Modern AppSec that keeps pace with AI development - James Wickett - ASW #372
Application Security Weekly (Audio)
Release Date: 03/03/2026
Why Proactive Security Is Far Better Than Patching - Erik Nost - ASW #375
Application Security Weekly (Audio)
So much of appsec’s efforts can be consumed by vuln management and a race to patch security flaws. But that’s more a symptom of the ease of scanning and the volume of CVEs. Erik Nost walks through the principles behind proactive security, why the concept sounds familiar to secure by design, and why organizations still struggle with creating effective practices for visibility. Resources Visit for all the latest episodes! Show Notes:
info_outline
Creating Better Security Guidance and Code with LLMs - Mark Curphey - ASW #374
Application Security Weekly (Audio)
What happens when secure coding guidance goes stale? What happens LLMs write code from scratch? Mark Curphy walks us through his experience updating documentation for writing secure code in Go and recreating one of his own startups. One of the themes of this conversation is how important documentation is, whether it's intended for humans or for prompts to LLMs. Importantly, LLMs don't innovate on their own -- they rely on the data they're trained on. And that means there should be good authoritative sources for what secure code looks like. It also means that instructions to LLMs need to be...
info_outline
Making Medical Devices Secure - Tamil Mathi - ASW #373
Application Security Weekly (Audio)
Medical devices are a special segment of the IoT world where availability and patient safety are paramount. Tamil Mathi explains why many devices need to fail open -- the opposite of what traditional appsec approaches might initially think -- and what makes threat modeling these devices interesting and unique. He also covers how to get started in this space, from where to learn hardware hacking basics to reviewing firmware and moving up the stack to the application layer. Segment Resources: Visit for all the latest episodes! Show Notes:
info_outline
Modern AppSec that keeps pace with AI development - James Wickett - ASW #372
Application Security Weekly (Audio)
As more developers turn to LLMs to generate code, more appsec teams are turning to LLMs to conduct security code reviews. One of the biggest themes in all the discussion around LLMs, agents, and code is speed -- more code created faster. James Wickett shares why speed continues to pose a challenge to appsec teams and why that's often because teams haven't invested enough in foundational appsec principles. Visit for all the latest episodes! Show Notes:
info_outline
Helping Users with Practical Advice to Protect their Digital Devices - Runa Sandvik - ASW #371
Application Security Weekly (Audio)
Journalists put a lot of effort into collecting information and protecting their sources, but everyone can benefit from having a digital environment that's more secure and more privacy protecting. Runa Sandvik shares her experience working with journalists and targeted groups to craft plans for how they use their devices and manage their information. And she also makes the point that the burden of security should not be just for users -- platforms and software providers should be evaluating secure defaults and secure designs that improve protections for everyone. Resources Visit for all...
info_outline
Conducting Secure Code Analysis with LLMs - ASW #370
Application Security Weekly (Audio)
A major premise of appsec is figuring out effective ways to answer the question, "What security flaws are in this code?" The nature of the question doesn't really change depending on who or what wrote the code. In other words, LLMs writing code really just means there's mode code to secure. So, what about using LLMs to find security flaws? Just how effective and efficient are they? We talk with Adrian Sanabria and John Kinsella about the latest appsec articles that show a range of results from finding memory corruption bugs in open source software to spending an inordinate amount of manual...
info_outline
Bringing Strong Authentication and Granular Authorization for GenAI - Dan Moore - ASW #369
Application Security Weekly (Audio)
When it comes to agents and MCPs, the interesting security discussion isn't that they need strong authentication and authorization, but what that authn/z story should look like, where does it get implemented, and who implements it. Dan Moore shares the useful parallels in securing APIs that should be brought into the world of MCPs -- especially because so many are still interacting with APIs. Resources Visit for all the latest episodes! Show Notes:
info_outline
Focusing on Proactive Controls in the Face of LLM-Assisted Malware - Rob Allen - ASW #368
Application Security Weekly (Audio)
Everyone is turning to LLMs to generate code, including attackers. Thus, it's no great surprise that there are now examples of malware generated by LLMs. We discuss the implications of more malware with Rob Allen and what it means for orgs that want to protect themselves from ransomware. Resources This segment is sponsored by ThreatLocker. Visit to learn more about them! Visit for all the latest episodes! Show Notes:
info_outline
Building proactive defenses that reflect the true nature of modern software risk - Paul Davis - ASW #367
Application Security Weekly (Audio)
Supply chain security remains one of the biggest time sinks for appsec teams and developers, even making it onto the latest iteration of the OWASP Top 10 list. Paul Davis joins us to talk about strategies to proactively defend your environment from the different types of attacks that target supply chains and package dependencies. We also discuss how to gain some of the time back by being smarter about how to manage packages and even where the responsibility for managing the security of packages should be. Visit for all the latest episodes! Show Notes:
info_outline
Lessons from MongoBleed, CWE Top 25, and Secure Coding Benchmarks - ASW #366
Application Security Weekly (Audio)
MongoBleed and a recent OWASP CRS bypass show how parsing problems remain a source of security flaws regardless of programming language. We talk with Kalyani Pawar about how these problems rank against the Top 25 CWEs for 2025 and what it means for relying on LLMs to generate code. Visit for all the latest episodes! Show Notes:
info_outlineAs more developers turn to LLMs to generate code, more appsec teams are turning to LLMs to conduct security code reviews. One of the biggest themes in all the discussion around LLMs, agents, and code is speed -- more code created faster. James Wickett shares why speed continues to pose a challenge to appsec teams and why that's often because teams haven't invested enough in foundational appsec principles.
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-372