The Application Security Podcast podcast artwork
Technology

The Application Security Podcast

by Chris Romeo and Robert Hurlbut
TechnologyNewsTech News

Not on the United States charts we track today.

If you like The Application Security Podcast, try…

Latest episodes

  • Your Developers Are Letting AI Answer Your Security Findings

    October 19, 2026 · 49 min

    Are your developers still reading their security findings, or are their agents answering for them? Ahmad Sadeddin, founder and CEO of Corgea, brings data from Corgea's customers: replies to security comments written with em dashes jumped…

  • Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops

    October 12, 2026 · 47 min

    What happens when a protocol goes from idea to everywhere before security can catch up? Vandana Verma Sehgal, leader of the OWASP MCP Top 10, returns to explain why most organizations cannot say how many MCP servers are running on their…

  • Your Opinion on AI Doesn't Matter. Learned Fragility Does

    October 5, 2026 · 53 min

    What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E. Schoenfield, CTO of Rezliant and author of Securing Systems, returns to warn about "the illusion of…

  • Why AI Code Review Will Replace Human Review Faster Than You Think

    September 29, 2026 · 49 min

    Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company. The founder of Manicode Security returns to explain why AI didn't kill AppSec education but supercharged it, why vague prompting on…

  • Vulnerability Jail and the AI-Era AppSec Engineer

    September 22, 2026 · 45 min

    Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. Jeevan, Director of Security Engineering at Rippling, returns to unpack how his team polices thousands of…

Show 7 more episodesShow fewer episodes
  • How Agentic AI Fails—and Which Controls Actually Stop It

    September 15, 2026 · 37 min

    Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents. Petra traded emergency medicine for application…

  • Your AppSec Bottleneck Is a People Problem

    September 7, 2026 · 48 min

    Most security champions programs don't fail on tooling — they fail on people. Lisi Hocke spent three years as a champion before moving fully into product security, which means she has argued both sides of this from inside the trenches…

  • AI Pen Testing Killed Traditional DAST

    August 31, 2026 · 44 min

    Is traditional DAST finally dead? James Berthoty came back to settle the argument that his last episode started. James is the founder and analyst behind Latio, and he argues that AI pentesting is a genuinely different animal — payloads…

  • AI Security: OWASP Meets Global Standards

    August 26, 2026 · 48 min

    AI security has no shortage of standards — the problem is turning them into something a team can actually use. Rob van der Veer has spent 34 years in AI and security, founded the OWASP AI Exchange, and created MOSAIC, the agreement that…

  • The Future of Open-Source Threat Modeling

    August 17, 2026 · 40 min

    You don't have to let AI do the thinking for you. In this episode, Vikram Narayan shares why the smartest teams use AI as an accelerant — not a replacement — and why human judgment still matters most in threat modeling. Vikram created…

  • Isaac Evans - AppSec in the Age of AI

    July 28, 2026 · 49 min

    AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it? Semgrep co-founder and CEO Isaac Evans explains why deep background analysis…

  • José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists

    July 21, 2026 · 53 min

    Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling? Okta's José Carlos Chávez joins Chris to explain what changed in the 2025 list—and what stubbornly did not. Drawing on his path…

Full episode archive on Apple Podcasts →

About the show

The Application Security Podcast is a practitioner-led show for anyone building or securing modern software—and now AI-powered applications. Hosts Chris Romeo and Robert Hurlbut talk with the people shaping application security about AI and LLM security, threat modeling, secure development, OWASP, cloud, DevSecOps, security champions, and building programs that help engineering teams move faster and safer. With more than 300 episodes, the show turns real-world experience into practical guidance for developers, architects, AppSec professionals, and security leaders.