Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup. She then discovered her passion for security, pivoted into pentesting for NCC Group, and now works as a Senior Product Security Engineer for Slack. Robyn joins us to discuss the role of penetration testing within the application security realm. Robyn provides actionable guidance that you can apply directly to your application pen testing program. We hope you enjoy this conversation with Robyn London. The conversation connects NCC Group, Slack, OWASP Juice Shop to practical choices that application security teams can make in their own programs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Robyn Lundin:
→ NCC Group
→ Slack

Mentioned in this episode:
→ NCC Group
→ Slack
→ OWASP Juice Shop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Robyn Lundin: Planning & organizing a penetration test as an AppSec team
03:37 Very, very cool. And that's, you know, one of the things
05:59 Very cool. And mentorship is such an important thing for us
07:17 Great advice. So Robyn, as we get started today in talking
08:55 To kind of dive into the deep end of our penetration
13:27 Yeah. So you mentioned low-hanging fruit, and I guess that's always
17:37 I've been away from pen testing for a long, long, long
20:16 Frequency. So let's say we have 1,000 apps. Do we test
22:07 Yeah, and just to let the record show, I think we
24:57 Would that also apply to, so if we had internal resources
26:48 Very good. So if you would, Robyn, just sort of wrapping

Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps. In the past, he headed security product efforts at Azure, focused on IoT, APIs and IaC. Michael's passionate about all things related to cloud, SaaS, and low-code security, and spends his time finding ways they could go wrong. He also leads the OWASP Low-Code Security Project and writes about it on Dark Reading. Michael's a regular conference speaker at OWASP BSides, DEF CON, Michael joins us to unpack low-code, no-code, and the new OWASP Top 10 that defines specific risks against low and no-code. We hope you enjoy this conversation with Michael Bargheri.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Michael Bargury:
→ Zenity
→ OWASP Low-Code/No-Code Top 10

Mentioned in this episode:
→ Zenity
→ OWASP Low-Code/No-Code Top 10
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Michael Bargury: Low Code / No Code Security and an OWASP Top Ten
01:33 Yeah. And you just got back from Global AppSec, right, in
04:13 Michael, so thanks again for joining us. As I mentioned, our
08:49 Yeah. So, just to And sure, I want to kind of
10:15 That's no-code then in that example, right
18:23 Wow. Yeah, it's a whole new avenue that nobody's really thought
20:16 With that in mind, you know, I was thinking about that
23:28 You have an example
26:46 You agree with that or is there something I'm missing
29:34 So, you've put together this new project, the OWASP Top 10
36:11 Michael, you have— I mean, I really love this list. It's
38:43 I look at these, you've got, you know, I'm looking at
42:56 Yeah. So, there's a lot more here to look at, and

Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department. The group's dedication is to providing global security services, including security architecture, DevSecOps tooling and integration services, delivery of technical training, and running Rakuten's Security Champion community. His focus is on empowering teams to improve security throughout the development lifecycle. Alex Olsen leads the Cybersecurity Consulting Group, part of Rakuten's Cybersecurity Defense Department. The group is dedicated to providing global security services, including security architecture, DevSecOps tooling and integration services, delivery of technical training, and the running of Rakuten's Security Champion Community. Alex joins us to talk about security champions, one of the topics that's near and dear to my heart.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Alex Olsen:
→ Rakuten: Democratizing AppSec
→ OWASP Global AppSec APAC

Mentioned in this episode:
→ Rakuten: Democratizing AppSec
→ OWASP Global AppSec APAC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Alex Olsen: Security champions, empowering developers, and AppSec training
03:54 There was a term that was used, democratizing AppSec. And it
07:00 Yeah. So, I guess what's the trade-off then when you— it
10:21 Like, they are the police because they can stop deployments, they
11:36 Yeah, so the kind of primary thing we want to talk
15:03 What's been your response or your experience with that
19:43 I'm listening to kind of— you're describing an onboarding process for
22:21 We think about, like, scope, cost, and effort, levels of effort
26:50 There's lots of excitement, right
35:21 Tactically or specifically about individual champions now. What have you seen
46:20 It was the return on investment. So, you know, what are
53:59 From a key takeaway perspective now, so let's kind of summarize

Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight. After running, he was elected and joined the OWASP Board of Directors. Hello, fine listeners from all over planet Earth. This is Chris Romeo, and I just wanted to let you know that you're in for a treat with this week's episode. This week we're joined by Mark Kerfe, and you may or may not have known, but Mark was involved in the creation of OWASP from the very early days. Now, Mark has been working in the background helping things happen over the few decades of OWASP, but he has recently run for and been elected to the OWASP Board of Directors.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Mark Curphey:
→ Jeff Williams on LinkedIn
→ OWASP

