The first OWASP Top 10 for Large Language Model Applications gave developers and security teams a shared threat model for a rapidly changing technology. Project leaders Steve Wilson and Gavin Klondike walk through the inaugural list and explain why familiar controls need to be reconsidered around probabilistic systems. They cover prompt injection, insecure output handling, training-data poisoning, denial of service, supply-chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft. Along the way, they distinguish application risks from attacks on the underlying model and show how plugins and autonomous actions can enlarge the blast radius. The episode closes with what the project learned from community feedback and how the list would evolve as real-world LLM deployments exposed new failure modes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Wilson and Gavin Klondike:
→ Steve Wilson on LinkedIn
→ Gavin Klondike on LinkedIn
→ OWASP GenAI Security Project

Mentioned in this episode:
→ OWASP Top Ten for LLM Applications project homepage
→ OWASP Top 10 For LLMs 2023 Slides V1 1
→ ChatGPT
→ LangChain
→ Tay (Microsoft chatbot)
→ DEF CON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing the OWASP Top 10 for LLM Applications
01:37 A threat model for large language models
05:39 Risk 1 — Prompt injection
09:00 Risk 2 — Insecure output handling
11:35 Risk 3 — Training-data poisoning
15:14 Risk 4 — Model denial of service
19:11 Risk 5 — Supply-chain vulnerabilities
28:16 Risk 6 — Sensitive information disclosure
33:28 Risk 7 — Insecure plugin design
38:27 Risk 8 — Excessive agency
42:39 Risk 9 — Overreliance
46:31 Risk 10 — Model theft
49:56 Lessons for the next release

Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world. With a rich background spanning over 25 years in IT, coding, and championing cybersecurity, Tanya delves into the essence of secure coding. We're honored to host the remarkable Tanya Janca, widely recognized as SheHacksPurple. Tanya is a brilliant mind behind the best selling book, Alice and Bob Learn Application Security, and the founder of WeHackPurple, a comprehensive platform dedicated to teaching the art of creating secure software. With a rich journey spanning over 25 years in IT, coding, and championing cyber security, Tanya has donned many hats, from serving in public sectors to leading at tech giants, and from founding trailblazing companies to spearheading community initiatives.

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ Alice and Bob Learn Application Security

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ WeHackPurple
→ This is How They Tell Me the World Ends
→ Tanya Janca (SheHacksPurple)
→ Alice and Bob Learn Application Security
→ Semgrep
→ r2c / Semgrep Inc.
→ Rust
→ Ruby
→ Ruby on Rails
→ Node.js
→ Adam Shostack
→ OWASP DevSlop Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tanya Janca: What Secure Coding Really Means
03:04 So I think, uh, we wanted to kind of start diving
05:23 Yeah, you can't get away with that, right
17:35 That's why they're not our ex staff. I like that one
22:34 This is a bit of a softball question But coding and
27:50 Yeah. And I, my experience, I've seen what I like to
37:29 Yeah, it's so cool. And I was checking in our archive
38:58 Intro into the lightning round. All right. Uh, Tanya, we have
43:15 Next question. Uh, what would it say if you could display

Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively. He underscores the idea that security is not an isolated endeavor but a collective effort, urging everyone to come together and build a world where safety and security are paramount. We're honored to have Hasan Yasar, the technical director of the Continuous Deployment of Capability Group at the renowned Software Engineering Institute at Carnegie Mellon University. With over 25 years of experience in secure software development, Hasan is at the forefront of leveraging emerging tech like DevSecOps, AI, ML, and more to drive transformation in software development.

