Absolute AppSec

Ken Johnson and Seth Law

A weekly podcast of all things application security related. Hosted by Ken Johnson and Seth Law.

  1. 3 days ago

    Episode 337 - w/Coffee, Chaos, and ProdSec - AI Guardrails, Risk Prioritization Shift

    In episode 337, the hosts reconvene for their quarterly crossover discussion with Kurt and Cameron from the Coffee, Chaos, and ProdSec podcast to analyze the current state of software security, AI guardrail limitations, and operational risk management. The technical commentary evaluates the practical limits of AI sandboxing, highlighting Anthropic’s acknowledgments regarding the challenges of enforcing strict guardrails around autonomous agents and LLMs. The panel critiques the industry's historical reliance on "bigger number better" vulnerability detection metrics, arguing that security teams must move away from serving as "bug janitors" inundated with false positives from static and dynamic scanners. Instead, the discussion advocates for prioritizing remediation based on actual business risk, leveraging automated threat modeling, and integrating hyper-efficient, token-aware AI security skills into developer workflows. Additionally, the hosts address the operational friction caused by frontier lab guardrails falsely flagging legitimate security assessments, pushing teams toward local open-weight models for threat analysis. Finally, the episode examines AWS infrastructure reliability issues and how automated supply chain campaigns target GitHub Actions, concluding that security practitioners must focus on systemic risk reduction rather than firefighting individual bugs. Sponsored by Guardsquare (guardsquare.com)

  2. 13 Oct

    Episode 336 - Hardware Image Signing, Bot Reduction, AI Code Insecurities

    In Absolute AppSec Episode 336, the hosts explore hardware-level image signing, bot traffic anomalies, cross-site scripting (XSS) developments, and AI-driven code quality challenges. The episode opens with an analysis of Apple's C2PA hardware-level cryptographic signing for photos, evaluating how hardware-based provenance signatures on image pixels and EXIF metadata offer an effective "allow-list" defense against AI-generated media and deepfakes. Turning to global network security, the hosts discuss the drone strikes on Yandex data centers and subsequent Cloudflare data showing that automated bot requests dropped from over 88% down to under 1% of network activity, highlighting how infrastructure disruptions impact automated botnets. The technical commentary covers PortSwigger's updated XSS cheat sheet, exploring how evolving browser behaviors continue to yield new sanitization bypasses, while noting that AI code generators frequently reintroduce long-patched, legacy vulnerability classes like path traversal. Finally, the episode critiques the hype surrounding AI coding models like GLM-5.3, arguing that despite claims of total automation, developers face increasing friction debugging low-quality LLM code outputs. The hosts conclude that the AppSec industry must transition away from acting as mere "bug janitors" managing tool alerts and instead focus on proactive, architectural risk reduction. Sponsored by Guardsquare (guardsquare.com)

  3. 6 Oct

    Episode 335 - w/ Ron Perris - Secure Coding with AI

    In episode 335 of Absolute AppSec, Seth and Ken sit down with Ron Perris. Ron is Chief Technology Officer at Manicode Security, to discuss the integration of AI into secure software development and AppSec workflows. The conversation explores the rapid adoption of large language models (LLMs) and local agentic harnesses, examining how developers use them for code generation and how security teams manage the resulting system-level risks on developer workstations. Perris details his work with Manicode.ai, founded alongside Jim Manico, which addresses LLM code generation defects by embedding language- and framework-specific positive security guidance directly into the AI's context window. By leveraginglifecycle hooks within coding harnesses to inject tailored defensive rules (e.g., parameterized queries or framework-specific escaping), Manicode guides LLM token generation away from common vulnerabilities rather than relying solely on post-generation SAST checks. The hosts and Perris critique the industry's overreliance on dashboard-driven vulnerability counting, arguing that AppSec must move beyond managing repetitive bugs and focus on systematically eliminating flaw classes through secure framework defaults and context engineering. Finally, Perris reflects on his time at Reddit, the challenges of preventing recurring vulnerability classes at scale, and the potential for reviving practitioner-focused conferences like LocomocoSec to address modern AI-driven AppSec realities. Sponsored by Guardsquare (guardsquare.com).

  4. 16 Sept

    Episode 334 - w/ Ryan Lloyd - Mobile Application Security

    In episode 334 of Absolute AppSec, hosts Ken Johnson and Seth Law interview Ryan Lloyd, Chief Product Officer at GuardSquare, to explore mobile application security and product management strategy. Lloyd details GuardSquare's evolution from the open-source Java optimizer ProGuard—which introduced basic name obfuscation—into a commercial suite offering multi-layered code hardening, control flow flattening, encryption, and automated runtime application self-protection (RASP) to detect dynamic tampering, hooking tools like Frida, and rooted devices. The discussion examines the product strategy behind balancing customer feature requests against core security engineering, emphasizing evidence-based decision-making over opinion. Addressing the broader mobile threat landscape, Lloyd highlights how attack vectors have expanded beyond financial services into retail, delivery, and loyalty apps, where attackers manipulate business logic or exploit open platform APIs like Android accessibility services for account takeovers. To track emerging threats, GuardSquare's research arm monitors reverse-engineering forums, academic compiler research, and dark web channels. Finally, the conversation evaluates how automated AI tools accelerate the velocity of reverse engineering and vulnerability discovery, underscoring that mobile security defenses must continually evolve to increase the time and cost required for attackers to tamper with client-side applications. Episode sponsored by GuardSquare (guardsquare.com).

