Hosts dig into the stories of AppSec experts and the tools, tactics, and tricks that make them successful.
Internet
Joined August 2016
- Tweets2.3K
- Following1.4K
- Followers2.9K
- Likes785
No human uses an em dash.
That's one way Corgea measures it: 35 to 60 percent of developer replies to security comments on PRs are now written by AI agents.
Ahmad Sadeddin joins Chris Romeo on the AppSec Podcast.
#AppSec #AISecurity
youtu.be/AlJMKHCubmI
Before the OWASP MCP Top 10, Vandana Verma Sehgal was spotlighting OWASP projects one video at a time.
Revisit her 2021 episode on the OWASP Spotlight Series.
#AppSec #OWASP
youtu.be/g0KfZtNzmIk
AI writes code faster than anyone reviews the design.
Security Compass models threats continuously.
Thanks to Security Compass for sponsoring this week's episode with Vandana Verma Sehgal.
#AppSec #ThreatModeling
appsecpodcast.com/securityco…
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design reviews to autonomous pentesting.
Thanks to Corgea for sponsoring this week's episode with Vandana Verma Sehgal.
#AppSec #AIsecurity
appsecpodcast.com/corgea
"Authenticate every action, authorize every sensitive action."
Vandana Verma Sehgal's rule for MCP. Long-lived tokens and inherited permissions can give an agent access to your entire account.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Why does MCP need its own OWASP Top 10?
Vandana Verma Sehgal: A malicious tool description gets pulled into the model's context and treated as trusted guidance before anyone even uses the tool.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Your developers are running MCP servers your security team can't see.
Vandana Verma Sehgal, leader of the OWASP MCP Top 10, on shadow MCP, scope creep, and why a secure MCP server should be boring.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Before this week's episode, go back to 2024: Brook Schoenfield on security, stories, jazz, and stage presence on The Security Table.
#AppSec #SecurityArchitecture
youtube.com/watch?v=AJSgUR_0…
AI writes code faster than anyone reviews the design.
Security Compass continuously models threats and translates them into actionable requirements for developers.
#AppSec #ThreatModeling
appsecpodcast.com/securityco….
The Application Security Podcast retweeted
Earlier this week I listened to: Vulnerability Jail and the AI-Era AppSec podcast by @AppSecPodcast and took down a few note and two questions that bordered around trust and accountability in the use of agents.
Today, fortunately at a workstation, I ran into an AI engineer who's also very much interested and is participating in AI governance research and shared my thoughts. Our conversation made me realize I could thread this path further with my curiosity to see how the industry could strike a balance. Or not. 💡
"If I close 10%, I've improved Cisco by 10%. Fantastic. Stop trying for perfection."
Brook Schoenfield on why one fixed weakness beats a perfect plan, and why AI threat models still count.
#AppSec #ThreatModeling
appsecpodcast.com/your-opini…
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design to production: design reviews, AI SAST, dependency and IaC scanning, autonomous pentesting.
#AppSec #SAST
appsecpodcast.com/corgea
Security either embraces securing AI, or "you will be left in the dust. It's that simple."
Brook Schoenfield on learned fragility and why your opinion on AI doesn't matter.
#AppSec #AIsecurity
appsecpodcast.com/your-opini…
Your opinion on AI doesn't matter. Learned fragility does.
@BrkSchoenfield joins Chris and Robert on the illusion of omniscient perfection, AI threat models, and why we should stop chasing vulnerabilities.
#AppSec #AIsecurity
appsecpodcast.com/your-opini…
More @manicode? Go back to 2023, when Jim told The Security Table the untold story of his relationship with threat modeling.
#AppSec #ThreatModeling
youtube.com/watch?v=JENmqlS4…
AI writes code faster than anyone can review the design.
Security Compass continuously models threats and translates them into actionable requirements for developers.
#AppSec #ThreatModeling
appsecpodcast.com/securityco…
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design to production: design reviews, AI SAST, dependency and IaC scanning, and autonomous pentesting.
#AppSec #AI
appsecpodcast.com/corgea.
Advice you can use this week from Jim Manico:
"Give me a set of requirements for this feature based on the security rules and the architecture of this app."
Ask AI for the requirements before you ask it for the code.
#AppSec #AI #SecureCoding
appsecpodcast.com/advice.
Can we trust AI to review our code?
Jim Manico says human code review is ending. Chris and Robert want to know when a human still steps in.
Watch the segment.
youtu.be/YwXIUDG9ino
#AppSec #CodeReview
"The era of code review is coming to an end."
@manicode on why humans reviewing code will hurt your company, token furnaces, and the one truly new vulnerability class of the AI era.
New episode is live.
#AppSec #AI
appsecpodcast.com/why-ai-cod…
