Application Security Weekly (Audio)

AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patching queue has never been an effective strategy. Nidhi Aggarwal talks about some of the economics and decisions that orgs evaluate when figuring out how to improve and protect their software. LLMs might be effective assistants in generating code, but only when they have the context of secure patterns to follow. We also talk about what some of the bug bounty data reveals in terms of successful researchers finding more impactful vulns and why the combination of domain expertise and curiosity remains profitable.
Segment Resources
https://www.hackerone.com/blog/finding-fast-fixing-slow-rising-exposure-debt
Vulnerability discovery and remediation gap in the AI era
AI-generated code is changing how vulnerabilities are created, discovered, and managed. This segment explores why finding more vulnerabilities doesn't necessarily mean reducing exposure, how teams can validate exploitability and prioritize real risk, and where agentic AI can support defenders without replacing human security expertise. It also looks at what continuous threat exposure management means for enterprise security teams in practice.
Everyone's a Builder Now: Securing the AI-Powered Enterprise: Black Hat Interview with Gil Geron, CEO of Orca Security
AI is fundamentally changing software development, turning employees across the business into builders and reshaping how organizations think about innovation and risk. In this session, Orca Security CEO Gil Geron explores what this shift means for enterprise leaders and why security must evolve alongside the next generation of AI-powered software creation.
Segment Resources:
https://orca.security/resources/press-releases/orca-security-extends-its-platform-to-the-new-generation-of-ai-builders/
https://orca.security/platform/ai-appgen-security/
This segment is sponsored by Orca Security. Visit https://securityweekly.com/orcabh to learn more about them!
Bugcrowd Launches Pathseeker: Flipping the Script on Traditional Pentesting: Black Hat Interview with Braden Russell, CTO of Bugcrowd
Bugcrowd is launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line, which combines continuous agentic pentesting with on-demand human validation. The launch comes as the security industry grapples with a growing "AI slop" problem, where unchecked AI-generated vulnerability reports have overwhelmed bug bounty programs and even forced some, like Curl, to shut theirs down. Braden will unpack how Bugcrowd is positioning Savant Pathseeker as a response to that industry-wide trust problem, not just a new product launch.
Segment Resources:
https://www.bugcrowd.com/products/pathseeker/
https://www.bugcrowd.com/press-release/bugcrowd-introduces-savant-pathseeker-delivering-continuous-agentic-pentesting-across-the-attack-surface/
https://www.bugcrowd.com/products/platform
https://www.bugcrowd.com/products/ai-powered-security-intelligence/
Apply for early access at https://securityweekly.com/bugcrowdbh
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-398

Sandboxing, least privilege, and monitoring are well-established controls in terms of the defenses they provide against unexpected and unauthorized actions. But being well-established in theory doesn't always translate to successful in practice. Kieran Human talks about some of the properties that a good sandbox should have and how monitoring creates a feedback loop to refine allow lists and access controls. In practice, the potential unpredictable behavior of an agent isn't much different from malware. We talk through some of the ways orgs can securely deploy agents without unnecessarily increasing their attack surface.
Resources
https://www.threatlocker.com/blog/the-principle-of-least-privilege-for-ai-agents
https://www.threatlocker.com/blog/applying-threatlocker-to-agentic-ai-tools
https://www.threatlocker.com/blog/why-the-five-eyes-alliance-sees-zero-trust-as-the-best-defense-against-agentic-ai-threats
This interview is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-397

All sorts of cybersecurity disciplines are adopting agents to help humans save time and automate routine activities. Sai Kiran Uppu describes his work on creating a platform for agents to analyze external threat intel, examine internal systems, and present triage decisions to operators. This type of work is especially useful to orgs that deal with petabytes of data and thousands of systems. And, as Kiran notes, it's important to keep that scale from blowing up your budget or turning triage into a procession of false positives.
Ideally, this kind of threat intel that's paying attention to attack trends and searching internal systems for evidence of compromise also turns into proactive defenses. We talk about some of the ways to engage developers to improve security visibility into their services and harden their designs against common attacks.
After that discussion we're running two sponsored interviews from Black Hat.
AI Pentesting and the Future of Cybersecurity: Black Hat interview with Chris Wallis, Founder and CEO of Intruder
This segment discusses how AI addresses the long-standing gap between traditional pentesting and automated vulnerability scanning. Intruder CEO and founder Chris Wallis dives into the nuances of AI-enabled security and how these offerings will impact mid-market security teams.
Segment Resources:
https://www.intruder.io/platform/ai-pentesting
https://www.intruder.io/blog/ai-pentesting-the-depth-of-a-pentest-on-demand
https://www.intruder.io/blog/ai-web-app-pentesting-test-on-every-major-release
Intruder's continuous exposure management platform helps security, IT, and engineering teams stop breaches before they start. For more information about Intruder's products and services, please visit https://securityweekly.com/intruderbh.
How Menlo Security Is Securing AI Agents from Prompt Injection: Black Hat Interview with Ramin Farassat, Chief Product Officer of Menlo
Enterprises are deploying AI agents like Microsoft Copilot, Google Gemini, and Claude Code faster than they can secure them, and attackers are exploiting that gap through prompt injection. Hidden instructions get buried in web pages, files, and even images that a human would never notice but an AI agent reads and acts on. Menlo Security is building Menlo Agent Runtime Security (MARS) to close that gap, running every agent session in an isolated cloud that sanitizes content before an agent can act on it. Ramin Farassat, Menlo Security's Chief Product Officer, will discuss why the exposure lives in the connectors and integrations around the model rather than the model itself, and how security teams can put controls on the agent attack surface without blocking agentic AI outright.
Segment Resources:
https://www.menlosecurity.com/product/ai-agent-security
MARS is now available today, please visit https://securityweekly.com/menlobh
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-396

Finding flaws has always been a focus of appsec. And now with open source projects and open weight models orgs have modern tools to review code and conduct pentests. Rishi Sharma describes the motivation behind creating a platform of LLM-driven security tools and the effective ways to keep the tools in scope, on budget, and for engineering teams. We talk about how prompts influence LLM activity, as well as the external constraints to keep the LLMs on task.
And even if finding flaws is a major focus of appsec, its goal should be delivering secure software and systems. We touch on some of the ways to keep bugs from creeping back into software and why it's more important to care about vuln classes than vuln counts.
Episode Resources:
https://projectdiscovery.io/research/ai-coding-impact-report
https://projectdiscovery.io/blog/oh-my-rogue-agent
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-395

There's already an increase in volume of security flaws found by LLMs. And orgs are already turning to LLMs to write code. So, what happens when orgs lean on LLMs to create patches for those security flaws? Keith Hoodlet gives an exclusive early look at his team's recent research into the success, quality, and failures of LLM-generated security patches. Notably, they saw scenarios across a spectrum from robust, effective patches to patches that changed the software's behavior to patches that introduced new vulns to patches that didn't even fix the original vuln while also introducing a new vuln.
The research considers factors like quality and correctness of prompts, complexity of the target software, programming language, and expertise required to understand what a robust patch should look like. If you're going to spend tokens on fixing security flaws, you want a feedback loop that fixes them correctly -- not an infinite loop of new flaws creeping in with every LLM iteration.
Watch for this research, its toolset, and data to be released on Thursday August 6th during Black Hat.
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-394