PODCAST · technology
Absolute AppSec
by Ken Johnson and Seth Law
A weekly podcast of all things application security related. Hosted by Ken Johnson and Seth Law.
Episodes
-
Episode 337 - w/Coffee, Chaos, and ProdSec - AI Guardrails, Risk Prioritization Shift
In episode 337, the hosts reconvene for their quarterly crossover discussion with Kurt and Cameron from the Coffee, Chaos, and ProdSec podcast to analyze the current state of software security, AI guardrail limitations, and operational risk management. The technical commentary evaluates the...
-
Episode 336 - Hardware Image Signing, Bot Reduction, AI Code Insecurities
In Absolute AppSec Episode 336, the hosts explore hardware-level image signing, bot traffic anomalies, cross-site scripting (XSS) developments, and AI-driven code quality challenges. The episode opens with an analysis of Apple's C2PA hardware-level cryptographic signing for photos, evaluating how...
-
Episode 335 - w/ Ron Perris - Secure Coding with AI
In episode 335 of Absolute AppSec, Seth and Ken sit down with Ron Perris. Ron is Chief Technology Officer at Manicode Security, to discuss the integration of AI into secure software development and AppSec workflows. The conversation explores the rapid adoption of large language models (LLMs) and...
-
Episode 334 - w/ Ryan Lloyd - Mobile Application Security
In episode 334 of Absolute AppSec, hosts Ken Johnson and Seth Law interview Ryan Lloyd, Chief Product Officer at GuardSquare, to explore mobile application security and product management strategy. Lloyd details GuardSquare's evolution from the open-source Java optimizer ProGuard—which introduced...
-
Episode 333 - LLM Patching Flaws, AI Code Regressions, Bug Bounty Economy
Sponsored by GuardSquare (guardsquare.com), the discussion of Episode 333 opens with an analysis of a 1Password academic paper evaluating how frontier LLMs perform at autonomous vulnerability patching. The research indicates that LLMs successfully generate functional, side-effect-free patches…
more -
Episode 332 - AI SDLC, Call for Cyber Defense, Rumor as the Exploit
In episode 332, the discussion focuses on how artificial intelligence is reshaping the Software Development Lifecycle (SDLC). The episode analyzes Anthropic's blog post regarding an "AI-native SDLC," evaluating its vision of replacing traditional development bottlenecks with AI workflows. The...
-
Episode 331 - Being "Mythos" Ready, CRLF-Powered De-sync Attacks
Sponsored by Guardsquare (guardsquare.com), Episode 331 focuses heavily on the growing role of AI agents in application security and how organizations should build and defend against agentic systems. Ken and Seth argue that effective AI security systems should combine deterministic tooling with…
more -
Episode 330 - w/ Jeevan Singh - Vulnerability Jail
In this special episode of Absolute AppSec, we cover a topic which started as a solution proposed by Rippling Security's Jeevan Singh: Vulnerability Jail. As Jeevan describes it: "In this new AI world, we have seen many more vulnerabilities, and we struggled to get Engineering to fix them all in…
more -
Episode 329 - AI exploitability, IDOR prevention, Smart TV Proxies
In this episode, sponsored by GuardSquare (guardsquare.com), Ken Johnson and Seth Law discuss OpenAI's reported Hugging Face security incident, questioning whether the model demonstrated genuinely novel offensive capability or mostly chained known vulnerability patterns at high inference cost,...
-
Episode 328 - Wordpress RCE, Vuln Prioritization, AI memory exfiltration
In episode 328 of Absolute AppSec, sponsored by GuardSquare (guardsquare.com), Seth and Ken start by highlighting a newly disclosed, pre-authentication WordPress core Remote Code Execution (RCE) vulnerability ("WP2Shell"). The core discussion centers on Alex Gaynor's article regarding the influx…
more -
Episode 256 w/ John Poulin - Token Security, Staying Technical as a Manager
Ken Johnson (@cktricky) abandons the podcast this week to attend a conference and play business, so Seth (@sethlaw) bring in Cloud Security Partners CTO John Poulin (@forced_request) as a co-host. John and Seth start off by discussing the difference in virtual and in-person training. This is...
-
Episode 327 - w/Coffee, Chaos, and ProdSec - ASPM Consolidation, Vuln Prioritization
In episode 327 of Absolute AppSec, co-hosts Ken Johnson and Seth Law present a highly anticipated quarterly crossover episode with Cameron and Kurt from the Coffee, Chaos, and ProdSec podcast. Sponsored by GuardSquare, the group begins with lighthearted banter about their personal footwear…
more -
Episode 326 - AppSec Jobs, Benchmarking LLMs, Open Web Standards
In episode 326 of Absolute AppSec, sponsored by mobile application security provider GuardSquare (guardsquare.com), the hosts start with a deep-dive into pre-show discussions about the shifting macroeconomic landscape of AppSec jobs. They analyze an industry-wide trend where corporate hiring is...