Connect with Hasan Yasar:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Cybersecurity First Principles: A Reboot of Strategy and Tactics

Mentioned in this episode:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Cybersecurity First Principles: A Reboot of Strategy and Tactics
→ Carnegie Mellon University Software Engineering Institute
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Software Transparency
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ SPDX
→ Log4j

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hasan Yasar: Actionable SBOM via DevSecOps
02:17 Yeah, we're going to unpack SBOM, as our listeners know, one
05:30 Caught my attention when you mentioned F-16 simulators and Secure by
11:22 We're heading, we're heading towards a world where... There's, there's, you
17:12 Yeah. And I think, you know, I think there is a
21:07 No, it was great, great conversation. Uh, uh, just quick aside
23:47 I know we've heard in your history, you've talked about some
31:38 Uh, so Hasan, uh, you've talked about or mentioned the term
34:46 Does that work
37:34 Does that work from a speed perspective
43:09 All right. So Hasan, we have, we have three questions. So
45:06 Excellent. And what's your top book recommendation

Varun Badhwar is a three-time founder, a luminary in the cyber security industry, and a clear communicator. He joins Chris and Robert on the Application Security Podcast to discuss scanning with context, SBOM plus VEX, and the developer productivity tax. The concept of a "Developer Productivity Tax" acknowledges the challenges developers face when bombarded with a plethora of vulnerabilities. This "tax" represents the drain on developers' time and resources as they navigate through a myriad of potential threats, many of which lack actionable context. The inefficiencies arising from this process can lead to significant delays in software development, emphasizing the need for more refined tools and techniques.

Connect with Varun Badhwar:
→ Endor Labs
→ The Hard Thing About Hard Things by Ben Horowitz

Mentioned in this episode:
→ Endor Labs
→ The Hard Thing About Hard Things by Ben Horowitz
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ OWASP Dependency-Track

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Varun Badhwar: The Developer Productivity Tax
02:11 You got to broadcast from wherever you are. So Robert is
05:47 Yeah, very cool. So, let's, let's dive into that. You know
08:39 CVSS. Because I know you've written a lot about CVSS, and
11:51 Whenever I, whenever I hear about reachability, I'm always curious to
15:00 Okay. So, here's another question for you. Uh, we've heard this
19:13 So the perfect state in the future will be a tool
21:06 I mean, I think it's gotta be a hundred percent to
28:52 Yeah, you might as well have a result. You might, you
31:48 There a consolidation coming in our market
35:22 All right. Next question. Uh, what would it say if you
36:40 Cool. Yeah, Tony Turner's a past guest. Chris Hughes is a

Six candidates for the 2023 OWASP Board of Directors debate the choices that shape the foundation and its community. Paulino Calderon, Steve Springett, Avi Douglen, Izar Tarandach, Sam Stepanyan, and Fred Donovan discuss the experience they would bring to the board, their priorities if elected, and how OWASP should support projects as open source changes. Chris and Robert press the candidates on declining membership, vendor neutrality, and the role of revenue from global events. The result is a direct comparison of competing ideas about governance, community growth, project health, and how the board can keep OWASP useful to practitioners around the world.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Foundation
→ OWASP Global Board

Mentioned in this episode:
→ OWASP CycloneDX
→ OWASP Dependency-Track
→ OWASP DefectDojo
→ ZAP
→ OWASP ASVS
→ OWASP Developer Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The 2023 OWASP board candidate debate
01:37 Candidate introductions and governing experience
09:36 The candidates’ priorities for OWASP
17:49 The future of OWASP open source projects
25:48 Reversing the decline in OWASP membership
34:29 Protecting vendor neutrality
41:54 Using proceeds from global events
46:41 Candidate responses and points of disagreement
58:20 Closing statements from the candidates

Itzik Alvas, Co-founder and CEO of Entro, is an expert on secrets security. Itzik joins Chris and Robert to discuss the significance of understanding and managing secrets, emphasizing the importance of knowing how many secrets an organization has, where they are located, and their potential impact. He elaborates on the three pillars of secrets management: listing and locating secrets, classifying and understanding their potential blast radius, and monitoring them for any abnormal behavior. Itzik Alvas started his cybersecurity journey 17 years ago, when he was selected to join the elite cybersecurity unit of the IDF, Israel Defense Forces. He was introduced to the cybersecurity ecosystem there and gained enormous knowledge and experience on a nation state level.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Itzik Alvas started his cybersecurity journey 17 years ago, when he was selected to join the elite cybersecurity unit of the IDF, Israel Defense Forces.
→ Learn more about Security Journey

