The Elephant in AppSec

The Elephant in AppSec

Time to discuss AppSec issues no one talks about.

  1. Secure by Design: Who’s Really Responsible? with Abhijeth Dugginapeddi

    -5 DIAS

    Secure by Design: Who’s Really Responsible? with Abhijeth Dugginapeddi

    Today on the show, I’m joined by Abhijeth Dugginapeddi, Director of Offensive Security at Palo Alto Networks. Before this, he built and led product and cloud security at BigCommerce, and worked on application security at Commonwealth Bank and Adobe.Abhijeth is deeply passionate about giving back to the community. He’s taught advanced web application security at UNSW, mentored through multiple outreach programs, and recently launched his first LinkedIn Learning course, “Practical Secure by Design”. He’s also been recognised in the Hall of Fame at companies like Google, Yahoo, and others for uncovering serious vulnerabilities across their platforms.In this episode, we get into the idea and the principles of secure by design, who should own it, and why security culture matters so much. We also talk about IPO readiness from a security perspective, and the real-world challenges startups face when trying to build security in.Dive right in!

    43 min
  2. The Pressure of Security Leadership: What SLAs Actually Work? with Terry O'Daniel

    19/10

    The Pressure of Security Leadership: What SLAs Actually Work? with Terry O'Daniel

    Today, I’m excited to be joined by Terry O’Daniel, former global head of security at Amplitude, Instacart, and Netflix, and a trusted advisor in the security space. Terry thrives in high-growth environments and loves tackling complex challenges. With a strong background in engineering and security, he builds teams that focus on solving security problems at scale through automation and instrumentation. Terry is also a frequent public speaker and passionate advocate for product security. And recently, he joined Harvard as the Head TA for Security Lifecycle Threats. In this episode, we break down how SLAs enforce real accountability, why security leaders are constantly under pressure, and why ignoring identity and data structures is a recipe for failure.  We also discuss how operating under pressure can surprisingly lead to better decision-making and what the future of product security will look like. Dive right in!

    44 min
  3. Can We Make AI Agents Smarter Than Security Teams? with Anshuman Bhartiya

    25/09

    Can We Make AI Agents Smarter Than Security Teams? with Anshuman Bhartiya

    Today, I’m excited to welcome Anshuman Bhartiya, an AppSec tech lead at Lyft. Before that, he worked as a security engineer at companies like Thirty Madison, Intuit, and Atlassian. Anshuman is also a fellow podcaster and co-host of the Boring AppSec podcast, alongside one of my previous guests, Sandesh Mysore Anand. Recently, he’s been experimenting extensively with building AI agents for both offensive and defensive security, and he’s documenting his findings at anshumanbhartiya.com(link in the description). In this episode, we dive into the challenges of building effective AI agents, the impact of AI on security practices, and the importance of understanding AI outputs and avoiding confirmation bias. We also touch on the ongoing debate of build versus buy solutions and explore where the future of AI in security might be headed. Dive right in!

    33 min
  4. Why DevSecOps isn't enough without deep cloud context with Anjali Singh Shukla

    24/09

    Why DevSecOps isn't enough without deep cloud context with Anjali Singh Shukla

    Today I’m joined by Anjali Singh Shukla, Senior Security Engineer Cloud at Flipkart. She bridges the worlds of Cloud Security and DevSecOps, having led audits and defense strategies across AWS, Azure, and GCP, with a strong focus on Kubernetes and container security. Beyond building secure pipelines, Anjali designs training programs and speaks at global conferences like Black Hat and OWASP. Most recently at OWASP AppSec Days Singapore, she showed how attackers exploit AWS EKS misconfigurations and how to defend against them. In this episode, we dive into why DevSecOps alone isn’t enough without a deep understanding of cloud, and the risks that come with moving fast in modern deployments. Anjali also shares her perspective on securing multi-cloud environments and weighs in on the industry’s buzz around CNAPP and CSPM and ASPM convergence. And with that, get ready to hear Anjali’s opinions.

