10
→ Burp Suite
→ OWASP ZAP
→ DevSecStation
→ Tanya Janca (SheHacksPurple)
→ ChatGPT
→ Stack Overflow
→ The Security Table podcast

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Tanya Janca returns
02:10 What vibe coding actually means
04:03 AI adoption and how developers prompt
05:57 Treating AI like an intern
07:28 Do AI systems need parental controls?
09:34 Security prompts for everyday development
11:47 Models, memory, and protecting sensitive data
14:11 What happens when Claude goes away?
16:02 The most dangerous vibe-coding misconception
18:06 Threat modeling before AI writes the code
22:48 Using AI throughout the development lifecycle
25:32 A reusable secure-prompt framework
29:09 Expose security assumptions and challenge flattery
32:30 Reviewing an AI-generated codebase
36:09 Will AI platforms absorb security tooling?
37:39 Five million findings for code nobody wrote
42:19 The remaining pieces of secure vibe coding
43:52 Reimagining AppSec
45:25 Continuous guidance beats occasional training
46:05 Introducing DevSecStation
47:12 Closing thoughts

Caroline Wong--The AI Cybersecurity Handbook Apr 21, 2026

Show notes

AI is multiplying the amount of software organizations produce, but security teams are not multiplying with it. Caroline Wong, author of The AI Cybersecurity Handbook and Chief Strategy Officer at Axari, explains how AppSec must change when agents generate code, make decisions, and assemble systems at machine speed. She and the hosts examine the growing backlog, the need for architecture and visibility, and why trust must be evaluated through accuracy, reliability, explainability, and accountability. Caroline also describes AI-augmented security teams as a practical response to constrained headcount and budgets. The conversation closes on preserving foundational knowledge, identifying roles most likely to change, and preparing now for a future that is arriving faster than traditional security programs can absorb.

Connect with Caroline Wong:
→ Caroline Wong on LinkedIn
→ Axari

Mentioned in this episode:
→ The AI Cybersecurity Handbook
→ Security Metrics: A Beginner's Guide
→ Cobalt
→ BSIMM
→ PCI DSS
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Caroline Wong
02:52 Competitive jiu-jitsu away from the screen
05:41 Learning through discomfort and failure
09:01 Writing The AI Cybersecurity Handbook
11:41 Why the AI shift is different
14:05 How AI-generated code changes AppSec
15:55 The security backlog grows faster
19:14 Do we need to re-architect everything?
21:34 Keeping visibility into agent-built systems
25:45 Trusting AI in security work
27:12 Criteria for evaluating trust
29:58 Explainability and losing foundational knowledge
34:00 AI-augmented security teams
36:25 Doing more with fewer people and dollars
39:24 Understand how the technology works
40:55 Which security roles change first?
43:36 Caroline's key takeaway
44:16 Closing thoughts

Steve Wilson--OpenClaw and Advanced AI Agents Apr 15, 2026

Show notes

OpenClaw makes always-on personal AI agents feel inevitable—and exposes how poorly prepared most organizations are for their autonomy. Steve Wilson, Chief AI and Product Officer at Exabeam and founder of the OWASP GenAI Security Project, returns to explain how advanced agents differ from chatbots and why their permissions, memory, and ability to act create a radically larger blast radius. He and the hosts explore source-code exposure, prompt injection, supply-chain risk, and the uncomfortable gap between rapid adoption and meaningful oversight. Steve also discusses the OWASP Agentic Security Initiative, emerging guidance for builders, and the limits of treating an agent like an intern. The episode closes with a practical challenge: learn how these systems work before trusting them with consequential access.