  5. 8 Sept

    Episode 333 - LLM Patching Flaws, AI Code Regressions, Bug Bounty Economy

    Sponsored by GuardSquare (guardsquare.com), the discussion of Episode 333 opens with an analysis of a 1Password academic paper evaluating how frontier LLMs perform at autonomous vulnerability patching. The research indicates that LLMs successfully generate functional, side-effect-free patches only 26% of the time, often introducing new security flaws, breaking application behavior, or hallucinating fixes due to a lack of environmental context and "correctness collapse". The hosts critique the industry push toward auto-remediation, arguing that automated patch generation fails to address root causes like noisy tooling or organizational culture issues, and they emphasize that human domain expertise remains necessary for reliable patching. Turning to real-world AI security risks, the episode examines a Snowflake vulnerability where an AI coding tool (GitHub Copilot Autofix) regressed a GitHub Actions workflow into an unauthenticated Remote Code Execution (RCE) flaw via command injection, which was subsequently discovered and validated within five days by Wiz's automated "Red Agent". Finally, the hosts cover Dark Reading reporting on how the AI-driven "vulnpocalypse" is repricing the bug bounty economy. As automated scanning harnesses double report volumes, companies face budget constraints that reduce payout amounts per finding, forcing organizations to narrow program scopes toward high-priority assets.

  6. 1 Sept

    Episode 332 - AI SDLC, Call for Cyber Defense, Rumor as the Exploit

    In episode 332, the discussion focuses on how artificial intelligence is reshaping the Software Development Lifecycle (SDLC). The episode analyzes Anthropic's blog post regarding an "AI-native SDLC," evaluating its vision of replacing traditional development bottlenecks with AI workflows. The commentary critiques Anthropic's reliance on simple Markdown files for tracking development decisions, noting that replacing deterministic tools with probabilistic LLMs in core SDLC processes introduces significant reliability risks, context drift, and excessive token costs. The conversation turns to OpenAI's "Collective Call for Cyber Defense" initiative, examining its push for frontier AI model regulation and critiques of open-weight models, which are viewed as an effort to establish vendor lock-in. Exploring the concept of "Rumor as the Exploit," the discussion highlights how public mentions or minor disclosures of vulnerabilities now allow AI-driven testing harnesses to rapidly discover and generate working exploits across unmaintained software ecosystems. To counter this accelerated threat landscape, the episode evaluates defensive strategies, including runtime verification, reachability analysis, and cooling-off periods for new package releases, emphasizing that security defenders must move beyond thin wrapper solutions and build robust systems combining deterministic controls with model capabilities. Episode sponsored by Guardsquare (guardsquare.com).

  7. 25 Aug

    Episode 331 - Being "Mythos" Ready, CRLF-Powered De-sync Attacks

    Sponsored by Guardsquare (guardsquare.com), Episode 331 focuses heavily on the growing role of AI agents in application security and how organizations should build and defend against agentic systems. Ken and Seth argue that effective AI security systems should combine deterministic tooling with the probabilistic reasoning of LLMs rather than handing an entire security workflow to a model. Deterministic steps can map repositories, identify dependencies, reconstruct code relationships, and narrow the areas requiring investigation, while LLMs provide reasoning and creativity where those capabilities add value. Preparing for AI-assisted attackers, emphasizing secure development practices, guardrails, sandboxing, pre-production testing, and faster detection and response. The episode also examines HTTP request smuggling and CRLF-based attacks, including how differences in request parsing between proxies and backend services can create authorization bypasses and other exploit chains. Seth and Ken emphasize identifying the critical vulnerability within an exploit chain and discuss how service-oriented architectures can increase risk when components interpret the same request differently. Finally, they question whether bug bounty programs adequately reward researchers for discovering complex, high-impact vulnerabilities, especially as AI agents increasingly automate vulnerability discovery.

  8. 18 Aug

    Episode 330 - w/ Jeevan Singh - Vulnerability Jail

    In this special episode of Absolute AppSec, we cover a topic which started as a solution proposed by Rippling Security's Jeevan Singh: Vulnerability Jail. As Jeevan describes it: "In this new AI world, we have seen many more vulnerabilities, and we struggled to get Engineering to fix them all in a timely fashion. This changed when we created Vulnerability Jail. If any vulnerability goes over SLA, your team is placed in Jail, preventing them from merging PRs into the main/default branches. We implemented Vulnerability Jail, updated our SLAs and got buy-in from Eng Leadership for our new Vulnerability Management program. As a result, we have now fixed the same number of vulnerabilities in one month as the team did in the previous year. The speed is still accelerating."" What do we think of the Stick approach to Vuln Management? What are the solutions to the rapid production by AI as well as the vulnpocalypse, Alex Gaynor's term to describe the way that "new technological innovation enables (or indirectly results in) finding a very large number of vulnerabilities in pre-existing software, which renders all previous assumptions and beliefs about the volume of extant vulnerabilities incorrect." Will "Vulnerability Jail" save us from the vulnpocalypse? Episode sponsored by GuardSquare (guardsquare.com)

See All (337)

About

A weekly podcast of all things application security related. Hosted by Ken Johnson and Seth Law.

Information

  • Creator
    Ken Johnson and Seth Law
  • Years Active
    2018 - 2026
  • Episodes
    337
  • Rating
    Explicit
  • Show Website
    Absolute AppSec

You Might Also Like