The Boring AppSec Podcast
This podcast discusses the hosts' experiences working at various companies, from startups to large enterprises and from tech to security firms. They cover both the positive and negative aspects of their career paths, including building side projects and startups. The show features candid conversation and strong opinions on all things security. The tone is casual and straightforward, aiming to share real-world insights from the application security field.
Episodes
Ep 37: The Future of Security Testing in an AI-Driven World with Jason Haddix
In this episode, Jason Haddix (CEO of Arcanum Information Security and creator of the Bug Hunter’s Methodology) joins us to examine how AI is changing penetration testing and security research. He explains that while AI agents can automate reconnaissance, code analysis, and parts of vulnerability discovery, meaningful results still depend on human expertise, methodology, and context engineering.Th
Ep 36: Discussing AI's Current State of Affairs
In this episode, we examine what is shifting in AI, AppSec, and product security and what remains fundamentally the same.For years, application security has operated on a familiar model: siloed reviews, tool-driven findings, and periodic assessments that struggle to keep pace with modern development. AI doesn’t eliminate those pressures, it amplifies them. Code is generated faster, systems are mor
Ep 35: Exploring Security After Determinism with Jens Ernstberger
In this episode, we sit down with Jens to explore why AI agents fundamentally break traditional security assumptions, from API keys and browser sessions to composability and access control.Drawing parallels to DeFi exploits and smart contract failures, he explains why agent identity, short-lived delegated authorization, and zero trust aren’t optional add-ons, but the foundation for safely running
Security at Scale in a Probabilistic World with Ankur Chakraborty
In this episode, Ankur Chakraborty discusses the evolution of AI security, emphasizing the importance of foundational security principles in the context of generative AI. He explores the challenges of scaling security measures in an era of rapid feature deployment and the necessity of integrating AI tools into security practices. The conversation delves into the balance between human oversight and
The Future of Identity in AI Agents with Ian Livingstone
In this conversation, Ian Livingstone discusses the changing landscape of AI and security, focusing on the challenges of agent identity and the need for a new approach to application security. He emphasizes the importance of understanding the non-deterministic nature of AI agents and the implications for identity management, permissions, and data security. The discussion also touches on the future
Rethinking Enterprise Security in an AI- and Platform-First World with Kane Narraway
In this episode, we sit down with Kane Narraway to unpack how enterprise security is changing as AI, platforms, and developer-driven security become the norm. Kane shares his path from digital forensics to leading security at Canva, and why understanding company culture matters just as much as choosing the right tools.We discuss why modern security is becoming platform-first, why much of the secur
The Future of Developer Security with Travis McPeak
In this episode, we sit down with Travis McPeak, one of the most prominent thinkers in the space of developer security. Travis, who built his career at the intersection of security automation and developer productivity, shares his philosophy on achieving security at scale in the AI era. His career spans security leadership roles at major tech companies, including Symantec, IBM, Netflix, and Databr
Scaling Product Security In The AI Era with Teja Myneedu
In this episode, we sit down with Teja Myneedu, Sr. Director, Security and Trust at Navan. He shares his philosophy on achieving security at scale, discussing some challenges and approaches specially in the AI era. Teja's career spans over two decades on the front lines of product security at hyper-growth companies like Splunk. He currently operates at the complex intersection of FinTech and c
Architecting AI Security: Standards and Agentic Systems with Ken Huang
In this episode, we sit down with Ken Huang, a core architect behind modern AI security standards, to discuss the revolutionary challenges posed by agentic AI systems. Ken, who chairs the OWASP AIVSS project and co-chairs the AI safety working groups at the Cloud Security Alliance, breaks down how security professionals are writing the rulebook for a future driven by autonomous agents.Key Takeaway
The Attacker's Perspective on AI Security with Aryaman Behera
In this episode, hosts Sandesh and Anshuman chat with Aryaman Behera, the Co-Founder and CEO of Repello AI. Aryaman shares his unique journey from being a bug bounty hunter and the captain of India's top-ranked CTF team, InfoSec IITR, to becoming the CEO of an AI security startup. The discussion offers a deep dive into the attacker-centric mindset required to secure modern AI applications, whi
From Toil to Intelligence: Brad Geesaman on the Future of AppSec with AI Agents
In this episode, host Anshuman Bhartiya sits down with Brad Geesaman, a Google Cloud Certified Fellow and Principal Security Engineer at Ghost Security, to explore the cutting edge of Application Security. With 22 years in the industry, Brad shares his journey and discusses how his team is leveraging agentic AI and Large Language Models (LLMs) to tackle some of the oldest challenges in AppSec, aim
