The Application Security Podcast

Latest Episodes:

Francesco Cipollone - Agentic AI Manifesto Sep 23, 2025

Show notes

Most products labeled as AI agents are little more than chatbots with tools. Francesco Cipollone, founder and CEO of Phoenix Security, explains what makes an agent genuinely agentic and why his team uses multiple specialized models instead of one all-purpose system. He and the hosts unpack the Agentic AI Manifesto's principles, including responsible adoption, human augmentation, transparency, and resisting automation for its own sake. Francesco also shares the practical economics behind multi-agent systems and the difficulty of applying them safely to vulnerability remediation. The conversation cuts through inflated promises while preserving a realistic case for useful automation: agents should increase human capability, remain observable and bounded, and solve a defined problem instead of becoming another vague digital-transformation initiative.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results.
→ Learn more about Security Journey

Connect with Francesco Cipollone:
→ Francesco Cipollone on LinkedIn
→ Phoenix Security

Mentioned in this episode:
→ Phoenix Security
→ Cursor
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Francesco Cipollone
02:36 Are you sure Francesco is not a bot?
04:41 Why create an Agentic AI Manifesto?
07:08 Defining a true AI agent
09:21 The agent is not the LLM
09:43 Six models working as specialists
12:12 Why not use one super agent?
15:05 The manifesto's core principles
18:27 Augment people instead of replacing them
21:17 The emerging AI coach role
23:37 Escaping digital-transformation theater
24:23 Transformation never really ends
27:46 Agents and vulnerability remediation
31:27 Closing thoughts

Simon Gibbs & Devika Gibbs -- Building Bridges with Games Sep 16, 2025

Show notes

Security education often struggles because the people in the room are being talked at instead of invited to participate. Simon and Devika Gibbs, the duo behind CyberSec Games, explain how tabletop games can turn abstract security concepts into shared experiences that connect developers, security practitioners, and business teams. They trace their path from agile stationery into threat-modeling games, describe what they learned from Elevation of Privilege and OWASP Cornucopia, and discuss the community that helped shape their work. The pair also introduce the Cybersecurity Game Challenge, including who can enter, how ideas are judged, and what winning makes possible. Their larger argument is simple: play lowers barriers, creates conversation, and can make difficult security lessons memorable enough to change behavior.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including the OWASP Top 10.
→ Learn more about Security Journey

Connect with Simon and Devika Gibbs:
→ Simon Gibbs on LinkedIn
→ Devika Gibbs on LinkedIn
→ CyberSec Games

Mentioned in this episode:
→ CyberSec Games
→ Cybersecurity Game Challenge
→ Elevation of Privilege
→ OWASP Cornucopia
→ Threat Modeling Manifesto
→ Adam Shostack
→ EU Cyber Resilience Act

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Simon and Devika Gibbs
02:39 From business analysis to game design
05:36 Printing the Threat Modeling Manifesto
06:27 What is CyberSec Games?
08:38 Games bring people together
11:13 A welcome from the security community
14:34 Building bridges across disciplines
18:00 Discovering Elevation of Privilege
19:35 The return on a simple card deck
22:45 How popular are security games?
26:21 The Cybersecurity Game Challenge
28:43 Judges and community contributors
30:33 What can the winner receive?
32:12 A future security-game reality show
33:29 How and when to enter
35:07 The audience homework assignment

Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps Sep 02, 2025

Show notes

APIs power modern applications, yet many AppSec programs still cannot reliably inventory them, model their threats, or enforce authorization. Akansha Shukla draws on more than a decade in application security and DevSecOps to explain why API security remains immature and what practitioners can do about it. She and the hosts examine the OWASP API Security Top 10, broken object-level authorization, API-specific threat modeling, and the role of posture management. The conversation also asks why foundational controls such as input validation remain difficult despite strong framework support, and whether declarations that shift left is dead reflect reality or marketing. Akansha closes with practical guidance for building developer understanding, integrating security throughout delivery, and treating APIs as first-class elements of architecture rather than invisible plumbing.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs. Learners report improving their knowledge as much as 85% on AppSec topics.
→ Learn more about Security Journey

Connect with Akansha Shukla:
→ Akansha Shukla on LinkedIn
→ Women4Cyber Mentorship Programme

