Show Notes
AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it? Semgrep co-founder and CEO Isaac Evans explains why deep background analysis and real-time agent plugins may replace universal rule sets with organization-specific security controls. He and Chris explore how security engineering roles will change, why independent verification still matters, and where business-logic flaws may become th...
More from The Application Security Podcast
Are your developers still reading their security findings, or are their agents answering for them? Ahmad Sadeddin, founder and CEO of Corgea, brings data from Corgea's customers: replies to security comments written with em dashes jumped from 2.5 percent in May to about a third, and once long, verbose replies are counted, somewhere between 35 and 60 percent come from agents. Chris and Ahmad dig into developers using agents to wave off findings as false positives, why commits per PR keep climb...
What happens when a protocol goes from idea to everywhere before security can catch up? Vandana Verma Sehgal, leader of the OWASP MCP Top 10, returns to explain why most organizations cannot say how many MCP servers are running on their developers' machines. She walks Chris and Robert through how MCP turns a chatbot into a new execution layer, how four lines of malicious code in a tiny server can slip past everyone, and why shadow MCP servers are shadow IT with direct access to action. The th...
What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E. Schoenfield, CTO of Rezliant and author of Securing Systems, returns to warn about "the illusion of omniscient perfection," the cheerful confidence that makes AI output feel finished, and the "learned fragility" that sets in when nobody understands the code anymore. He, Chris, and Robert debate whether an AI threat model that gets 90% of the way there is a win, h...
Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company. The founder of Manicode Security returns to explain why AI didn't kill AppSec education but supercharged it, why vague prompting on frontier models turns companies into "token furnaces," and why prompt injection is the one genuinely new vulnerability class of the AI era. He walks Chris and Robert through his full AI coding workflow, from reverse engineering an architecture file to securit...
Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. Jeevan, Director of Security Engineering at Rippling, returns to unpack how his team polices thousands of engineers shipping 10x more code: a "vulnerability jail" that locks non-compliant teams out of the main branch, AI-reviewed extension requests, and homegrown agents that hunt for entire classes of vulnerabilities instead of one bug at a time. He and Chris debate w...