The Future of Autonomous Red Teaming with Ads Dawson
In this episode, we talk to Ads Dawson (Staff AI Security Researcher @ Dreadnode). We discuss the evolving landscape of offensive security in the age of AI. The conversation covers the practical application of AI agents in red teaming, a critical look at industry standards like the OWASP Top 10 for LLMs, and Ad's hands-on approach to building and evaluating autonomous hacking tools. He shares
Navigating AI's New Security Landscape with Vineeth Sai
In this episode, we talk to Vineeth Sai Narajala (Senior Security Engineer @ Meta). We discuss the evolving landscape of AI security, focusing on the Model Context Protocol (MCP), Enhanced Tool Definition Interface (ETDI), and the AI Vulnerability Scoring System (AIVSS). We explore the challenges of integrating AI into existing systems, the importance of identity management for AI agents, and the
Agentic AI: Transforming Vulnerability Management with Harry Wetherald
In this episode, we talk to Harry Wetherald (Co-Founder and CEO @ Maze). We explore the evolving landscape of vulnerability management. Harry shares insights from his journey in AI and machine learning, discussing the challenges of triaging vulnerabilities across diverse organizations. The conversation delves into the concept of agentic AI, the importance of context engineering, and the hurdles of
Surag Patel and Arshan Dabirsiaghi
In this episode, we talk to Surag Patel (CEO @ Pixee) and Arshan Dabirsiaghi (CTO @ Pixee). We discuss the transformative approach that Pixee is taking in application security. We explore the shift from traditional security tools that merely detect vulnerabilities to a model that emphasizes automated remediation. The discussion covers the evolving role of AppSec professionals, the integration of A
Ken Johnson
In this episode, we talk to Ken Johnson, Co-Founder & CTO @ DryRun Security. Ken discusses the evolution of application security, focusing on the role of AI and LLMs in enhancing security practices. He emphasizes the importance of context engineering over traditional prompt engineering, the challenges of consistency and repeatability in LLM outputs, and the ethical considerations surrounding A
Casey Ellis
In this episode, we talk to Casey Ellis, Founder & Advisor @Bugcrowd.Casey shares his personal journey through health challenges and his insights into the cybersecurity landscape. He discusses the evolution of the bug bounty industry, the importance of secure design, and the role of AI in both enhancing and complicating security measures. Casey emphasizes the need for accountability and the po
S2E10 - Vivek Ramachandran
In Season 2 Episode 10, we talk to Vivek Ramachandran, Founder @SquareXTeam .In this episode, Vivek shares his journey in cybersecurity, discussing the evolution of content creation, the importance of building for a global audience, and navigating the Indian cybersecurity market. He emphasizes the need for browser security, the challenges of local markets, and the significance of personal relati
S2E9 - Ali Mesdaq
In Season 2 Episode 9, we talk to Ali Mesdaq, Founder & CEO @ Amplify Security.We discuss the evolution of security tools, the importance of customer validation, and the role of AI agents in enhancing security practices. Ali shares insights on building a positive security culture within organizations and how Amplify Security differentiates itself in a competitive market. The conversation empha
S2E8 - Ankita Gupta
In Season 2 Episode 8, we talk to Ankita Gupta, Co-Founder & CEO @ Akto.ioAnkita shares her unique journey into the cybersecurity space, discussing her diverse background and the inception of her API security company. She emphasizes the importance of understanding customer needs, the role of co-founders in a startup's success, and the surprising maturity of buyers in the cybersecurity indu
S2E7 - Jonathan Cran
In Season 2 Episode 7, we talk to Jonathan Cran, Founder @ Stealth.Jonathan is a seasoned security industry veteran, discussing the evolution of AI in security, the challenges of adopting AI technologies in enterprises, and the future of attack surface management. We explore the role of AI agents, the importance of context in security solutions, and provide insights for cybersecurity entrepreneurs
S2E6 - Vibhav Sreekanti
In Season 2 Episode 6, we talk to Vibhav Sreekanti, Co-Founder & CTO @ProphetSecurity .We discuss the evolving landscape of AI in cybersecurity, the skepticism surrounding generative AI, and the importance of experimentation with AI agents. Vibhav shares insights on building specialized agents for security operations, the challenges of deploying AI in production, and the critical need for sec
S2E5 - Drew Dennison
In Season 2 Episode 5, we talk to Drew Dennison, Co-Founder & CTO @ Semgrep.
We discuss the evolution of Semgrep as a code security tool, its focus on custom rules, and the importance of open source in democratizing application security. Drew shares insights from his entrepreneurial journey, the challenges faced in the early days of Semgrep, and the lessons learned from working in both the de
S2E4 - Varun Badhwar
In Season 2 Episode 4, we talk to Varun Badhwar, Founder & CEO @ Endor Labs.
We discuss the current state of application security, the challenges faced by development teams, and the importance of integrating security into the software development lifecycle. Varun shares insights from his previous experiences in building and acquiring cybersecurity companies, emphasizing the need for effective
S2E3 - Robert Wood
In Season 2 Episode 3, we interview Robert Wood, Founder & CEO @ SideKick Security.
