Hosts dig into the stories of AppSec experts and the tools, tactics, and tricks that make them successful.
Internet
Joined August 2016
- Tweets2.3K
- Following1.4K
- Followers2.9K
- Likes788
Jim Manico told us that human code review is on its way out.
Ahmad Sadeddin's data says agents are already addressing the security findings.
Catch up on Jim's episode.
#AppSec #CodeReview
youtube.com/watch?v=G-0ecWjB…
Design it. Build it. Ship it. Corgea secures it.
AI SAST, design reviews, dependency and IaC scanning, and autonomous pentesting in one platform.
Thanks to Corgea for sponsoring this week's episode with Ahmad Sadeddin.
#AppSec #AISecurity
appsecpodcast.com/corgea
A security review on a PR can run $5 to $25 once you scan every push. Some teams run 100,000 a month.
Ahmad Sadeddin on why AI AppSec budgets are about to get a hard look.
#AppSec #AISecurity
appsecpodcast.com/your-devel…
In May, 2.5 percent of developer replies to Corgea's security comments were written by an agent. Now it's about a third.
Ahmad Sadeddin breaks down the data with Chris Romeo.
#AppSec #AISecurity
appsecpodcast.com/your-devel…
No human uses an em dash.
That's one way Corgea measures it: 35 to 60 percent of developer replies to security comments on PRs are now written by AI agents.
Ahmad Sadeddin joins Chris Romeo on the AppSec Podcast.
#AppSec #AISecurity
youtu.be/AlJMKHCubmI
Before the OWASP MCP Top 10, Vandana Verma Sehgal was spotlighting OWASP projects one video at a time.
Revisit her 2021 episode on the OWASP Spotlight Series.
#AppSec #OWASP
youtu.be/g0KfZtNzmIk
AI writes code faster than anyone reviews the design.
Security Compass models threats continuously.
Thanks to Security Compass for sponsoring this week's episode with Vandana Verma Sehgal.
#AppSec #ThreatModeling
appsecpodcast.com/securityco…
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design reviews to autonomous pentesting.
Thanks to Corgea for sponsoring this week's episode with Vandana Verma Sehgal.
#AppSec #AIsecurity
appsecpodcast.com/corgea
"Authenticate every action, authorize every sensitive action."
Vandana Verma Sehgal's rule for MCP. Long-lived tokens and inherited permissions can give an agent access to your entire account.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Why does MCP need its own OWASP Top 10?
Vandana Verma Sehgal: A malicious tool description gets pulled into the model's context and treated as trusted guidance before anyone even uses the tool.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Your developers are running MCP servers your security team can't see.
Vandana Verma Sehgal, leader of the OWASP MCP Top 10, on shadow MCP, scope creep, and why a secure MCP server should be boring.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Before this week's episode, go back to 2024: Brook Schoenfield on security, stories, jazz, and stage presence on The Security Table.
#AppSec #SecurityArchitecture
youtube.com/watch?v=AJSgUR_0…
AI writes code faster than anyone reviews the design.
Security Compass continuously models threats and translates them into actionable requirements for developers.
#AppSec #ThreatModeling
appsecpodcast.com/securityco….
The Application Security Podcast retweeted
Earlier this week I listened to: Vulnerability Jail and the AI-Era AppSec podcast by @AppSecPodcast and took down a few note and two questions that bordered around trust and accountability in the use of agents.
Today, fortunately at a workstation, I ran into an AI engineer who's also very much interested and is participating in AI governance research and shared my thoughts. Our conversation made me realize I could thread this path further with my curiosity to see how the industry could strike a balance. Or not. 💡
"If I close 10%, I've improved Cisco by 10%. Fantastic. Stop trying for perfection."
Brook Schoenfield on why one fixed weakness beats a perfect plan, and why AI threat models still count.
#AppSec #ThreatModeling
appsecpodcast.com/your-opini…
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design to production: design reviews, AI SAST, dependency and IaC scanning, autonomous pentesting.
#AppSec #SAST
appsecpodcast.com/corgea
Security either embraces securing AI, or "you will be left in the dust. It's that simple."
Brook Schoenfield on learned fragility and why your opinion on AI doesn't matter.
#AppSec #AIsecurity
appsecpodcast.com/your-opini…
Your opinion on AI doesn't matter. Learned fragility does.
@BrkSchoenfield joins Chris and Robert on the illusion of omniscient perfection, AI threat models, and why we should stop chasing vulnerabilities.
#AppSec #AIsecurity
appsecpodcast.com/your-opini…
More @manicode? Go back to 2023, when Jim told The Security Table the untold story of his relationship with threat modeling.
#AppSec #ThreatModeling
youtube.com/watch?v=JENmqlS4…
AI writes code faster than anyone can review the design.
Security Compass continuously models threats and translates them into actionable requirements for developers.
#AppSec #ThreatModeling
appsecpodcast.com/securityco…