Rephonic
Artwork for The Application Security Podcast

The Application Security Podcast

Chris Romeo and Robert Hurlbut
Application Security
Threat Modeling
Cybersecurity
OWASP
Artificial Intelligence
Vulnerability Management
Education
Devsecops
Secure Guardrails
Software Development
API Security
OWASP Top 10
AI Security
Penetration Testing
EU Cyber Resilience Act
Security Champions
Responsible AI
Security
Product Security
Devops

The Application Security Podcast is a practitioner-led show for anyone building or securing modern software—and now AI-powered applications. Hosts Chris Romeo and Robert Hurlbut talk with the people shaping application security about AI and LLM security, threat modeling, secure development, OWASP, cloud, DevSecOps, security champions, and building programs that help engineering teams move faster a... more

PublishesWeeklyEpisodes313Founded10 years ago
Number of ListenersCategories
TechnologyNewsTech News

Listen to this Podcast

Artwork for The Application Security Podcast

Latest Episodes

What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E. Schoenfield, CTO of Rezliant and author of Securing Systems, returns to warn about "the illusion of omniscient perfect... more

Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company. The founder of Manicode Security returns to explain why AI didn't kill AppSec education but supercharged it, why vague prompting on frontier mod... more

Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. Jeevan, Director of Security Engineering at Rippling, returns to unpack how his team polices thousands of engineers shippin... more

Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents. Petra traded emergency medicine for application security and... more

Key Facts

Accepts Guests
Accepts Sponsors
Contact Information
Podcast Host
Number of Listeners
Find out how many people listen to this podcast per episode and each month.

Similar Podcasts

People also subscribe to these shows.

Recent Guests

Brook Schoenfield
Bestselling author, opinionated thinker, security practitioner
Episode: Your Opinion on AI Doesn't Matter. Learned Fragility Does
Jeevan Singh
Director of Security Engineering at Rippling
Rippling
Episode: Vulnerability Jail and the AI-Era AppSec Engineer
Petra Vukmirovic
Technology leader and threat modeling expert
Numan
Episode: How Agentic AI Fails—and Which Controls Actually Stop It
James Berthoty
Founder and Lead Analyst at Latio Tech
Latio Tech
Episode: AI Pen Testing Killed Traditional DAST
Rob van der Veer
Global leader in AI security; founder of OWASP AI Exchange; helped shape international AI standards
Software Improvement Group; OWASP AI Exchange
Episode: AI Security: OWASP Meets Global Standards
José Carlos Chávez
Security software engineer at Okta; OWASP Coraza co-leader; security-focused software engineer
Okta
Episode: José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Michael Burch
VP of AI Enablement and Acceleration at Security Journey
Security Journey
Episode: Michael Burch - AI-Enabled Citizen Developers
Josh Grossman
CTO of Bounce Security
Bounce Security
Episode: Josh Grossman--AI & SAST: Is it a match?
Dwayne McDaniel
Principal developer advocate focused on secret security and non-human identity governance at GitGuardian
GitGuardian
Episode: Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets

Hosts

Chris Romeo
Host with deep involvement in application security and ventures related to security leadership and Kerr Ventures; frequently discusses AI, threat modeling, and governance.
Robert Hurlbut
Co-host, Threat Modeling Architect and security veteran; often focuses on threat modeling, architecture, and practical AppSec guidance.

Reviews

4.9 out of 5 stars from 73 ratings
  • Empowering, insightful and actionable! 🔥

    Whether you’re well established as an AppSec innovator, or just getting started as a catalyst for change - this is a must-listen podcast for you! Chris and Robert do an incredible job leading conversations that cover a huge breadth of topics related to the ins and outs of staying on the cutting edge of data security and privacy - with leaders who’ve actually experienced success themselves. Highly recommend listening and subscribing!

    Apple Podcasts
    5
    JoshCrist
    United States6 years ago
  • Best AppSec Podcast

    Interesting subjects and interviews. These guys know their stuff. Aren’t afraid to admit when they don’t know a lot about a topic. Just like me we are all here to learn from experts in the field of AppSec. They ask the most interesting and relevant questions of their guests.

    Keep up the great work!!

    Apple Podcasts
    5
    mjdecap
    United States7 years ago
  • awesome and very informative!

    Proud to give you a 5-star review! Well worth it!

    Apple Podcasts
    5
    holysheetman
    United States9 years ago
  • For developers and testers

    Best podcast for web application developers and testers. Vulnerabilities and controls in the same place.

    Apple Podcasts
    5
    Eepica
    United Kingdom9 years ago

Listeners Say

Key themes from listener reviews, highlighting what works and what could be improved about the show.

listeners find it empowering, insightful, and practical for real-world AppSec and AI security.
episodes are described as informative for developers and security professionals alike.
guests and hosts are praised for asking relevant questions and driving depth in security topics.

Chart Rankings

How this podcast ranks in the Apple Podcasts, Spotify and YouTube charts.

Apple Podcasts
#244
Netherlands/Technology

Talking Points

Recent interactions between the hosts and their guests.

