Jon McCoy -- The Mindset to Reverse Engineer

How does a developer learn to take software apart and use that knowledge to build it more securely? Jon McCoy joins Chris and Robert to discuss reverse engineering, the habits of a breaker, and the connection between offensive research and everyday development. He explains what reverse engineering means, describes experiments with malware and .NET applications, and shows how familiar practices such as unit testing can incorporate security thinking. The conversation explores framework protections, how much coding knowledge penetration testers need, and the role of local developer and security communities. Jon’s advice for newcomers is practical: choose an application, inspect how it works, and learn by experimenting. The episode emphasizes curiosity and repeated hands-on work as foundations for deeper software understanding.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Jon Mccoy:→ Jon McCoy on X→ Jon McCoy on GitHubMentioned in this episode:→ NDC Conferences→ DEF CON→ MetasploitFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Reverse engineering with Jon McCoy01:53 Why a developer became interested in security02:27 What reverse engineering means03:24 Teaching security through familiar developer practices04:06 Adding security thinking to unit tests05:00 Malware experiments and the breaker mindset07:56 Helping others learn to break software11:22 Security in the .NET framework14:39 How much code should a penetration tester know?17:45 Learning through developer and security communities19:47 A first month of learning to reverse engineer21:26 Resources and hands-on experimentation