The Boring AppSec Podcast

About The Boring AppSec Podcast

In this podcast, we will talk about our experiences having worked at different companies - from startups to big enterprises, from tech companies to security companies, and from building side projects to building startups. We will talk about the good, the bad, and everything in between. So join us for some fun, some real, and some super hot takes about all things Security in the Boring AppSec Podcast.

Publisher

The Boring AppSec Podcast

Category

technology

Language

en

Explicit

No

First episode

4 Mar 2024

Latest episode

11 Mar 2026

Latest episodes

11 of 37 episodes have a transcript.

1. 

   11 Mar 2026TRANSCRIPT

   Ep 37: The Future of Security Testing in an AI-Driven World with Jason Haddix

   In this episode, Jason Haddix (CEO of Arcanum Information Security and creator of the Bug Hunter’s Methodology) joins us to examine how AI is changing penetration testing and security research. He explains that while AI agents can automate reconnaissance, code analysis, and parts of vulnerability discovery, meaningful results still depend on human expertise, methodology, and context engineering. The conversation explores how AI is shifting the entry path for new security practitioners, why deep research and critical thinking remain essential skills, and how experienced testers are embedding their knowledge into agent workflows using tools like Claude Code. Jason also discusses practical experimentation with AI assistants such as OpenClaw, including prompt-injection defenses, guardrails, and the operational risks of running autonomous systems. The episode also addresses the growing debate around AI-generated code and AI-driven vulnerability discovery, highlighting the difference between marketing claims and real-world results. It closes with a discussion on why the industry needs better benchmarks and evaluation methods to measure whether AI security tools actually find meaningful vulnerabilities.

2. 

   2 Mar 2026TRANSCRIPT

   Ep 36: Discussing AI's Current State of Affairs

   In this episode, we examine what is shifting in AI, AppSec, and product security and what remains fundamentally the same. For years, application security has operated on a familiar model: siloed reviews, tool-driven findings, and periodic assessments that struggle to keep pace with modern development. AI doesn’t eliminate those pressures, it amplifies them. Code is generated faster, systems are more interconnected, and the surface area of change expands weekly. The conversation explores agent-based workflows through tools like OpenClaw, not as novelty, but as a signal of a broader shift: from manually operating tools to orchestrating fleets of agents. As AI interfaces move from chat windows to terminals to messaging environments, security teams must reconsider where workflows live and how context is preserved across them. For decades, AppSec has struggled to build a reliable understanding of what systems exist and how they connect. Large language models may finally make it possible to construct living maps of components, data flows, and trust boundaries  enabling assessments that talk to each other instead of existing in isolation. The discussion also revisits threat modeling, not as a compliance artifact, but as a foundation for system-wide reasoning. If AI can automate baseline coverage and reduce repetitive toil, security teams may return to their original purpose: high-leverage risk judgment on critical systems. This leads to a broader debate whether AppSec as a distinct function evolves, shrinks, or dissolves into engineering itself and what the enduring “maker–checker” model of risk management demands in an AI-native world. Finally, the episode reflects on the role of large AI labs in security: the gap between ambitious claims and shipped products, and what that means for founders and security leaders navigating change. 00:00–02:15 — Why this is a no-guest episode & what’s changed since last year 02:15–06:30 — AI co-authoring, productivity gains, and writing workflows 06:30–10:20 — OpenClaw architecture, agent risks, and prompt injection realities 10:20–14:00 — The shifting UI of AI: chat → terminal → messaging agents 14:00–18:30 — Agent orchestration vs siloed security tooling 18:30–23:00 — Context graphs and assessments that “talk” to each other 23:00–27:30 — Threat modeling’s evolution and system-wide visibility 27:30–31:00 — Why inventory is still AppSec’s hardest problem 31:00–34:30 — Personal AI stacks: Obsidian, memory layers, and query tools 34:30–37:30 — Open source in the age of AI-generated PR spam 37:30–40:00 — AI labs: what they ship vs what they say 40:00–44:00 — Will AppSec disappear? A serious debate 44:00–48:00 — Maker–checker risk models in an AI-driven org 48:00–51:00 — Where AI replaces toil — and where humans stay critical 51:00–End — 2026 predictions for AI security and product security .

3. 

   16 Feb 2026TRANSCRIPT

   Ep 35: Exploring Security After Determinism with Jens Ernstberger

   Jens Ernstberger discusses how AI agents challenge traditional security assumptions, emphasizing the need for agent identity and zero trust, in an interview with Anshuman Bhartiya and Sandesh Anand.

Inside a recent episode

Ep 37: The Future of Security Testing in an AI-Driven World with Jason Haddix

Published 11 Mar 2026 · Transcript excerpt

[…] And the cloud code skill was very generic. It's like iterate a number ID, you know, iterate, you know, a non -number ID, but, you know, like it had all the basic iDore stuff in it, it had all the forced 403 browsing kind of stuff, and that's all very generic, and that was kind of where it stopped. And then I went into research mode, deep research mode, and I started reading a whole bunch of blogs and doing research, and I use AI for this now as well. I use what I call a, are you guys familiar with Ralph a Ralph loop? Yeah, okay, cool. So I have built my own cloud code Ralph loop skill, and I give it a research topic, and it does 20 rounds of research, and then presents me with links so that I can go manually go look at them. […]

Who has been a guest on The Boring AppSec Podcast

Names identified in recent episode analyses. Showing up to five guests.

• Jens Ernstberger
• Ankur Chakraborty
• Casey Ellis

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

1 ratings

Spotify

5.0 / 5

5 ratings

Podcast Authority Score: 57 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

71

Social presence

90

YouTube

0

Engagement

60

Contact The Boring AppSec Podcast

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.