AppSec

Prompt engineering is no longer just a developer experiment, it is becoming a critical enterprise skill. In this episode of AppSec. FM, Jerry Hoff talks with Jim Manico about the emerging practice of secure prompt engineering, how it affects AI-generated code, and what organizations can do to prepare. They cover the risks of third-party libraries, the evolving AISVS project, and how AI has the pot...

The Zed Attack Proxy (ZAP) has grown from a personal project into one of the most widely used open-source security testing tools in the world. In this episode of AppSec. FM, Jerry Hoff talks with Simon Bennetts, founder and lead of ZAP, about its evolution, role in CI/CD automation, and the importance of community contributions. The conversation also explores the integration of AI, the unique posi...

Threat modeling is shifting from a manual process to one supercharged by AI. In this episode of AppSec. FM, Jerry Hoff talks with Fraser Scott, Chief Scientist at IriusRisk, about how AI and LLMs are transforming the way organizations identify risks in software development. The conversation explores the current state of threat modeling, supply chain challenges, and the economic value of embedding...

AI is transforming the way organizations build and secure software. In this episode of AppSec. FM, Jerry Hoff talks with Chris Hertz, co-founder and CEO of Healer, about how AI is reshaping both development practices and attacker strategies. The discussion explores the economics of vulnerability remediation, the challenges of securing open source dependencies, and how collaboration between develop...

Application security is at a turning point, with AI transforming development and new security challenges emerging every day. In this episode of AppSec. FM, Jerry Hoff talks with Michael Coates about the importance of investing in innovative security solutions and the companies that will define the next generation of AppSec. They discuss the role of shadow developers, the accelerating pace of devel...

Application security has never been more critical, but are we focusing on the wrong things? In this episode of AppSec. FM, Jerry Hoff sits down with Robert RSnake Hansen to explore the true relevance of AppSec in the age of CVEs, compliance, and adversaries who are evolving faster than ever. Highlights: Why most security risk comes from a small subset of CVEs. The gap between compliance frameworks...

AI is reshaping the way we build and secure software. In this episode of AppSec. FM, Jerry Hoff talks with Arshan Dabirsiaghi about the practical realities of AI-generated code, the challenges it introduces, and the opportunities it creates for modern AppSec. Highlights: How AI-generated code improves developer productivity. Why prompt engineering matters for secure AI use. Risks of hallucinated p...

Threat modeling has been a cornerstone of application security for decades — but is it still relevant in the era of AI-assisted development? In this episode of AppSec. FM, Jerry Hoff talks with Amir Kavousian about how threat modeling must evolve to keep pace with modern software practices. Highlights: Why threat modeling is still essential for AppSec. How AI-assisted development changes risk cons...