-
Episode 325 - Simplified Threat Modeling, Defining A Vulnerability
In episode 325 of Absolute AppSec, co-hosts Ken Johnson and Seth Law first break down an informal guide to threat modeling, arguing that overly prescriptive frameworks like STRIDE induce a heavy cognitive load on developers. Instead, they advocate for simplified, creative questions to expose...
-
Episode 324 - Three Week Trap, Malicious Extensions
In episode 324 of Absolute AppSec, co-hosts Ken Johnson and Seth Law share a mix of security model critiques. Starting with industry dynamics, Ken recaps his recent presentation at OWASP Nova regarding the limits of human-scale AppSec, recounting a dramatic storm during the talk where patio…
more -
Episode 323 - Secrets Logs, Prompt Injection Risks
In episode 323 of Absolute AppSec, co-hosts Ken Johnson and Seth Law focus heavily on core application security vulnerabilities, legacy operational struggles, and the challenges of generative AI systems. After briefly discussing Seth’s recent trip to BSides Vancouver and confirming upcoming...
-
Episode 322 - Megalodon, Staged Package Publishing, AI Powered Honeypots
In episode 322, the co-hosts examine critical vulnerabilities, changing security standards, and adaptive defense mechanisms. They deep dive into the recent "Megalodon" breach, identifying it as a direct poisoned pipeline execution attack. Rather than exposing a flaw inside GitHub itself ,...
-
Episode 321 - The Future of AppSec
In episode 321 of Absolute AppSec, the co-hosts dive into a sprawling discussion about the future of Application Security amid the heavy noise of artificial intelligence and automated tools. The hosts start with a debate on whether traditional AppSec fundamentals remain relevant. Drawing…
more -
Episode 320 - Return of @lojikil - LLM Bug Hunting, AI OffSec, Defender Burnout
Ken is away, so Stefan Edwards (lojikil) joins Seth to talk all things AppSec. This episode starts by exploring the acceleration of AI on the offensive side of security, enabling threat actors to automate complex tasks like patch diffing, gadget discovery, and reverse engineering binaries. The...
-
Episode 319 - Vercel Breach, Security vs. Compliance, Pull Request Flows w/ AI Agents
Episode 319 covers a range of industry developments, primarily focusing on the recent Vercel security incident and the evolving landscape of AI-driven compliance. The hosts detail how a Vercel employee's use of a consumer-level Context AI plan led to a workspace compromise via a leaked OAuth…
more -
Episode 318 - Slack Impersonation, Mythos, Vulnerability Research Future
Episode 318 examines critical vulnerabilities and the evolving impact of AI on the security industry. The episode details a recent sophisticated impersonation and malware attack targeting open-source Slack communities, including their own, where attackers spoofed Seth's identity to distribute...
-
Episode 317 - (Post-RSAC/BSidesSF), Supply Chain Security, Future of SDLC
Ken Johnson and Seth Law reflect on the 2026 RSA Conference and BSidesSF, noting an industry-wide "awakening" regarding the high costs and engineering complexities of operationalizing AI security tools. A major focus is the recent "supply chain attack hell," specifically the compromise of the…
more -
Episode 316 - w/Coffee, Chaos, and ProdSec - Agentic Development Lifecycle
In episode 316 of Absolute AppSec, hosts Ken Johnson and Seth Law participate in a crossover with Kurt Hendle and Cameron Walters from the Coffee, Chaos, and ProdSec podcast to discuss the radical transformation of security roles in an AI-driven landscape. The guests share origin stories rooted…
more -
Episode 315 - Risks of "AI-Native" Security Products, Rapid Software Development
In episode 315 of Absolute AppSec, Ken Johnson and Seth Law discuss the rapidly evolving challenges of securing software in an era of AI-assisted development. The hosts provide updates on their "Harnessing LLMs for Application Security" training, noting that the field is changing so fast that…
more -
Episode 314 - LLM AppSec Disruption, Limitations of AI in Security, AppSec Oversight
In this episode, the hosts discuss the seismic shift in the application security landscape triggered by the rise of Large Language Models (LLMs) and Anthropic’s "Claude Code". They highlight the massive economic repercussions of these AI advancements, noting that billions in market value were…
more -
Episode 313 - AppSec Role Evolution, AI Skills & Risks, Phishing AI Agents
Ken Johnson and Seth Law examine the intensifying pressure on security practitioners as AI-driven development causes an unprecedented acceleration in industry velocity. A primary theme is the emergence of "shadow AI," where developers utilize unauthorized AI coding assistants and personal agents,...