Mentioned in this episode:
→ OWASP
→ OWASP Top Ten
→ WebGoat
→ OWASP Juice Shop
→ ZAP
→ OpenSSF
→ Alpha-Omega
→ Sigstore
→ CycloneDX
→ OWASP ModSecurity Core Rule Set
→ Royal Holloway Information Security
→ Ward Cunningham
→ Linux Foundation
→ Mark Curphey
→ OWASP Top Ten
→ OpenSSL
→ Jeff Williams on LinkedIn
→ Christian Folini

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Curphey: The future of OWASP
03:58 You're getting to university, you're in this kind of information security-focused
12:26 Would you say then was the first project
15:33 It definitely is fun to watch kind of where it's gotten
22:02 I think about, you know, kind of taking a different strategy
25:35 Yeah. No, that definitely makes sense. So, you know, when I
31:24 Cool. Let's transition and talk a little bit about the larger
35:06 There's a lot more moving pieces to it. So, When we
38:59 Yeah, that is a great goal for all of us to

Tiago Mendo is a co-founder and CTO of Probely. He has extensive experience in pentesting applications, training, and providing all-around security consultancy. Tiago Mendo is a co-founder and CTO of Probly. He has extensive experience in pen testing applications, training, and providing all-around security consultancy. He started working with security in the early 2000s with a tenure of 12 years at Portugal Telecom, where he built the web security team and worked with 150+ developers. He holds a master's in information technology, information security from Carnegie Mellon University, and a CISSP certification. He's also a qualified member of AP2SI, a nonprofit organization that promotes information security in Portugal, and co-leader of the Lisbon OWASP chapter.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Tiago Mendo:
→ OWASP ZAP
→ Probely

Mentioned in this episode:
→ OWASP ZAP
→ Probely
→ sqlmap
→ Jenkins
→ PCI DSS
→ Cobalt.io
→ LASCON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tiago Mendo: How to scan at scale with OWASP ZAP
02:23 One thing we like to do in our podcast is start
07:14 Very cool. And so from understanding and hearing about the talk
10:23 About in a DevOps context
12:56 Then, what are some of the challenges, Diego, from trying to
22:32 That's either hitting test environments or even production environments as well
28:55 As we think about, you know, for our listeners, what they

J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals. Wolfgang has led advisory and assessment practices for cybersecurity consulting firms. Wolf challenged my thinking in this episode and pointed out a new area of threat modeling that I had never considered. The conversation connects Cisco Secure, Converge Detroit, LINDDUN to practical choices that application security teams can make in their own programs. The hosts press for concrete lessons, tradeoffs, and actions practitioners can carry into their next security decision. It closes with practical guidance for application security leaders.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Wolfgang Goerlich:
→ Cisco Secure
→ Converge Detroit

Mentioned in this episode:
→ Cisco Secure
→ Converge Detroit
→ LINDDUN
→ MITRE ATT&CK Framework

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Wolfgang Goerlich: Security beyond vulnerabilities
05:56 Very, very cool. It's funny, I have a very similar origin
09:10 I didn't even know, but they taught me the importance of
12:16 Yeah. Very cool. One of the things I learned from— it
14:47 This idea of security beyond vulnerabilities, because I'm really curious to
20:35 Criminal organizations able to use the transfer of funds liberally to
23:10 Yeah. And so, When I think about threat modeling from a
28:05 Why
32:12 That's really— that's great. That's great advice for just people building
37:58 From a key takeaway perspective or a call to action, We

Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of IT experience and a background in software engineering and web application development. Sam has worked for various financial services institutions in the City of London, specializing in Application Security consulting, Secure Software Development Lifecycle (SDLC), developer training, source code reviews and vulnerability management. He is also a Subject Matter Expert in Web Application Firewalls (WAF) and SIEM systems. Sam holds a Master’s degree in Software Engineering and a CISSP certification. Sam Stepanyan is an OWASP chapter leader and an independent application security consultant with over 20 years of experience in the IT industry with a background in software and web app development.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast, and this is Robert Hurlbut.
→ Learn more about Security Journey

Connect with Sam Stepanyan:
→ OWASP Nettacker
→ OWASP ZAP

Mentioned in this episode:
→ OWASP Nettacker
→ OWASP ZAP
→ Metasploit
→ Kali Linux
→ Jeremiah Grossman
→ OWASP Top Ten
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sam Stepanyan: OWASP Nettacker Project
01:48 Like we typically do, we'd like to start off with your
05:34 Yeah, that was a great event to be a part of
13:36 The security team, that is one of the foundational tools that
16:44 About performance. So when I hear you describe it's written in
20:38 In terms of, you mentioned vulnerabilities and having a library of
26:01 They don't have a lot of commercial tools and things that
39:58 Yeah. So, what's a key takeaway then or a call to

