Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing

What can practitioners learn from a new OWASP document, an upcoming conference, and an industry analyst report in one conversation? Chris and Robert test a multi-topic format by reviewing Proactive Controls 3.0, previewing AppSec USA, and discussing Gartner’s application security testing market analysis. They examine renamed controls, digital identity guidance, conference learning and hallway conversations, and the range of testing products covered by the report. The hosts compare static, dynamic, interactive, and runtime approaches while questioning predictions about adoption and unfamiliar vendors. The episode captures a moment in the market rather than offering timeless rankings, but its method remains useful: read frameworks and analyst material critically, understand what each category measures, and investigate tools in the context of your own development program.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Chris Romeo and Robert Hurlbut:→ Chris Romeo on LinkedIn→ Robert Hurlbut on LinkedInMentioned in this episode:→ OWASP Proactive Controls→ OWASP Proactive Controls→ OWASP Threat Dragon Project→ Contrast SecurityFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Three AppSec topics in one episode01:36 OWASP Proactive Controls 3.002:58 Renamed and reorganized controls04:15 Strong digital identity05:36 Why AppSec USA matters08:19 Fundamentals and advanced conference content11:01 Meeting the podcast community12:52 Gartner’s application security testing report14:13 Predictions about testing adoption16:36 Interactive and runtime testing18:46 Unfamiliar vendors in the market20:27 Using analyst reports as a starting point22:34 Closing thoughts