What's Not Found in AppSec? - ASW #404
Summary
In this episode of Application Security Weekly, hosts Mike Shima, John Kinsella, Tyler Shields, and Adrian Lister explore what is "missing" from modern AppSec. They discuss the failure of current vulnerability prioritization models, arguing that AI-driven discovery has outpaced the ability to contextualize risk. The group critiques industry incentives that favor finding flaws over fixing them and debates whether security governance should shift from decentralized scanning to centralized, verified package platforms. Finally, they address how AI is reshaping the talent pipeline, suggesting th…
Topics discussed
Intro: The 404 theme and host introductions
Guest introductions and FinSec Summit announcement
The missing piece: Vulnerability prioritization
AI-driven discovery vs. remediation and vendor incentives
Incentive mismatch in the security industry
Quantifying risk: Metrics vs. actual exploitability
Context, LLMs, and the future of prioritization
Platform security: Apple, Android, and choke points
Open source governance and supply chain security
Ease of use and the shift to secure-by-design
AI code generation and the future of open source
Spec reviews vs. code reviews in the AI era
Mobile security and Zero Trust implementation
Formal proofs and the limits of AI-written code
The struggle of SMBs and legacy software maintenance
AI agents in AppSec: Writing, finding, and fixing
Tech debt and attack surface in AI-generated code
The future of junior AppSec roles and mentorship
Redefining junior skills: Specs, threat modeling, and hands-on
Education paths: Formal degrees vs. practical hacking
Industry evolution and natural curiosity in security
Learning resources: CTFs and conference opportunities
Celebrating progress: Rust adoption and security improvements
Three-word wrap-up and closing remarks
Listen ad-free on Castria