The Application Security Podcast

The Application Security Podcast is a practitioner-led show for anyone building or securing modern software—and now AI-powered applications. Hosts Chris Romeo and Robert Hurlbut talk with the people shaping application security about AI and LLM security, threat modeling, secure development, OWASP, cloud, DevSecOps, security champions, and building programs that help engineering teams move faster and safer. With more than 300 episodes, the show turns real-world experience into practical guidance for developers, architects, AppSec professionals, and security leaders.

The Application Security Podcast is a technology podcast hosted by Chris Romeo and Robert Hurlbut, with 310 episodes on record and a Required Pod Score of 80.

Chris Romeo and Robert Hurlbut hosts The Application Security Podcast, a technology show with 310 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #14

  Why AI Code Review Will Replace Human Review Faster Than You Think

  Sep 28, 202649 minS13

  Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company. The founder of Manicode Security returns to explain why AI didn't kill AppSec education but supercharged it, why vague prompting on frontier models turns companies into "token furnaces," and why prompt injection is the one genuinely new vulnerability class of the AI era. He walks Chris and Robert through his full AI coding workflow, from reverse engineering an architecture file to security rules and planning-mode build plans that make AI output deterministic. The three debate whether AI will finally eliminate SQL injection, whether AppSec vendors can survive without integrating cyber models, and when humans still need to step in: the moment an agent tries something its policy doesn't allow. Plus: the one habit every security leader should teach developers now. This episode is sponsored by Security Compass . Make modern software development secure, consistent, and provable. About Security Compass AI writes code faster than anyone reviews the design. Threats do not wait for an annual assessment. Security Compass models threats continuously and turns them into requirements developers act on, not a report read after ship. → Learn more about securing the AI-DLC with Security Compass This episode is sponsored by Corgea . Design it. Build it. Ship it. Corgea secures it. About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. → Learn more about Corgea Connect with Jim Manico: → Jim Manico on LinkedIn Mentioned in this episode: → Manicode Security → Manicode Forge → OWASP Artificial Intelligence Security Verification Standard (AISVS) → OWASP AISVS on GitHub → Claude Code → Ollama Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast Chapters: 00:00:00 - Cold open: the era of code review is ending 00:00:47 - Meet Jim Manico 00:01:03 - Welcome and what gets Jim away from screens 00:05:29 - How AI changed developer security education 00:07:03 - Teaching developers to use AI well 00:09:26 - Where AI and AppSec stand: the token furnace 00:12:08 - Separating signal from hype 00:14:24 - Integrate with cyber models or die: the future of AppSec tools 00:18:34 - Are AI coding assistants creating new vulnerabilities? 00:20:02 - Prompt injection: the one truly new class 00:21:15 - Will AI eliminate the OWASP Top 10? 00:24:18 - Local models and Apple's hardware edge 00:28:32 - Jim's AI coding workflow, step by step 00:33:57 - The end of human code review 00:38:31 - Can we trust AI code review, and when do humans step in? 00:44:56 - Where companies really are with AI 00:47:02 - One change for security leaders: planning mode 00:48:19 - Wrap up

  ListenShow Notes
• 

  Episode #13

  Vulnerability Jail and the AI-Era AppSec Engineer

  Sep 22, 202645 minS13

  Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. Jeevan, Director of Security Engineering at Rippling, returns to unpack how his team polices thousands of engineers shipping 10x more code: a "vulnerability jail" that locks non-compliant teams out of the main branch, AI-reviewed extension requests, and homegrown agents that hunt for entire classes of vulnerabilities instead of one bug at a time. He and Chris debate whether AI has killed classic SAST and DAST, whether code review still needs a human in the loop, and whether bug bounty programs still make sense when the researchers on both sides are running the same models. Plus: one concrete move every AppSec leader can make this quarter. This episode is sponsored by Security Compass . Make modern software development secure, consistent, and provable. About Security Compass AI writes code faster than anyone reviews the design. Threats do not wait for an annual assessment. Security Compass models threats continuously and turns them into requirements developers act on, not a report read after ship. → Learn more about securing the AI-DLC with Security Compass This episode is sponsored by Corgea . Design it. Build it. Ship it. Corgea secures it. About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. → Learn more about Corgea Connect with Jeevan Singh: → Jeevan Singh on LinkedIn Mentioned in this episode: → Rippling → Dwarkesh Patel: "The Rise and Fall of Agent Civilizations" (essay on the OpenAI–Hugging Face incident) Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast Chapters: 00:00:00 - Cold open: vulnerability jail 00:00:55 - Meet Jeevan Singh 00:01:11 - Welcome and Robert's AI lab 00:02:37 - What gets Jeevan away from the machines 00:04:51 - Hardware projects with his son 00:06:20 - What's changed for the AppSec engineer since AI 00:08:17 - Shipping production code and fixing whole vulnerability classes 00:09:13 - Why AppSec has to become less collaborative 00:10:02 - From democratized vuln management to vulnerability jail 00:11:50 - How engineering reacted and the feature flag jail precedent 00:14:05 - From manual jail to automated checks 00:15:30 - An AI bot that reviews SLA extensions 00:16:06 - Can AI wipe out an entire vulnerability class? 00:17:36 - Building an anti-SSRF library and rolling it out 00:19:40 - Which AppSec skills matter now 00:22:28 - Validating all that AI-generated code 00:22:57 - Agents that hunt for vulnerability classes 00:24:38 - Is this the death of classic AppSec tools? 00:26:51 - Code review and humans in, on, and out of the loop 00:28:00 - Objective-based agents that find RCEs 00:28:59 - Build vs. buy for AppSec teams 00:31:29 - Advice for teams of one to five AppSec engineers 00:32:58 - Cutting SLAs to 3, 5, 7, and 10 days 00:34:31 - Parachuted in as the only AppSec engineer 00:37:59 - One investment to make this quarter 00:39:09 - The Hugging Face and OpenAI agent incident 00:40:13 - Is bug bounty dead? 00:42:19 - Key takeaways: be an engineer, run toward AI 00:43:53 - Wrap-up