-
Episode 312 - Vibe Coding Risks, Burnout, AppSec Scorecards
In episode 312 of Absolute AppSec, the hosts discuss the double-edged sword of "vibe coding", noting that while AI agents often write better functional tests than humans, they frequently struggle with nuanced authorization patterns and inherit "upkeep costs" as foundational models change behavior...
-
Episode 311 - Transformation of AppSec, AI Skills, Development Velocity
Ken Johnson and Seth Law examine the profound transformation of the security industry as AI tooling moves from simple generative models to sophisticated agentic architectures. A primary theme is the dramatic surge in development velocity, with some organizations seeing pull request volumes…
more -
Episode 310 - w/ Mohan Kumar and Naveen K Mahavisnu - AI Agent Security
In this episode of Absolute AppSec, hosts Ken Johnson and Seth Law interview Mohan Kumar and Naveen K Mahavisnu, the practitioner-founders of Aira Security, to explore the critical challenges of securing autonomous AI agents in 2026. The conversation centers on the industry's shift toward…
more -
Episode 309 - w/ Nathan Hunstad - Compliance, Security Governance
In this episode of Absolute AppSec, Nathan Hunstad, Director of Security at Vanta, discusses the intersection of security policy, governance, and technical defense. Drawing on his unique background in political science and the Minnesota state legislature, Hunstad argues that policy acts as the...
-
Episode 308 - w/Avi Douglen - Privacy, AppSec Conferences, OWASP
Ken Johnson (cktricky on social media) and Seth Law are happy to announce a special episode of Absolute AppSec with Avi Douglen (sec_tigger on X), long-time OWASP Global Board of Directors member, founder and CEO of Bounce Security and co-author of the Threat Modeling Manifesto. The conversation...
-
Episode 307 - 2025 Retrospective, Supply Chain, MCP and APIs
In episode 307 of Absolute AppSec, hosts Ken and Seth conduct a retrospective on the application security landscape of 2025. They conclude that their previous predictions were largely accurate, particularly regarding the rise of prompt injection, AI-backed attacks, and the industry-wide shift...
-
Episode 306 - w/ Paul McCarty - Open Source Malware
Given the spate of recent npm news stories, we've arranged a topical show with software supply-chain security researcher and npm hacker Paul McCarty (find Paul on bsky https://bsky.app/profile/6mile.githax.com) . Paul is currently a researcher with Safety (https://getsafety.com/) and has a...
-
Episode 305 - Career Impact of GenAI, SEO/GEO, More Supply Chain Attacks
The latest episode of Absolute AppSec is here, with Ken Johnson and Seth Law checking in during the busy Q4 holiday season to share some fascinating insights on the evolving landscape of security and technology. They kick off by reflecting on their intensive, ever-changing "Harnessing LLMs for...
-
Episode 304 - More OWASP Top 10, AI Dynamic Testing
This episode, the 304th of Absolute AppSec, features hosts Ken Johnson (@cktricky) and Seth Law (@sethlaw) discussing the crush of Q4 expectations, upcoming training opportunities, the recent updates to the OWASP Top Ten, and the impact of AI tools like XBow on application security (AppSec)...
-
Episode 303 - w/Prof. Brian Glas - OWASP Top 10 2025
Prof. Brian Glas (infosecdad on social media) joins Seth Law (sethlaw) and Ken Johnson (cktricky) for a timely episode of Absolute AppSec. Infosec Guru and one of the OWASP Top Ten project leaders Prof. Glas joins us in the aftermath of the Global AppSec conference and the announcement of the new...
-
Episode 302 - OWASP Global AppSec DC predictions, AI Browser Dangers, MCP Security
Episode 302 of Absolute AppSec has hosts Ken Johnson and Seth Law speculating on the upcoming Global AppSec DC conference, predicting the announcement of the OWASP Top Ten 2025 edition, with Brian Glass scheduled to discuss it on the podcast. The conversation shifts to a technical discussion of...
-
Episode 301 - AI Browsers, New AI Agent Attacks, Framework Checklists
In this episode, Seth and Ken debate OpenAI's Atlas browser, which embeds AI into web browsing. Ken views it as a major privacy concern, potentially accelerating invasive data collection and surveillance. Seth noted that new browsers historically have critical flaws. They acknowledged that AI is...
-
Episode 300 - THIS! IS! APPSEC!
For the 300th (!!!!) episode of the podcast, Seth and Ken reminisce on changes to the industry and overall approach to application security since inception. The hosts discussed the evolution of the industry, noting that once-popular approaches like blindly emulating "hip" Silicon Valley security...
