The cybersecurity podcast about application security and those who practice it. Hosted by tech industry veterans, each episode focuses on a specific area of cybersecurity, with the hosts and their guests sharing their practitioners’ experiences and opinions, sprinkled liberally with a solid dose of humor and anecdotes.
OWASP Top 10 Turns 20: Still Valid, Still Controversial
The OWASP Top 10 has been the web application security yardstick for over two decades now, from its first edition in 2003 to the latest 2025 update, with its changes of format and scope often stirring industry controversy.
In this episode of AppSec Serialized, Dan Murphy and Ryan Bergquist discuss the past, present, and future of the OWASP Top 10, and do a reality check on its practical usefulness today.
18 Dec 2025
Dune and Gloom Under the AppSec Tree: From Shai-Hulud to React2Shell
Supply-chain vulnerabilities are getting more frequent and dangerous, with the Shai-Hulud npm worm and React2Shell RCE vulnerability being just two of the recent ones.
In this episode of AppSec Serialized, Dan Murphy and Ryan Bergquist analyze those recent threats (plus a bonus Django vulnerability) and talk about the implications of security risk shifting towards dependencies.
25 Nov 2025
20,000 Apps Under the Sea: Deep Dive into Vibe Coding Security
Vibe coding is allowing even non-developers to produce fully functional web applications by using LLMs to generate code – but how secure are they?
In this episode of AppSec Serialized, special guest Bogdan Calin joins hosts Dan Murphy and Ryan Bergquist to talk about his research, which involved vibe-coding over 20,000 applications and analyzing them to learn what vulnerabilities and hardcoded secrets are most frequent.
30 Oct 2025
Conducting the AppSec Symphony: From Noise to ASPM Harmony
Application security posture management (ASPM) has become a crucial pillar of AppSec programs by aggregating, correlating, and prioritizing vulnerability reports arriving from various testing tools.
In this episode of AppSec Serialized, Cenk Kalpakoğlu, founder of Kondukto, joins hosts Dan and Ryan to discuss the evolution of ASPM, how Invicti and Kondukto approach integrations, and how security can be embedded early in CI/CD pipelines. The conversation covers industry trends, automation, and lessons from Kondukto’s startup journey to its acquisition by Invicti.
23 Sept 2025
Prompt and Circumstance: LLM Vulnerability Scanning
Large language models are transforming software development by making it easier to write and connect code, but they also introduce serious security risks. Vulnerabilities like LLM command injection, SSRF, and insecure outputs mirror traditional web flaws while creating new attack vectors unique to AI-driven apps.
In this episode, Dan Murphy and Ryan Bergquist discuss how LLM-powered applications can be manipulated into leaking data, executing malicious commands, or wasting costly tokens. They also explain how Invicti’s scanning technology detects and validates these risks, helping organizations protect against the growing challenges of LLM security.
14 Aug 2025
Revving the (Scan) Engine
At the heart of any DAST product is a scan engine that needs to be fast and accurate while keeping up with how the latest applications and APIs are being built and attacked. As AI-assisted development increases both the volume of code and its opacity, having an engine that can automatically and reliably test for security flaws without holding up releases is crucial for any serious DAST solution—and for its users.
In this episode of AppSec Serialized, Dan Murphy and Ryan Bergquist look at the evolution of DAST and discuss how Invicti has combined the best features of Netsparker and Acunetix to create a new scan engine powering its AppSec platform.
25 Feb 2025
AppSec Tech Below the Deck
Application security engineers connect security to engineering in more ways than one. Without their efforts, skills, and tools, even the best-laid application security policies and programs would remain mere CISO wishlists.
In this episode, Invicti’s Frank Catucci and Dan Murphy talk to application security engineer Paul Good to learn what a day in the life of an AppSec guy looks like when you need to balance internal and external security needs. In the story segment, Mallory the hacker realizes that vulnerabilities are not given once and for all—because while you’re probing a gap, someone might already be fixing it…
21 Jan 2025
CISO on the Seesaw
The role of Chief Information Security Officer, or CISO, is crucial for any sizable organization yet often misunderstood as purely a compliance paperwork post. In reality, CISOs have to balance multiple aspects of information security to minimize risk, ensure timely incident response, maintain compliance, and more—all with finite resources and competing priorities.
In this episode, Frank Catucci and Dan Murphy talk to a real-life CISO, Invicti’s own Matthew Sciberras, discussing the balancing skills required to define and apply application security policies with limited resources. In the story segment, Alice the head dev realizes her cherished new project will be delayed due to vulnerabilities—if only she had scanned earlier…
17 Dec 2024
Another Code Brick in the Wall
Invicti's Frank Catucci and Dan Murphy explore the high-risk world of software supply-chain security, where a single vulnerable component can create a critical security gap.
19 Nov 2024
APIs Wide Open
APIs are the secret door through which so many application attacks are executed in recent years. Compared to graphical user interfaces, they are far easier to build and deploy but far harder to test and secure, making API security a top concern.
In this episode, Frank Catucci and Dan Murphy dive into the world of API security, discussing high-profile breaches and looking at ways to discover and test the API part of your web applications. In the fiction segment, Mallory the hacker finds a shadow API being exposed by MegaHelix Corp.
24 Oct 2024
Machine Learning When the Perimeter is Burning
Knowing what sites, apps, and APIs you’re exposing to the Internet is crucial for determining your realistic risk level and making accurate security decisions.
In this episode, Frank Catucci and Dan Murphy are joined by special guest Bogdan Calin, Principal Security Researcher at Invicti, to talk about ways of determining an organization’s web attack surface and the resulting risk level. In particular, they discuss the pro and cons of various AI and ML approaches to this problem and go deeper into the workings of the pioneering Predictive Risk Scoring feature that Bogdan helped design and build.
In the fiction segment, it’s Bob the CISO’s first day at a new company and from the first cursory check, he’s worried that the org is exposing a lot more that it should be. A call with Alice the head developer does nothing to put his mind at ease—quite the opposite...
10 Sept 2024
Hot Cross-Site Fun
Cross-site scripting (XSS) is one of the oldest web vulnerability types and still a very real threat.
In this episode, Frank Catucci and Dan Murphy talk about the origins of cross-site scripting, some high-profile attacks, and best practices to test for and also prevent XSS in applications. In the fiction segment, Mallory the hacker uses XSS to inject script into an old and vulnerable leaderboard server—but she has to work hard to get around the WAF first.
Podcast Authority Score: 1 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
Quality
2
Social presence
0
YouTube
0
Engagement
0
Contact AppSec Serialized by Invicti
Guest appearances
Does not typically book guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of AppSec Serialized by Invicti?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