  ListenShow Notes
• 

  Episode #12

  How Agentic AI Fails—and Which Controls Actually Stop It

  Sep 14, 202637 minS13

  Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents. Petra traded emergency medicine for application security and now heads information security at Numan — and she joins Chris Romeo and Robert Hurlbut to make the case for fault tree analysis (FTA), the deductive method that picks up exactly where threat modeling stops. Petra walks through a "wrong customer refund" AI agent scenario step by step, showing how AND/OR gates and minimal cut sets turn vague worry into ranked, data backed probabilities. They dig into where AI helps build a tree, and where garbage in, garbage out still applies, why "comprehensive test coverage" is a myth, and how attaching real dollar figures to failure paths makes it easier to sell security controls to leadership. This episode is sponsored by Corgea . Design it. Build it. Ship it. Corgea secures it. About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. → Learn more about Corgea Connect with Petra Vukmirovic: → Petra Vukmirovic on LinkedIn → OWASP Threat Model Library Mentioned in this episode: → Adam Shostack: "Stop Trying to 'Manage Risk'" (keynote) → OWASP Global AppSec USA 2026 (San Francisco, Nov 5–6) Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast Chapters: 00:00 Cold open — the math behind where to put your controls 01:09 Meet Petra Vukmirovic 01:28 Petra's origin story: from ER doctor to AppSec 02:50 Career path: engineer to Head of InfoSec at Numan 04:18 What is fault tree analysis, and where threat modeling ends 06:22 Can AI actually do fault tree analysis? 08:12 Walking the "wrong customer refund" agent example 12:33 Storing your trees: JSON vs. Markdown 16:08 Why conjunctive failures trip up narrow thinking 17:27 Top 3 failure modes when agents touch downstream systems 19:29 Real story: an agent pushed code to main without approval 21:27 Testing: why "comprehensive coverage" is a myth 23:54 How rough is rough? Assigning probabilities 28:08 Getting started without a six week science project 31:35 Using FTA to sell controls and build credibility 33:43 The epiphany: FTA is about controls, not faults 34:48 The one thing every agentic team should add today 35:48 Closing thoughts and OWASP Global AppSec USA preview

  ListenShow Notes
• 

  Episode #11

  Your AppSec Bottleneck Is a People Problem

  Sep 7, 202648 minS13

  What makes a security champions program successful—and why do so many fail? Lisi Hocke explains how psychological safety, cognitive load, power sources, and community can help create sustainable programs. We also explore reducing security wait times, gaining organizational support, the role of AI, why champions meetings shouldn’t be recorded, and the importance of putting people first. This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. Learn more at Corgea.com . About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. Learn more about Corgea . FOLLOW US ON SOCIAL MEDIA: ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ListenShow Notes
• 

  Episode #10

  AI Pen Testing Killed Traditional DAST

  Aug 31, 202644 minS13

  Is traditional DAST finally dead? James Berthoty explains how AI pentesting is changing the dynamics of security testing through contextual payloads, autonomous agents, and application-aware vulnerability discovery. We also explore token costs, AI-native security vendors, the future of bug bounties, testing in production, and whether model providers could eventually absorb today’s security tools. This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. Learn more: https://bit.ly/4wMCNUf About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. Learn more about Corgea → https://bit.ly/4wMCNUf FOLLOW OUR SOCIAL MEDIA: ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ListenShow Notes

Recent guests on The Application Security Podcast. Study who booked and why before you pitch.

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.