-
Episode 299 - Startup Grind, Will Security Companies Disappear
The duo is back after a short hiatus. Today's episode is inspired by recent articles related to startups, funding, and the grind that happens when building a company or being an individual contributor. Specifically, a recent article about AI startup founders putting in long hours to the exclusion...
-
Episode 298 - Shai Hulud, Layered Security, New Commandments of Security Teams
In what is (sadly) becoming a weekly segment, this episode starts with talk of the latest installment of npm package takeovers, dubbed Shai Hulud as discussed in Slack and analyzed by Paul McCarty and team. Strategies discussed for monitoring packages and preventing malware from entering into...
-
Episode 297 - True/False Positives, Phishing Package Maintainers
The Absolute AppSec duo returns with an in-depth episode talking about true and false positives, where context matters and business impact must be taken into account in order to avoid rabbit holes. This discussion spurred by a recent article from signalblur of magonia.io discussing alerts in a...
-
Episode 296 - OWASP Top 10, NX Compromise, Security News Sources
Ken and Seth kickoff a podcast by reviewing current state of the OWASP Top 10 project, given recent requests and interactions on Absolute AppSec slack from various contributors. This is followed by an in-depth breakdown of the recent NX npm package compromise. This breakdown shows that even…
more -
Episode 295 - DEF CON 33 Recap, Crocs and Socks (and Bots)
Seth and Ken return with a new episode summarizing their experience at DEF CON 33 and all things Las Vegas over the past month. This includes panels, talks, workshops, happy hours, and even corporate (boo) events. This is followed by discussion of a few research items that came out of the...
-
Episode 294 - w/ Anshuman Bhartiya - AppSec in the Age of AI
Just in time for AppSec sweeps week, Anshuman Bhartiya is joining Seth Law (sethlaw on social media) and Ken Johnson (cktricky) on the Absolute AppSec podcast! With over a decade in the security industry, Anshuman Bhartiya brings a wealth of knowledge to the table, in web application penetration...
-
Episode 293 - AppSec's Reality Gap
Spurred by a recent article from Venture in Security, this episode delves deep into the practical application of security into an organization's SDLC. Covering a range of issues from gaps in contextual understanding to disingenuous vendor claims, Seth and Ken share their experiences dealing with...
-
Episode 292 - Manual Source Code Review, AI Slop in Bug Bounties, AppSec Authorization
Seth and Ken are _back_ to talk through some recent experiences and news across the industry. To start the episode, Seth highlights the edge cases uncovered during manual code review that require context to understand and identify. Inspired by recent a recent post on AI Slop in the curl bug…
more -
Episode 291 - w/ Sean Varga - OWASP Top 10 of AppSec Sales
Sean Varga, current regional sales manager with noted ASPM company Cycode joins Ken (@cktricky) and Seth (@sethlaw) to discuss the dawning realization organizations are having that they need AppSec experience and tech help to accompany their swelling numbers of developers. Sean's introduces "the...
-
Episode 290 - Authentication Fatigue, Browser AI Agents
Ken returns after a week's hiatus to review the latest AppSec news with Seth. Specifically, the idea that authentication fatigue exists for both consumers and developers. The amount of choice to implement security controls can have unintended consequences and introduces risk that may or may not…
more -
Episode 289 - Return of @lojikil - Context Matters
With @cktricky out on a grand tour across the country (or just unable to record for the day), @sethlaw succumbs to the dark side to give @lojikil a platform to talk about recent developments in the application security world. Specifically, a discussion on vulnerability data and scoring…
more
We're indexing this podcast's transcripts for the first time — this can take a minute or two. We'll show results as soon as they're ready.
No matches for "" in this podcast's transcripts.
No topics indexed yet for this podcast.
Loading reviews...
ABOUT THIS SHOW
A weekly podcast of all things application security related. Hosted by Ken Johnson and Seth Law.
HOSTED BY
Ken Johnson and Seth Law
CATEGORIES
Loading similar podcasts...
Frequently Asked Questions
How many episodes does Absolute AppSec have?
Absolute AppSec currently has 336 episodes available on PodParley. New episodes are automatically indexed when they're published to the podcast feed.
What is Absolute AppSec about?
A weekly podcast of all things application security related. Hosted by Ken Johnson and Seth Law.
How often does Absolute AppSec release new episodes?
Absolute AppSec publishes regularly with 336 episodes available. Check the episode list for the typical release schedule.
Where can I listen to Absolute AppSec?
You can listen to Absolute AppSec on PodParley by clicking any episode. We provide an embedded audio player for direct listening, and you can also subscribe via your preferred podcast app using the RSS feed.
Who hosts Absolute AppSec?
Absolute AppSec is created and hosted by Ken Johnson and Seth Law.
URL copied to clipboard!