Connect with Itzik Alvas:
→ Entro
→ Foundation by Isaac Asimov

Mentioned in this episode:
→ Entro
→ Foundation by Isaac Asimov
→ Ringworld by Larry Niven
→ Seveneves by Neal Stephenson
→ Azure Key Vault
→ Aquia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Itzik Alvas: Secrets Security and Management
02:03 We are, we are the original application security podcast. Like we
04:28 I understand. I've never been a CISO, so I can't say
07:06 I can imagine. So just to dive into our topic today
09:35 That's a big, that's a big number. I'm still stuck on
13:07 I guess another, another part of the program is how you
16:02 Yeah. Yeah. So I feel like we've, we've kind of explored
19:16 Definitely make sure I keep aware, but I'm sure there is
21:33 That's true. That's true. I mean, the Lambdas of the world
24:32 You're, you're advocating for almost like a secrets workflow management approach
28:03 You talked about, um, deleting, so, you know, I think about
32:47 We'll do. All right. So, um, what's your most controversial opinion
35:02 Very cool. And then finally, what's your top book recommendation

Harshil Parikh is a seasoned security leader with experience building security and compliance functions from the ground up. He notably built the security and compliance team at Medallia from scratch and led it through several transitions. He is also a conference speaker, and, most recently, he co-founded Tromzo. Harshil shares insights about AppSec, running a startup, selling effectively, and provides justification for his mantra, "Context is king. Scaled the team globally, achieved compliance, SOC 2 ISO FedRAMP, went through an IPO, And secured seven mergers and acquisitions. Additionally, he's been a speaker at RSA Conference, AppSec USA, and CSX Europe. Harshil joins us to discuss developer first security, developer autonomy and guardrails, and challenges scaling AppSec programs.

Connect with Harshil Parikh:
→ The Metrics Manifesto by Richard Seiersen
→ Tromzo

Mentioned in this episode:
→ The Metrics Manifesto by Richard Seiersen
→ Tromzo

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Harshil Parikh: Deep Environmental and Organizational Context in Application Security
01:56 Yeah, that's good. That's, that's, uh, it's a good challenge or
04:47 Let's dive in a little bit to some of the work
06:57 What's your approach to get in front of the right people
10:35 It's a long, it's definitely a long term thing and that's
14:46 Mean, you don't really have to worry about having a good
20:42 Particular pushback did you get on that
23:30 Yeah, I was wondering about that in terms of guardrails. I
26:41 Does governance play in to that scaling problem that you just
33:49 There we go. All right, Harjul. Uh, so, first question is
35:06 Yeah. So, um, the next one we have is, uh, what

Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of Interactive Application Security Testing (IAST) in the modern DevOps landscape. After reflecting on the history of OWASP, the conversation turns to the challenges organizations face in managing their application security (AppSec) backlogs. Jeff highlights the alarming number of unresolved issues that often pile up, emphasizing the inefficiencies of traditional security tools. Jeff Williams is a veteran application security expert who founded and led OWASP, Aspect Security, and Contrast Security. Jeff also created several highly successful open source projects, including jbom, jot, OWASP Top Ten, WebGoat, ESAPI, ASVS, and more.

Connect with Jeff Williams:
→ Jeff Williams on LinkedIn
→ Java Observability Toolkit (JOT)

Mentioned in this episode:
→ Jeff Williams on LinkedIn
→ Java Observability Toolkit (JOT)
→ Venture in Security: solving the circle sticker problem
→ Contrast Security
→ B09NRF399J
→ Brakeman

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeff Williams: The Tech of Runtime Security
03:51 What's the root of that problem
05:42 You're someone who's been around AppSec since the beginning of AppSec
07:27 Let's, uh, let's take a look at that. Um, what is
09:12 In your, in your AppSec program that you're building here, are
11:46 Okay. What about performance though
16:55 Hmm. So are you using the same detection and rule technology
22:15 About reachability
25:16 You think about these types of technologies, I'm curious from your
29:47 Yeah. And that's one of the things, um, one, one of
33:00 Hmm. It's funny that, that, that were the, those were the
34:56 Good. Um, next is, uh, what would it say if you
37:13 Yeah. Very cool. So Jeff, we always like to end with