José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Q: Why does Broken Access Control remain top despite tooling improvements?
He argues it reflects organizational structure and the ongoing overhead of maintaining up-to-date access policies across dynamic environments, including relational and temporal access concepts.
José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Q: What made the Louvre heist analogy click and map to OWASP Top 10?
José describes connecting the Louvre incident with lack of observability and monitoring failures, then expanding to multiple incidents, and ultimately mapping these to OWASP Top 10 themes to create a compelling narrative.
José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists
Q: But first, José, let's get into your security origin story. How did you get into the world of security and then ultimately, application security?
José explains shifting from observability to security, joining Traceable and later Okta, and applying software engineering practices to security work, with a focus on automation and building deterministic security postures.
How Agentic AI Fails—and Which Controls Actually Stop It
Q: How data-driven should the probabilities be in fault tree analysis?
Probabilities should become more data-driven the deeper you go in the tree, starting with educated assumptions at the top and moving toward concrete statistics from logs, industry reports, and real-world telemetry as you descend.
How Agentic AI Fails—and Which Controls Actually Stop It
Q: What failure modes should we be worried about in agentic systems?
Focus on the top three failure modes that can cause revenue loss or reputational damage, with emphasis on downstream actions driven by agent outputs and the risk of excessive agent autonomy. Use threat modeling to identify and then apply fault tree analysis to quantify and prioritize those paths.

Audience Metrics

Listeners, social reach, demographics and more for this podcast.

Listeners per Episode
Gender Skew
Location
Interests
Professions
Age Range
Household Income
Social Media Reach

Frequently Asked Questions About The Application Security Podcast

What is The Application Security Podcast about and what kind of topics does it cover?

The show targets security practitioners building and protecting modern software, with a strong emphasis on practical guidance for AppSec, DevSecOps, and AI-enabled security. Episodes frequently feature hands-on discussions with practitioners and industry leaders about threat modeling, secure development, AI and LLM security, observability, and governance, with a bias toward actionable frameworks, real-world incidents, and building security programs that help engineering teams move faster and safer. Notable strengths include a consistently pragmatic orientation, use of case studies, and a steady stream of guest experts who translate complex concepts into repeatable practices for engineers and security leaders alike.

Where can I find podcast stats for The Application Security Podcast?

Rephonic provides a wide range of podcast stats for The Application Security Podcast. We scanned the web and collated all of the information that we could find in our comprehensive podcast database. See how many people listen to The Application Security Podcast and access YouTube viewership numbers, download stats, audience demographics, chart rankings, ratings, reviews and more.

How many listeners does The Application Security Podcast get?

Rephonic provides a full set of podcast information for four million podcasts, including the number of listeners. View further listenership figures for The Application Security Podcast, including podcast download numbers and subscriber numbers, so you can make better decisions about which podcasts to sponsor or be a guest on. You will need to upgrade your account to access this premium data.

What are the audience demographics for The Application Security Podcast?

Rephonic provides comprehensive predictive audience data for The Application Security Podcast, including gender skew, age, country, political leaning, income, professions, education level, and interests. You can access these listener demographics by upgrading your account.

How many subscribers and views does The Application Security Podcast have?

To see how many followers or subscribers The Application Security Podcast has on Spotify and other platforms such as Castbox and Podcast Addict, simply upgrade your account. You'll also find viewership figures for their YouTube channel if they have one.

Which podcasts are similar to The Application Security Podcast?

These podcasts share a similar audience with The Application Security Podcast:

1. Application Security Weekly (Audio)
2. Defense in Depth
3. CISO Series Podcast
4. Cybersecurity Today
5. SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

How many episodes of The Application Security Podcast are there?

The Application Security Podcast launched 10 years ago and published 313 episodes to date. You can find more information about this podcast including rankings, audience demographics and engagement in our podcast database.

How do I contact The Application Security Podcast?

Our systems regularly scour the web to find email addresses and social media links for this podcast. We scanned the web and collated all of the contact information that we could find in our podcast database. But in the unlikely event that you can't find what you're looking for, our concierge service lets you request our research team to source better contacts for you.

Where can I see ratings and reviews for The Application Security Podcast?

Rephonic pulls ratings and reviews for The Application Security Podcast from multiple sources, including Spotify, Apple Podcasts, Castbox, and Podcast Addict.

View all the reviews in one place instead of visiting each platform individually and use this information to decide if a show is worth pitching or not.

How do I access podcast episode transcripts for The Application Security Podcast?

Rephonic provides full transcripts for episodes of The Application Security Podcast. Search within each transcript for your keywords, whether they be topics, brands or people, and figure out if it's worth pitching as a guest or sponsor. You can even set-up alerts to get notified when your keywords are mentioned.

What guests have appeared on The Application Security Podcast?

Recent guests on The Application Security Podcast include:

1. Brook Schoenfield
2. Jeevan Singh
3. Petra Vukmirovic
4. James Berthoty
5. Rob van der Veer
6. José Carlos Chávez
7. Michael Burch
8. Josh Grossman

To view more recent guests and their details, simply upgrade your Rephonic account. You'll also get access to a typical guest profile to help you decide if the show is worth pitching.

Find and pitch the right podcasts

We help savvy brands, marketers and PR professionals to find the right podcasts for any topic or niche. Get the data and contacts you need to pitch podcasts at scale and turn listeners into customers.
Try it free for 7 days