    33 min
  5. Decoding a Healthy Security Program: What Does "Healthy" Even Mean? with Maxwell Zhou

    18/09

    Decoding a Healthy Security Program: What Does "Healthy" Even Mean? with Maxwell Zhou

    Today, I’m joined by Maxwell Zhou, the Founding Partner of PolarStar Cybersecurity Group, a cybersecurity firm focused on helping fintech organizations strengthen their product security. Throughout his career at Greenlight, Visa, and T-Mobile, Maxwell has specialized in penetration testing, vulnerability assessments, and secure coding practices. He’s particularly excited about building world-class security programs that scale with hyper-growth organizations.In this episode, we discuss one of Maxwell’s articles on the traits of healthy security programs, diving into what “healthy” really means. We also explore the concept of security debt, how it can lead to increased incidents over time, and the importance of having a pentesting background when it comes to understanding which vulnerabilities truly matter.Dive right in!

    41 min
  6. Why SAP Security Can be a Hidden Weakness for Enterprises with Oumaima Baira

    12/09

    Why SAP Security Can be a Hidden Weakness for Enterprises with Oumaima Baira

    Today, I’m joined by Oumaima Baira, Directrice of Enterprise Security at Deloitte. With nearly a decade of experience, she’s helped organizations strengthen their defenses — from DevSecOps and SAP application security to enterprise-wide security strategy. She began her career in cloud engineering before moving into cyber consulting, and quickly rose through Deloitte’s leadership ranks, blending deep technical expertise with strategic vision. Beyond her professional roles, Oumaima is an active member of the cybersecurity community. She often takes part in OWASP France chapter meetups, where we met, and international OWASP and cyber events, sharing insights and learning from peers. She’s also a passionate advocate for women in cybersecurity, inspiring the next generation of cyber leaders to step confidently into the field. In this episode, we explore the unique challenges and security risks of SAP systems — a business management and automation platform relied on by countless global organizations. We discuss why understanding business logic is critical to application security, and why this is especially important when it comes to securing SAP. Oumaima also shares her perspective on global differences in security maturity and offers practical advice on preparing for crisis management with efficiency. Dive right in!

    37 min
  7. Latin America’s AppSec Culture: What’s Lost (and Found) in Translation?

    5/09

    Latin America’s AppSec Culture: What’s Lost (and Found) in Translation?

    Today, I’m joined by Max Alejandro Gómez-Sánchez Vergaray, Defensive Cybersecurity Manager at Banco de Crédito BCP. With a background in software engineering, Max transitioned into AppSec and has become a leading voice in promoting DevSecOps awareness and building robust AppSec programs using SAMM across Latin America and beyond. He actively contributes to OWASP projects like Cornucopia and regularly offers free workshops in Spanish on secure design for digital products. If you’d like to join a future session, check out the link below!In this episode, we dive into AppSec in Latin America, with a focus on Peru’s unique cybercrime laws and their impact on security awareness. Max shares insights on the cultural challenges in cybersecurity training, the complexities of translating frameworks like Cornucopia, and what can get lost in translation. We also explore building connections in remote teams and what global developers can learn from Latin America’s approach. Dive right in!

    37 min
  8. OWASP SAMM vs BSIMM: Which Maturity Model Reigns Supreme?

    27/08

    OWASP SAMM vs BSIMM: Which Maturity Model Reigns Supreme?

    Today, I'm joined by Nariman Aga-Tagiyev, a seasoned cybersecurity architect and threat modeling coach, bringing over two decades of experience in the software development industry.  As the founder of SecureHabits, he’s on a mission to help software manufacturers mature their secure software development lifecycle. Nariman is a familiar face at OWASP Netherlands Chapter events and an active contributor to projects like OWASP SAMM and the Security Champions Maturity Model. His work bridges the gap between theory and practice, empowering teams to build security into their culture - not just their code. In this episode, we dive into a memorable "battle" Nariman had at the RSA conference, where he argued both sides of the SAMM vs. BSIMM debate—mostly with himself, after BSIMM expert Caroline Wong couldn’t attend.  We also explore why organizations often skip the foundational steps before rushing to buy security tools, why true maturity is so rare, and what the new regulatory frameworks like the Cyber Resilience Act mean for businesses in the EU. Dive right in!

    46 min
Ver tudo (78)

Excerto

Sobre

Time to discuss AppSec issues no one talks about.

Informação

  • Autoria
    The Elephant in AppSec
  • Anos em atividade
    2024 - 2025
  • Episódios
    78
  • Classificação
    Para todos
  • Copyright
    © The Elephant in AppSec
  • Site do programa
    The Elephant in AppSec