Development, operations, and security teams generate oceans of data yet still struggle to answer basic questions about what code is running, who owns it, and which findings matter. OWASP founder Mark Curphey and security veteran John Viega introduce Chalk, an open-source telemetry and observability tool designed to connect repositories, builds, deployments, and production systems. They explain how better provenance can eliminate irrelevant alerts, prioritize deployed software, trace incidents back to owners and commits, and confirm that fixes actually reached production. The conversation covers small-company and enterprise use cases, lessons from Log4Shell, performance overhead, supported platforms, and Chalk’s event model. Mark and John also discuss open-source sustainability and the Software Security Project before closing with candid views on where application security gets priorities wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Curphey and John Viega:
→ Mark Curphey on LinkedIn
→ John Viega on LinkedIn
→ Chalk
→ Crash Override

Mentioned in this episode:
→ Crash Override
→ Chalk
→ The Software Security Project
→ Atomic Habits
→ Start With Why
→ OWASP ZAP
→ Sigstore

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Curphey and John Viega: Chalk
01:46 John’s path into application security
04:20 The de facto silos separating development and production
07:52 Chalk as telemetry for software engineering
12:12 Why startups also need production visibility
15:18 Log4Shell and the challenge of finding deployed software
17:08 How security teams can use Chalk
23:10 Chalk’s performance impact in production
25:00 Supported platforms and frameworks
28:00 Events, protocols, and outbound telemetry
42:18 Holding commercial users of open source accountable
46:32 Controversial opinions about AppSec
48:09 Industry messages, books, and closing thoughts

Maril Vernon is passionate about Purple teaming and joins Robert and Chris to discuss the intricacies of purple teaming in cybersecurity. She underscores the significance of fostering a collaborative environment between developers and the security team. Drawing from her experiences, Maril shares the challenge of development overlooking her remediation recommendations. She engaged directly with the developers, understanding their perspective and learning to frame her remediations in developer-centric language. This approach made her recommendations actionable and bridged the communication gap between the two teams. Meryl Vernon is a senior application security architect and Purple Team program manager. Meryl is also co-host and co-founder of the Cyber Queens podcast, an all-female-led podcast aimed at increasing female and LGBTQ diversity in cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Meryl Vernon is a senior application security architect and Purple Team program manager.
→ Learn more about Security Journey

Connect with Maril Vernon:
→ Purple Team Exercise Framework
→ Scythe

Mentioned in this episode:
→ Purple Team Exercise Framework
→ Scythe
→ MITRE ATT&CK Framework
→ AttackIQ
→ SafeBreach
→ PlexTrac
→ Atomic Red Team
→ mitre-attack/attack-navigator
→ 9781260464009
→ The Pentester BluePrint: Starting A Career As An Ethical Hacker P 9781119684305
→ Watkins
→ The Pentester Blueprint: Starting a Career as an Ethical Hacker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Maril Vernon: You Get What You Inspect, Not What You Expect
02:31 Yeah, I'm very, very glad to have you here. And as
04:08 Yeah, definitely. Congratulations. What sparked your interest and what led you
06:30 I think my understanding of purple teaming, I may not have
10:44 Writing your remediations in dev. I must understand... I know we're
13:13 You in the code as you're preparing your remediation
14:45 Yeah. Let's talk about collaborative methods of AppSec. So, that's sort
19:19 Can you take us through a story of purple teaming
23:36 Long is this process going
25:36 Continuing on about purple teaming, what are some— you talked a
27:30 From a vendor perspective, so you mentioned a couple of different
30:03 Do the tools, the purple team commercial tools, stack up against
31:32 Do you see purple teaming going in the future
34:32 All right. Well, Meryl, we really appreciate you joining us today
37:14 Excellent. And what's your top recommendation for those interested in security