Mentioned in this episode:
→ OWASP API Security Top 10
→ Burp Suite Professional
→ Women4Cyber Mentorship Programme
→ OAuth 2.0

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Akansha Shukla
03:11 Moving from engineering into security
06:13 Why development knowledge matters
09:09 Using the OWASP API Security Top 10
11:55 Authorization and API guardrails
14:46 Threat modeling APIs
17:26 Why teams skip API threat models
18:49 Is the barrier knowledge or process?
21:15 The role of API security posture management
22:25 Why API inventory is still difficult
24:41 Framework support versus real adoption
27:43 Did security make the paved road too hard?
28:14 Why input validation remains unsolved
29:39 Is shift left dead?
33:04 Akansha's key takeaway
34:55 Closing thoughts

Getting Ready for the EU CRA Aug 20, 2025

Show notes

The EU Cyber Resilience Act turns product security from a best practice into a market-access requirement, and its effects extend well beyond Europe. Application Security Architect and OWASP SAMM core team member Nariman Aga-Tagiyev explains what manufacturers need to know about product classes, conformity assessments, vulnerability handling, software components, and enforcement. He and the hosts explore why global software companies should care, how the rules apply to commercial uses of open source, and what implementation may look like as regulators and assessors mature. Nariman then connects compliance to practical improvement through OWASP SAMM, BSIMM, DSOMM, and openCRE. His recommendation is to start with a maturity assessment now, identify gaps team by team, and use the regulation as leverage for sustainable security rather than a last-minute paperwork exercise.

Connect with Nariman Aga-Tagiyev:
→ Nariman Aga-Tagiyev on LinkedIn
→ OWASP SAMM

Mentioned in this episode:
→ EU Cyber Resilience Act
→ OWASP SAMM
→ BSIMM
→ OWASP DevSecOps Maturity Model
→ openCRE
→ Linux Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Nariman Aga-Tagiyev
02:48 From competitive programming to AppSec
05:40 Learning security through software architecture
09:21 Nariman's work with OWASP
09:49 What the EU Cyber Resilience Act changes
13:12 Product classes and conformity assessment
16:15 Will certification work across Europe?
17:17 How complicated is CRA compliance?
18:49 Does the Act reference OWASP SAMM?
20:49 Why should companies care?
21:44 Three perspectives on the regulation
25:40 Assessing readiness team by team
28:20 How the CRA treats open source
30:04 Commercial activity in the supply chain
34:19 How enforcement may develop
36:37 Start with a maturity framework
38:27 Mapping requirements with openCRE
39:49 Closing thoughts

Marisa Fagan - Measuring Security Culture Aug 05, 2025

Show notes

Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value. Marisa Fagan, Head of Product at Katilyst and a veteran security-culture practitioner, shares a practical blueprint for piloting and scaling a program that lasts. She explains how to recruit and motivate champions using status, access, power, and stuff, why a pilot should produce both learning and a business case, and which anti-patterns quietly destroy trust. Marisa and the hosts also examine metrics for security culture, the role of qualitative evidence, and how champion models can extend to privacy and accessibility. The episode offers concrete guidance for building participation without turning volunteers into unpaid security staff.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Marisa Fagan:
→ Marisa Fagan on LinkedIn
→ Katilyst

Mentioned in this episode:
→ Security Champion Success Guide
→ OWASP Security Champions Guide
→ People-Centric Security
→ Katilyst
→ Kim Wuyts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Marisa Fagan
03:02 What security culture means
05:44 Why security champions programs matter
08:36 Starting with organizational context
11:26 Recruiting the right champions
14:58 The components of an effective pilot
18:00 Turning a pilot into a business case
18:52 Motivating champions with SAPS
22:06 Status, access, power, and stuff
25:30 Common program anti-patterns
29:16 Chris's biggest champions-program mistake
32:15 Metrics that demonstrate success
35:02 Qualitative evidence and culture change
37:32 How security careers shape the advice
41:33 Creating space to share challenges
46:10 Beyond security champions
49:04 Closing thoughts

Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics Jul 22, 2025

Show notes

A dashboard full of green indicators can still describe an insecure organization. Aram Hovsepyan, founder and CEO of Codific and an OWASP SAMM contributor, explains why vulnerability totals and unexamined CVSS scores often measure activity instead of security outcomes. He introduces the Goal Question Metric framework as a way to begin with an organizational goal, ask what must be understood, and choose measurements that answer those questions. Aram and the hosts distinguish precision, reliability, and accuracy, examine how metrics shape behavior, and identify overlooked indicators that show whether a program is actually moving. They also discuss redesigning executive dashboards and testing a long-standing metric from Chris. The takeaway: a useful metric must support a decision, reflect context, and make its limitations visible.