GraphQL gives clients remarkable flexibility, but that same flexibility can expose authorization gaps, denial-of-service paths, and unexpected routes to sensitive data. Black Hat GraphQL authors Nick Aleks and Dolev Farhi join Chris and Robert to explain how GraphQL differs from SQL and REST, why its schema and query model change the attacker’s workflow, and which familiar web risks still apply. They explore introspection, field-level authorization, query depth and complexity, batching, injection, and direct attacks against GraphQL endpoints. The discussion moves from reconnaissance and exploitation to practical mitigations, including strong server-side controls, input validation, output encoding, and deliberate limits on what clients may request. Nick and Dolev also introduce the vulnerable applications and tooling behind their book and offer a path for practitioners to build hands-on GraphQL security skills.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Dolev Farhi and Nick Aleks:
→ Dolev Farhi on LinkedIn
→ Nick Aleks on LinkedIn
→ Black Hat GraphQL
→ Damn Vulnerable GraphQL Application

Mentioned in this episode:
→ Black Hat GraphQL (book)
→ CrackQL
→ Damn Vulnerable GraphQL Application
→ Wealthsimple
→ OWASP API Security Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Nick Aleks and Dolev Farhi: GraphQL Security
04:44 Dolev’s security origin story
07:01 Introducing Black Hat GraphQL
07:51 What GraphQL is and where teams use it
10:57 GraphQL compared with SQL
13:19 The GraphQL threat landscape
18:16 How familiar OWASP risks appear in GraphQL
20:59 How attackers discover and reach GraphQL endpoints
29:24 Mitigating authorization and denial-of-service risks
34:14 Server-side controls, validation, and output encoding
36:56 Why Nick and Dolev wrote the book
40:00 Practical GraphQL security takeaways

With nearly 25 years of experience in the cyber-security industry, Guy held various positions in both corporates and startups. In his role as the CTO for the cyber crisis management firm Profero, his focus is making incident response fast and scalable, harnessing the latest technologies and a cloud-native approach. Guy is the BSidesTLV chairman and CTF lead, a Public speaker in well-known global security events (SAS, t2, 44CON, BSidesLV, and several DefCon villages, to name a few), and the recipient of the Cisco “black belt” security ninja honor – Cisco’s highest cybersecurity advocate rank. Guy joins us to explore his front-row seat for the incident response with Log4j.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Guy Barhart-Magen:
→ Profero
→ Log4j

Mentioned in this episode:
→ Profero
→ Log4j
→ Aleph One's "Smashing The Stack for Fun and Profit"
→ Heartbleed
→ OpenSSL

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Guy Barhart-Magen: Log4j and Incident Response
02:18 I promise I'll be back for year 60 at least. for
07:40 That's really cool. I miss those days. There was a, there
10:10 From the kind of going back into the security realm, what
28:31 I mean, that's historically— when you think about some of the
31:06 Yeah. So here's a question for you as you kind of
36:02 Yeah, I mean, that's a common challenge though, right
39:01 Yeah. That's, that is definitely a challenging scenario. And as an

Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience. Specialties: Automation, Continuous Integration/Delivery/Testing/Deployment Expertise: Linux, packaging, and tool design. Brett joins us to discuss why he hates security and shares his vast knowledge of building a secure and cutting-edge build pipeline. We hope you enjoy this conversation with... Brett Smith is a software architect, engineer, developer with 20+ years of experience. His specialties include automation, continuous integration, delivery, testing, deployment, plus he has expertise in Linux packaging and tool design. Now, don't hang up right now. There's a lot more to his thoughts on security. He also has vast knowledge building a secure and cutting-edge build pipeline, and so he's going to walk you through the different phases and things that you need to be thinking about when building a secure build pipeline.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Brett Smith:
→ SLSA
→ in-toto

Mentioned in this episode:
→ SLSA
→ in-toto
→ Rekor (Sigstore)
→ OpenVEX spec
→ OWASP Threat Dragon
→ eBPF
→ GitHub Dependabot
→ VEX
→ Jenkins
→ Snyk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brett Smith: Security is a Necessary Evil
01:19 I'm going to get to asking Brett his origin story in
08:30 So you wouldn't, you wouldn't give yourself the moniker or title
12:18 I mean, there is a weakest link, right
17:05 That's a good startup idea right there. Just follow somebody around
21:11 I mean, that's kind of like a bare minimum level of
23:14 Do you get to that exploitability and being able to measure
26:03 With eBPF, this is gonna be more from like, Linux-based applications
33:30 I've heard other people with that same idea. Back on the
38:10 Yeah, I mean, I think you've given us some different concepts
40:53 From a key takeaway perspective or a call to action, we've