The Application Security Podcast

Hosts dig into the stories of AppSec experts and the tools, tactics, and tricks that make them successful.

[The Application Security Podcast @AppSecPodcast]

Design it. Build it. Ship it. Corgea secures it.

Corgea is an AI native AppSec platform: design reviews, AI SAST, dependency and IaC scanning, and autonomous pentesting.

Thanks to Corgea for sponsoring this week's episode.

#AppSec #AISecurity
https://t.co/xo5kYzbxOl.

[The Application Security Podcast @AppSecPodcast]

A million-token context window is not a million tokens of attention.

Rock Lambros: the first token in context counts for far more than the 125,000th.

Long sessions rot. Start fresh more often.

#AppSec #AIAgents
https://t.co/fyAhLbvVOu

[The Application Security Podcast @AppSecPodcast]

Who tells the agent no?

Rock Lambros says most agent deployments still rely on a prompt.

In a gas plant, the safety system runs on separate hardware and never trusts the control system to shut down on its own.

#AppSec #AgenticAI
https://t.co/XtX7PAz9ln

[The Application Security Podcast @AppSecPodcast]

"Told the agent 11 times, don't touch anything. And it did anyway."

Rock Lambros on the Replit incident, and why a prompt is advisory, not a control.

New episode of the Application Security Podcast is out now.

#AppSec #AIAgents
https://t.co/vLIzbin99U

[The Application Security Podcast @AppSecPodcast]

Design it. Build it. Ship it. Corgea secures it.

AI native AppSec from design to production: design reviews, AI SAST, autonomous pentesting.

Thanks to Corgea for sponsoring last week's episode with Kim Wuyts and Avi Douglen.

#AppSec #AISecurity
https://t.co/xo5kYzbxOl.

[The Application Security Podcast @AppSecPodcast]

Before Context & Cringe, there was LINDDUN.

Revisit our 2023 conversation with Kim Wuyts on the future of privacy threat modeling, then hear where she and Avi Douglen took it next.

#AppSec #ThreatModeling
https://t.co/ENoYO181AS

[The Application Security Podcast @AppSecPodcast]

Teaching privacy works. People understand it.

But as Avi Douglen puts it, "there's a world of difference between understanding it and getting it."

That gap is why he and Kim Wuyts built Context & Cringe.

#AppSec #Privacy
https://t.co/68ZWX51R0x

[The Application Security Podcast @AppSecPodcast]

Your AI agents run on every endpoint. Do you know what they're doing?

Origin inventories and observes agent activity at scale.

Thanks to Origin for sponsoring this week's episode with Kim Wuyts and Avi Douglen.

#AppSec #AISecurity
https://t.co/UICJUFsfKA

[The Application Security Podcast @AppSecPodcast]

Can AI do privacy threat modeling?

Kim Wuyts: "It still lacks a lot of nuance; it still misses that broader context."
Avi Douglen: AI can talk about cringe. It can't feel it.

#AppSec #PrivacyEngineering
https://t.co/68ZWX51R0x

[The Application Security Podcast @AppSecPodcast]

AI can draft your privacy threat model.

It can't feel the cringe.

Kim Wuyts and Avi Douglen on Context & Cringe, APVS, and why the human gut still matters in privacy.

#AppSec #Privacy
https://t.co/balFGMfj7U

[The Application Security Podcast @AppSecPodcast]

Let your agents work. Keep them in sight.

Origin inventories, observes, and measures AI agent usage across your endpoints.

Thanks to Origin for sponsoring this week's episode with Hannah Foxwell.
#AppSec #AIsecurity
https://t.co/UICJUFsfKA

[The Application Security Podcast @AppSecPodcast]

No human checks in the software factory?

This week's episode with Hannah Foxwell made the case that's dangerous.

From the archive: Tanya Janca on secure guardrails and how they differ from paved roads.
#AppSec #DevSecOps
https://t.co/PhJZfKCpi0

[The Application Security Podcast @AppSecPodcast]

Your cycle time can look great while your backlog quietly grows.

Hannah Foxwell's advice: measure saturation, not just speed. You can't go fast unless you can go safely.

#AppSec #VulnerabilityManagement
https://t.co/H5ezm5u7mJ

[The Application Security Podcast @AppSecPodcast]

Can you still trust the CVE process when the exploit shows up before the CVE does?

Hannah Foxwell and Chris Romeo on why exploitability is the wrong thing to wait for.

#AppSec #VulnerabilityManagement
https://t.co/H5ezm5u7mJ

[The Application Security Podcast @AppSecPodcast]

Design it. Build it. Ship it. Corgea secures it.

AI native AppSec from design to production: design reviews, AI SAST, dependency and IaC scanning, and autonomous pentesting.

Thanks to Corgea for sponsoring this week's episode.

#AppSec #AIsecurity
https://t.co/xo5kYzbxOl

[The Application Security Podcast @AppSecPodcast]

Before the CVE even has a number, the exploit may already exist.

Hannah Foxwell joins Chris Romeo and Robert Hurlbut on why the time to exploit is now negative, and why AppSec has never mattered more.

#AppSec #AIsecurity
https://t.co/H5ezm5u7mJ

[The Application Security Podcast @AppSecPodcast]

Jim Manico told us that human code review is on its way out.

Ahmad Sadeddin's data says agents are already addressing the security findings.
Catch up on Jim's episode.

#AppSec #CodeReview
https://t.co/8Y1ytYe4q8

[The Application Security Podcast @AppSecPodcast]

Design it. Build it. Ship it. Corgea secures it.

AI SAST, design reviews, dependency and IaC scanning, and autonomous pentesting in one platform.

Thanks to Corgea for sponsoring this week's episode with Ahmad Sadeddin.
#AppSec #AISecurity
https://t.co/xo5kYzbxOl

[The Application Security Podcast @AppSecPodcast]

A security review on a PR can run $5 to $25 once you scan every push. Some teams run 100,000 a month.

Ahmad Sadeddin on why AI AppSec budgets are about to get a hard look.
#AppSec #AISecurity
https://t.co/sl1EKyw3U6

[The Application Security Podcast @AppSecPodcast]

In May, 2.5 percent of developer replies to Corgea's security comments were written by an agent. Now it's about a third.

Ahmad Sadeddin breaks down the data with Chris Romeo.

#AppSec #AISecurity
https://t.co/sl1EKyw3U6