The Application Security Podcast is brought to you by Security Journey.

Connect with Aram Hovsepyan:
→ Aram Hovsepyan on LinkedIn
→ Codific

Mentioned in this episode:
→ Goal Question Metric framework
→ LINDDUN
→ Codific
→ OWASP SAMM
→ Kim Wuyts
→ Security Compass
→ Toreon

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why your security dashboard may be lying
01:25 Meet Aram Hovsepyan
02:43 From privacy research to AppSec
06:30 The inspiration behind the talk
09:44 How common security metrics fail
11:35 If every metric is green, are you secure?
13:23 Metrics drive human behavior
16:48 Introducing Goal Question Metric
18:38 Precision, reliability, and accuracy
22:05 Good numbers can answer the wrong question
26:43 Why total vulnerability counts mislead
28:30 The metrics teams overlook
31:52 Measuring movement, not perfection
33:13 Redesigning a security dashboard
35:04 Testing Chris's long-standing metric
38:22 What a useful metric must reveal
40:09 Closing thoughts

Sean Varga -- OWASP Top 10 for AppSec Sales Jul 15, 2025

Show notes

We’re discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga. Sean shares the unique challenges and best practices in AppSec sales, like the importance of empathy, understanding customer needs, and community participation. Learn about the OWASP top 10 for AppSec Sales and discover how to achieve success by aligning with customer goals, maintaining detailed living documents, and fostering strong partnerships. AppSec meets sales strategy. This is not your typical security podcast, but a glimpse into how sales work in AppSec. As security practitioners, we must practice empathy. This is our chance. We're unpacking the OWASP Top 10, not for vulnerabilities, but for what drives successful AppSec sales.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Sean Varga:
→ DevOpsDays
→ BSides

Mentioned in this episode:
→ DevOpsDays
→ BSides
→ Crossing the Chasm
→ Veracode
→ Secure Code Warrior

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sean Varga: OWASP Top 10 for AppSec Sales
09:00 I guess I want to ask kind of another question on
18:00 Yeah, I have a kind of a different perspective on this
20:14 You hit on something that is part of the frustration. Right
28:15 You're describing in my mind what is a consultative approach to
30:11 Yeah. So then we get to know your solution. Wait, you
33:51 Right
34:46 Mm-hmm. Let's, uh, we can jump over the understand all stakeholders
44:25 I'm going to give you a second to think about your

Sarah-Jane Madden -- What AI means for AppSec Jul 09, 2025

Show notes

Sarah-Jane Madden joins Chris and Robert to ask what AI actually changes in software development—and what foundational practices still matter. Drawing on her OWASP Global AppSec EU keynote, she challenges the idea that AI makes the SDLC obsolete or turns every prompt into production-ready software. The conversation examines vibe coding, the difficulty of operationalizing AI-generated prototypes, skill atrophy, hallucinations, and the quality problems hidden by code that merely passes generated tests. Sarah-Jane argues for treating AI as a useful assistant rather than an unquestioned authority: engineers must preserve critical thinking, understand their systems, and verify the output. The episode closes with practical guidance for engineering leaders who want teams to gain efficiency from AI without surrendering judgment, accountability, or software quality.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Sarah-Jane Madden:
→ Sarah-Jane Madden on LinkedIn
→ Nemo Resideo keynote at OWASP Global AppSec EU

Mentioned in this episode:
→ Nemo Resideo keynote at OWASP Global AppSec EU
→ Sarah-Jane Madden — Threat Modeling to Established Teams
→ GitHub Copilot