We discuss Rob's journey from working at Cigital to starting his own consulting firm, the challenges of point solutions in cybersecurity, and the importance of soft skills in the industry. Rob shares insights on platformization versus services, tailoring security programs to unique needs, and building a se
S2E2 - Dustin Lehr
In Season 2 Episode 2, we interview Dustin Lehr, Co-Founder, Chief Product & Technology Officer at Katilyst.
We discuss the significance of security champions in application security. We explore the cultural aspects of implementing security champions programs, the challenges of maintaining engagement, and the importance of leadership support. The conversation delves into measuring the success
S2E1 - Jimmy Mesta
In Season 2 Episode 1, we interview Jimmy Mesta, a seasoned expert in application security and co-founder of RAD Security.
We discuss the evolution of Kubernetes, its security challenges, and the importance of understanding the complexities of cloud-native infrastructure. Jimmy shares insights from his journey of starting a company, the role of AI in security, and the nuances of investing in sec
S1E10 - Future Security Predictions
Welcome to the Boring AppSec Podcast! In Episode 10, we discuss some security predictions that we hope to see in the near future. Some of them are:
AI agents - different kinds - activity based and/or persona based
Security talent is going to get better, hiring is important
AI powered security engineers - up leveling junior engineers
AI code review assistants - GPT4-o et al
Company consoli
S1E09 - Incidents
Welcome to the Boring AppSec Podcast! In Episode 9, we discuss incidents. Both Sandesh and I share 2 incidents each and the lessons learnt from them. Tune in!
References mentioned in the episode:
Log4j - https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance
Incident runbook - https://engineering.razorpay.com/how-an-incident-transformed-razorpay-improving-the-5-why-rca-fo
S1E08 - Bug Bounties Part 2
Welcome to the Boring AppSec Podcast! In Episode 8, we continue discussing bug bounties from where we left off in Episode 3. We discuss how to build mature bug bounty programs, how to start a program, how to convince stake holders to start a program, differences and similarities between vulnerability disclosure programs and bug bounty programs among other things. Tune in!
Contacting Anshuman
L
S1E07 - Hiring in Security
Welcome to the Boring AppSec Podcast! In Episode 7, we discuss how to hire the right security folks on a security engineering team. We go over the interviewing process, what to look out for, how to compose a team, and also share some of our experiences of interviewing including some tips on what a candidate can/should do if they want to get noticed by hiring managers and recruiters.
Contacting A
S1E06 - Vulnerability Management
Welcome to the Boring AppSec Podcast! In Episode 6, we discuss the art of Vulnerability Management. What it means, what are some of the problems we've seen as practitioners, what are some ways we've considered to make the process of managing vulnerabilities easy.
References:
We will try and add information about all the references we make here. Please enter rabbit holes at will :)
Git
S1E05 - Threat Modeling
Welcome to the Boring AppSec Podcast! In Episode 5, we dig deep into what threat modeling is from a practitioner's perspective. We compare it with design reviews and discuss when/how/why of threat modeling. In the end, we wrap up by talking about how Gen AI could help threat modeling significantly.
References:
We will try and add information about all the references we make here. Please ente
S1E04 - Running a lean AppSec team
Welcome to the Boring AppSec Podcast! In Episode 4, we discuss how lean AppSec teams run and operate. We share our experiences of having worked in engineering heavy organizations where the "engineer : appsec-engineer" ratio is far from ideal and scaling the AppSec team becomes very important to be able to reasonably manage risk.
References:
We will try and add information about all the
S1E03 - Bug Bounties
Welcome to the Boring AppSec Podcast! In Episode 3, we discuss all things bug bounties. The researcher side as well as the program owner's side. Enter at your own will as we have a lot of hot takes.
References:
We will try and add information about all the references we make here. Please enter rabbit holes at will :)
Bug Bounty Platforms
Bugcrowd - https://www.bugcrowd.com/
HackerOn
S1E02 - First Security Hire
Welcome to the Boring AppSec Podcast! In Episode 2, we discuss what a first security hire responsibilities are. How do they prioritize? What do they prioritize?
References:
We will try and add information about all the references we make here. Please enter rabbit holes at will :)
Building a product security program
Some blogs on getting SOC2 certifications without too much redtape - RunRev
S1E01 - Asset Inventory
Welcome to the Boring AppSec Podcast! In Episode 1, we discuss software inventories. What they are, why we need them, and what are our favorite ways to build them.
References:
We will try and add information about all the references we make here. Please enter rabbit holes at will :)
Cartography - https://github.com/lyft/cartography
GenAI + Cartography
https://shinobi.security/#how-it-
Recommended
این نقطه
Solved Murders - True Crime Stories
紐約鳥｜New York Aperture
Doctor Zhivago Slow Read
Apple News In Conversation
The Young and Called Podcast .
Jubal Phone Pranks from The Jubal Show
پلی لیست | PlayList
English with Olivia | Slow Conversations & Vocabulary
Bible Tea
TED Talks Daily
Pod Save America