Connect with Steve Wilson:
→ Steve Wilson on LinkedIn
→ OWASP GenAI Security Project

Mentioned in this episode:
→ OpenClaw
→ Peter Steinberger
→ Lex Fridman Podcast — Peter Steinberger on OpenClaw
→ NVIDIA NemoClaw
→ Claude Code source leak
→ Tay
→ OWASP GenAI Security Project — Get Involved
→ OWASP Agentic Security Initiative
→ The Developer's Playbook for Large Language Model Security
→ OWASP Top 10 for LLM Applications
→ Claude Code
→ The Security Table

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Wilson
02:34 A fifth visit to the podcast
04:21 What is OpenClaw?
07:03 From chatbot to always-on agent
10:16 Why personal agents feel different
13:16 The expanding blast radius
16:29 Permissions, memory, and persistent access
18:43 Security catches up to agent adoption
21:28 New tension between security and development
24:09 When an agent exposes source code
26:12 Understanding consequential failures
29:59 Threats that keep defenders awake
32:41 Agentic security guidance from OWASP
35:45 Why the intern metaphor falls short
38:18 Supervision and human accountability
41:41 Where advanced agents are headed
45:28 The one thing practitioners should do now
48:48 Closing thoughts

Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows Oct 28, 2025

Show notes

AppSec teams are drowning in repetitive triage while the work that requires judgment keeps piling up. Brad Geesaman, Principal Security Engineer at Ghost Security, explains how large language models can shrink that toil without handing security decisions to an unreliable black box. He walks through using LLMs for classification, evidence gathering, and contextual analysis, with humans retaining final authority. Brad and Chris examine prompt engineering, trust, market disruption, and the limits of incumbent tools built around producing ever-larger finding queues. They also explore AI-assisted remediation, code drift, and the changing day-to-day work of AppSec engineers. The result is a pragmatic model for gaining leverage from AI while preserving the expertise, accountability, and skepticism that effective security still demands.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Brad Geesaman:
→ Brad Geesaman on LinkedIn
→ Ghost Security Reaper

Mentioned in this episode:
→ Ghost Security
→ Reaper
→ Security Compass
→ OWASP ZAP
→ Burp Suite Professional
→ SQL Slammer
→ Code Red
→ Nimda
→ Exodus Communications
→ NetWitness

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brad Geesaman
03:01 What toil means in AppSec
05:20 Why triage drains security teams
06:13 Where AI can create leverage
09:29 Does an LLM need custom training?
11:51 Prompt engineering for useful results
13:33 Humans remain at the center
15:23 Trusting probabilistic systems
19:30 A seismic shift in AppSec tooling
20:18 Escaping the pile of findings
24:00 How incumbent vendors are responding
25:46 Why platform shifts leave openings
28:31 The AppSec engineer's changing day
33:04 Moving from triage to code changes
35:36 AI-generated code and application drift
38:49 What Brad hopes comes next
41:51 Closing thoughts

OWASP Candidate Debate - 2025 Edition Oct 15, 2025

Show notes

What should OWASP become, and which leaders have a credible plan to get it there? In this special 2025 Board of Directors candidate debate, nine candidates present their qualifications and answer the same questions about OWASP's future. The discussion tests concrete ideas for expanding education, improving global and chapter outreach, strengthening project support, finding sustainable funding, and making the Foundation's impact easier to measure. Candidates identify where OWASP performs well, where it falls short, and how they would balance ambitious programs against limited staff and volunteer capacity. Closing statements give each participant a final opportunity to define their priorities. The result is a direct comparison designed to help OWASP members make an informed choice before voting.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Foundation
→ 2025 Global Board Elections

Mentioned in this episode:
→ OWASP 2025 Global Board Elections
→ OWASP Global Board Candidates
→ OWASP Foundation
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ OWASP CycloneDX
→ OWASP Nettacker
→ OWASP ASVS
→ OWASP Security Champions Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The 2025 OWASP candidate debate
01:22 Debate format and opening question
02:24 Candidates introduce themselves
13:50 Sam Stepanian's introduction
16:05 Arunesh Salhotra's introduction
18:17 Arvind Janardhanan's introduction
22:02 How should OWASP increase its impact?
28:12 Comparing ideas for greater impact
31:59 What is OWASP doing poorly?
35:27 Project support and Foundation operations
38:57 Using data to increase influence
41:19 Indexing projects and regional review
44:01 Should OWASP grow more chapters?
48:43 A regional ambassador program
51:50 How would candidates fund their plans?
55:03 Corporate support and new funding
58:52 Candidate closing statements
64:37 Education as an OWASP priority
68:05 Debate conclusion

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected