The AppSec Management Podcast

Traditional GRC tools were built for corporate IT, not for modern software development. As regulations like the EU Cyber Resilience Act raise the bar for product-level security, a new discipline is emerging: Product Risk and Compliance (PRC).

Risk assessments are the starting point of your application security program and as it turns out your Cyber Resilience Act compliance strategy. If you think about it, it makes absolute sense. If there is no risk, you don't really need security. Unfortunately, that's not the world we are living in and creating a crystal clear understanding of the risk profile for each of your products is essential....

Lara and I kick off our new series on the EU Cyber Resilience Act (CRA), where we'll go deep on what the regulation actually means for product security teams and how to translate it into concrete application security practice. In this first episode, we cover the foundations:What the CRA is and why it existsWhich products fall under its scope, and which don'tHow compliance requirements diff...

AI is changing everything - including how attackers think. But is the security industry keeping up? This webinar, hosted jointly with Toreon, tackles one of the biggest questions in AppSec right now: as AI agents, LLMs, and prompt-driven development become the norm, what does application security even look like?📌 Follow us on LinkedIn: https://www.linkedin.com/company/9420309/🌐 Or visit our webs...

In this chapter we have the research team of PXL University of Applied Sciences that did an in depth analysis of the state of AppSec processes at SMEs. They report on their outcomes and findings.

You can use SAMMY for free on sammy.codific.com

You can use sammy for free on sammy.codific.com

This episode looks at the latest developments around AI tools in Application Security. Guidance and best practices in the new context.

This is deep dive into DORA the EU Digital Operational Resilience Act. For more details refer to the Codific website: https://codific.com/summary-of-dora/

This episode covers the EN-40000 standards that serve as a provisional basis for CRA Horizontal Standards. This is the summary of resources collected on complycra.eu for the full story and presentation please refer to the website: https://complycra.eu/cra-standards/

This content is a summary of a deep dive by the Codific team. For the full coverage refer to the article on the Codific Website: https://codific.com/secure-controls-framework-a-comprehensive-overview/

This is a summary of interviews in the Codific website. For the full stories please refer to the Codific website: https://codific.com/codifics-customers-success-stories/

This is a summary of a deep dive by the Codific team. For the full article please refer to the Codific website: https://codific.com/nis-2-directive-compliance-guide-fines-scope/

This is a summary of a deep dive by Aram Hovsepyan. For the full article refer to the Codific website: https://codific.com/nist-ssdf-1-2-explained/

In this International Women’s Day interview, we speak with Kim Wuyts, a privacy engineer and privacy by design advocate with 15+ years across security and privacy. Kim helped develop LINDDUN, a privacy threat modeling framework, and regularly speaks at international security and privacy conferences. This conversation is for women who are considering cybersecurity or privacy, women already in tech...

This episode is based on analysis by Aram Hovsepyan. For the full story refer to his blog post here: https://codific.com/claude-code-security-will-ai-disrupt-application-security/

In this episode, Viktor Lukachyk, Security Manager at Sigma Software, joins Nicolas and Dag from Codific to break down the Cyber Resilience Act (CRA) and what it means for software and digital product companies operating in the EU.We discuss how CRA fits alongside regulations like NIS 2 and DORA, which products fall into scope, and why CRA is focused on secure by design principles rather than comp...

ISO 27001, NIST CSF, NIST SSDF, CIS Critical Security Controls Framework. All these things are called frameworks. But what are they really? Why do we need them? And are they only relevant for GRC teams in large organizations? If all your tools show green dashboards, isn’t that enough to claim your software product is secure? In this episode of AppSec Science I explain why frameworks are essential...

Many organizations treat Common Vulnerability Enumerations or CVEs as first class citizens. Some even enforce strict SLAs on CVE remediation times depending on their severity scores expressed with the CVSS metric. The numbers make sense as they are built on top of real and hard data. Moreover, attackers also have access to this data, so building your complete strategy around vulnerability dashboar...

" If you can’t measure it you can’t improve it. ". It is hard to argue with that. But here is the catch, what are we measuring and what are we improving.  Measuring the right things right is not a rocket science, but it is a science. Common sense might get you so far, but in my experience common sense is failing us. Organizations are focusing on metrics that are readily produced by tooli...

This episode is based on the the IBM cost of a Data Breach report, for full data refer to the report. https://www.ibm.com/reports/data-breach

This episode is based on content from the the Codific website. Voices and narrative are AI generated. For full factual acurracy refer to the Codific website. https://codific.com/application-security-insights-and-other-exciting-stories/

This content is based on an article written by Nicolas Montauban. Voices and narrative are AI generated, for full factual accuracy refer to the underlying article. https://codific.com/owasp-asvs-a-comprehensive-overview/

This podcast is based on the presentations and press releases of the OWASP and Codific team. For the latest insights check the Codific website.

This podcast is based on in depth analysis by Dr. Aram Hovsepyan. Voices and narrative are AI generated. For full factual accuracy refer to underlying article. https://codific.com/top-application-security-failures-in-fortune-500-companies/