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sarah-Jane Madden: What AI Means for AppSec
02:35 From an OWASP keynote to AI in software development
04:59 The biggest misconception about AI-assisted development
07:13 Why AI will not eliminate software development
11:58 Vibe coding and the production-readiness gap
15:46 Operationalizing AI-generated prototypes
17:53 Where AI helps inside the SDLC
23:58 Over-reliance, skill atrophy, and engineering judgment
27:00 Using AI for grunt work without losing core skills
29:38 Can developers trust large language model output?
33:36 Practical guardrails for responsible AI use

Dag Flachet -- Kaizen for your Appsec Program Jun 17, 2025

Show notes

Dag Flachet joins us to discuss the concept of Kaizen and its application in improving application security. Dag shares his journey into the world of security, emphasizing the importance of iterative, small-step improvements. The conversation delves into how organizations can effectively implement maturity models to enhance their security programs, the limitations of compliance-focused frameworks like ISO 27,000 and SOC 2, and the practical application of Kaizen principles. They also explore the evolution and future updates of OWASP SAM, and the importance of empowering development teams through a bottom-up approach in security enhancement. Dag is the co-founder of Codific, a professor and board member at the Geneva Business School, and an active member of the OWASP Barcelona Chapter and the OWASP SAMM community.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Our training includes theory and immersive learning that teaches the skills and knowledge needed to create a security-first mindset across your organization.
→ Learn more about Security Journey

Connect with Dag Flachet:
→ Codific
→ OWASP SAMM

Mentioned in this episode:
→ Codific
→ OWASP SAMM
→ OWASP SAMM
→ OWASP DevSecOps Maturity Model (DSOMM)
→ openCRE.org
→ EU Cyber Resilience Act

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dag Flachet: Kaizen for your Appsec Program
01:39 The thing that we love. Well, uh, we're joined by Dag
06:54 That'd be funny if she sent a message yet. Like, hey
13:20 Yeah, very cool. Well, as we mentioned, we're going to be
17:08 Which is, is DSOM part of SAM now or are they
22:08 This is an interesting thing, but maturity models have also evolved
24:44 Let's wrap this whole thing together now. We introduced Kaizen. We've
27:00 If we were to kind of dive a little bit deeper

Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications Mar 18, 2025

Show notes

What happens when teams add large language models to real applications and discover that familiar AppSec controls are no longer enough? Andra Lezza and Javan Rasokat share lessons from building, breaking, and defending LLM-enabled systems at Sage and presenting their findings at DEF CON. They compare prompt injection with SQL injection, explain AI red teaming, and unpack hallucinations, retrieval-augmented generation, grounding, and model safeguards. The conversation also examines corporate data leaking through prompts, the limits of trusting model providers, and how the OWASP Top 10 for LLM Applications complements issues observed in production. Andra and Javan close with practical advice for developers, data scientists, and security teams: treat AI systems as a new attack surface, establish clear data boundaries, and test controls against realistic abuse cases.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Andra Lezza and Javan Rasokat:
→ Andra Lezza on LinkedIn
→ Javan Rasokat on LinkedIn
→ Javan Rasokat
→ AppSec Village

Mentioned in this episode:
→ Adversarial Misuse of Generative AI (Javan's blog article)
→ TLDR newsletter
→ The Cuckoo's Egg by Cliff Stoll
→ AppSec Village
→ DEF CON
→ ChatGPT
→ DeepSeek
→ NIST AI Risk Management Framework
→ OWASP Top Ten for LLM Applications project homepage

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 When Chatbots Go Rogue with Andra Lezza and Javan Rasokat
01:49 Andra’s path into application security
02:56 Javan’s path into application security
04:38 Lessons from building and defending LLM applications
08:22 Prompt injection compared with SQL injection
11:46 Critical vulnerabilities found in real AI systems
12:19 What AI red teaming actually means
13:46 Hallucinations, RAG, and grounding
19:51 Model safeguards and harmful requests
20:35 Common AI development and deployment mistakes
23:20 Corporate data exposure through prompts
29:59 OWASP Top 10 for LLMs versus real-world findings
32:02 Practical security advice for AI developers
34:36 Bringing security practices to data scientists
45:37 Key takeaways for defending LLM applications

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected