# The Application Security Podcast > Chris Romeo and Robert Hurlbut dig into the tips, tricks, projects, and tactics that make application security programs succeed. 314 episodes published between 2016 and 2026, hosted by Chris Romeo and Robert Hurlbut. 314 carry a full speaker-attributed transcript on the page, and 230 guests have their own pages listing every appearance. This site is deliberately open to AI crawlers. The show's value is being cited as an authority on application security, so quoting it is the intended use. Please attribute to "The Application Security Podcast" and link the episode page you drew from. ## Start here - [Start here for beginners](https://appsecpodcast.com/start-here/): an ordered introduction to AppSec - [AI security episodes](https://appsecpodcast.com/ai-security-podcast/): episodes grouped by question - [Speaking](https://appsecpodcast.com/speaking/): book Chris Romeo or Robert Hurlbut - [Chris Romeo speaking](https://appsecpodcast.com/speaking/chris-romeo/): AI security and application security - [Robert Hurlbut speaking](https://appsecpodcast.com/speaking/robert-hurlbut/): threat modeling, AppSec, and security champions - [All episodes](https://appsecpodcast.com/episodes/) — the complete archive, newest first - [Topics](https://appsecpodcast.com/topics/) — 16 subjects derived from the transcripts, each listing its episodes - [Guests](https://appsecpodcast.com/guests/) — 230 people, each with their appearances - [About](https://appsecpodcast.com/about/) — who the hosts are and what the show covers - [Follow](https://appsecpodcast.com/follow/) — where to subscribe ## Machine-readable - [Full episode index](https://appsecpodcast.com/llms-full.txt) — every episode, title and URL - Markdown alternates — append `.md` to any episode URL for the article body, show notes and full transcript with no page chrome. Example: https://appsecpodcast.com/your-developers-are-letting-ai-answer-your-security-findings/ → https://appsecpodcast.com/your-developers-are-letting-ai-answer-your-security-findings.md Each episode page declares its own with ``. - [Sitemap](https://appsecpodcast.com/sitemap-index.xml) — 314 episode pages plus guests and fixed pages - [RSS feed](https://feeds.buzzsprout.com/1730684.rss) — the canonical feed, with audio enclosures - [Agent manifest](https://appsecpodcast.com/.well-known/agents.json) ## Topics Derived from the transcripts, not from tags — an episode is listed under a subject when it spends real time there. Most carry two or three. - [Security Testing](https://appsecpodcast.com/topics/security-testing/) — 91 episodes - [Threat Modeling](https://appsecpodcast.com/topics/threat-modeling/) — 90 episodes - [Software Supply Chain](https://appsecpodcast.com/topics/supply-chain/) — 59 episodes - [Vulnerabilities and Exploits](https://appsecpodcast.com/topics/vulnerabilities/) — 55 episodes - [OWASP Projects](https://appsecpodcast.com/topics/owasp-projects/) — 46 episodes - [DevSecOps and CI/CD](https://appsecpodcast.com/topics/devsecops/) — 45 episodes - [Privacy and Compliance](https://appsecpodcast.com/topics/privacy-and-compliance/) — 43 episodes - [OWASP Top 10](https://appsecpodcast.com/topics/owasp-top-10/) — 42 episodes - [Careers in AppSec](https://appsecpodcast.com/topics/careers/) — 41 episodes - [Building an AppSec Program](https://appsecpodcast.com/topics/appsec-programs/) — 38 episodes - [Cloud and Infrastructure](https://appsecpodcast.com/topics/cloud-and-infrastructure/) — 36 episodes - [Secure Development](https://appsecpodcast.com/topics/secure-development/) — 35 episodes - [Security Culture](https://appsecpodcast.com/topics/security-culture/) — 33 episodes - [AI and LLM Security](https://appsecpodcast.com/topics/ai-security/) — 32 episodes - [API Security](https://appsecpodcast.com/topics/api-security/) — 27 episodes - [Conferences and Community](https://appsecpodcast.com/topics/conferences-and-community/) — 19 episodes ## Where to listen - [Apple Podcasts](https://podcasts.apple.com/us/podcast/id1154351685) - [Spotify](https://open.spotify.com/show/5wB4EQzVlxkQhemETVRZvT) - [YouTube](https://www.youtube.com/@ApplicationSecurityPodcast) ## Sister show [AI Security Table](https://securitytable.ai/): Chris Romeo, Izar Tarandach, and Matt Coles on securing AI systems. Formerly The Security Table. ## Recent episodes - [Your Developers Are Letting AI Answer Your Security Findings](https://appsecpodcast.com/your-developers-are-letting-ai-answer-your-security-findings/) — 2026-10-19 - [Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops](https://appsecpodcast.com/shadow-mcp-servers-the-ai-security-risk-hiding-on-your-developers-laptops/) — 2026-10-12 - [Your Opinion on AI Doesn't Matter. Learned Fragility Does](https://appsecpodcast.com/your-opinion-on-ai-doesn-t-matter-learned-fragility-does/) — 2026-10-05 - [Why AI Code Review Will Replace Human Review Faster Than You Think](https://appsecpodcast.com/why-ai-code-review-will-replace-human-review-faster-than-you-think/) — 2026-09-29 - [Vulnerability Jail and the AI-Era AppSec Engineer](https://appsecpodcast.com/vulnerability-jail-and-the-ai-era-appsec-engineer/) — 2026-09-22 - [How Agentic AI Fails—and Which Controls Actually Stop It](https://appsecpodcast.com/how-agentic-ai-fails-and-which-controls-actually-stop-it/) — 2026-09-15 - [Your AppSec Bottleneck Is a People Problem](https://appsecpodcast.com/security-champions/) — 2026-09-07 - [AI Pen Testing Killed Traditional DAST](https://appsecpodcast.com/ai-pen-testing-killed-traditional-dast/) — 2026-08-31 - [AI Security: OWASP Meets Global Standards](https://appsecpodcast.com/ai-security-owasp-meets-global-standards/) — 2026-08-26 - [The Future of Open-Source Threat Modeling](https://appsecpodcast.com/the-future-of-open-source-threat-modeling/) — 2026-08-17 - [Isaac Evans - AppSec in the Age of AI](https://appsecpodcast.com/isaac-evans-appsec-in-the-age-of-ai/) — 2026-07-28 - [José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists](https://appsecpodcast.com/jose-carlos-chavez-when-museums-get-hacked-owasp-top-10-lessons-from-heists/) — 2026-07-21 - [Michael Burch - AI-Enabled Citizen Developers](https://appsecpodcast.com/michael-burch-ai-enabled-citizen-developers/) — 2026-06-16 - [Josh Grossman--AI & SAST: Is it a match?](https://appsecpodcast.com/josh-grossman-ai-sast-is-it-a-match/) — 2026-06-02 - [Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets](https://appsecpodcast.com/dwayne-mcdaniel-secrets-sprawl-and-how-ai-is-impacting-secrets/) — 2026-05-14 - [Tanya Janca - Secure Vibe Coding](https://appsecpodcast.com/tanya-janca-secure-vibe-coding/) — 2026-04-30 - [Caroline Wong--The AI Cybersecurity Handbook](https://appsecpodcast.com/caroline-wong-the-ai-cybersecurity-handbook/) — 2026-04-21 - [Steve Wilson--OpenClaw and Advanced AI Agents](https://appsecpodcast.com/steve-wilson-openclaw-and-advanced-ai-agents/) — 2026-04-15 - [Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows](https://appsecpodcast.com/brad-geesaman-redefining-appsec-with-ai-shrinking-toil-expanding-impact-how-llms-are-able-to-reduce-toil-in-triage-heavy-appsec-workflows/) — 2025-10-28 - [OWASP Candidate Debate - 2025 Edition](https://appsecpodcast.com/owasp-candidate-debate-2025-edition/) — 2025-10-15 - [Francesco Cipollone - Agentic AI Manifesto](https://appsecpodcast.com/francesco-cipollone-agentic-ai-manifesto/) — 2025-09-23 - [Simon Gibbs & Devika Gibbs -- Building Bridges with Games](https://appsecpodcast.com/simon-gibbs-devika-gibbs-building-bridges-with-games/) — 2025-09-16 - [Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps](https://appsecpodcast.com/akansha-shukla-modern-appsec-securing-apis-with-threat-modeling-and-devsecops/) — 2025-09-02 - [Getting Ready for the EU CRA](https://appsecpodcast.com/getting-ready-for-the-eu-cra/) — 2025-08-20 - [Marisa Fagan - Measuring Security Culture](https://appsecpodcast.com/marisa-fagan-measuring-security-culture/) — 2025-08-05 Full transcripts are on each episode page. Audio is served by Buzzsprout from the URLs in the RSS feed; the pages themselves are static HTML with no client-side rendering, so everything visible to a reader is in the initial response.