Application Security

Mastering Application Security: Your Resource for Secure Development, Testing, Code Analysis, and More.

Content Partnership: OWASP Logo SC Media Logo

Stressed stock trader looking at falling market data on a large screen in the exchange.

OWASP Global AppSec: Cybersecurity industry overdue for a ‘market correction’

Paul WagenseilNovember 6, 2026

Insurance data will show which products work, and which are just FUD, says industry vet Jeremiah Grossman.

Today's Top AppSec Headlines

Interviews from OWASP Global AppSec USA 2025

Training
OWASP 2025 Wrap-Up: Community, AI Security, and the Future of AppSec – Avi Douglen – OWSP25 #2
Supply chain
The future of CycloneDX and software transparency – Steve Springett – OWSP25 #2
AI/ML
From Transparency to Trust: Shaping AI Security with OWASP AIBOM & AI Exchange – Aruneesh Salhotra – OWASP25 #2
Risk Assessments/Management
AIVSS: Do we need a new Risk Management Approach in the era of Agentic AI? – Ken Huang – OWASP25 #2
Application security
Threat Modeling and The Four Question Framework – Adam Shostack – OWSP25 #1
AI/ML
Secure Coding in the Age of AI – James Manico – OWSP25 #1
Leadership
Security Champions: You Already Have Them! How to Tap Their Potential – Dustin Lehr – OWSP25 #1
AI/ML
Beyond the Firewall: Why Traditional Web Security Still Matters in the AI Era – Felipe Zipitria – OWSP25 #1
Governance, Risk and Compliance
Use OWASP SAMM for CRA compliance – Sebastien Deleersnyder – OWSP25 #1
Training
CyberRisk TV Live from OWASP Global AppSec 2025 – Allan Friedman – OWSP25 #1
Application security
GenAI Security From Assessment to Action – Sandy Dunn – OWSP25 #1
Application security
Agentic Security Risks – John Sotiropoulos – OWSP25 #1

Application Security: Explained and Explored

Application Security News

Application security

ConnectWise investigating reports of unauthorized access to third-party extensions

Steve ZurierNovember 12, 2026

Attackers may be exploiting ScreenConnect extensions to execute malicious commands on endpoints.

Application security

Beyond the LLM Top 10: Putting AI security into practice – Scott Clinton – OWSP26 #1

November 12, 2026

At OWASP Global AppSec 2026, Scott Clinton, chair of the OWASP GenAI Security Project, joins CyberRisk TV to discuss the project’s expanding work to secure AI applications and agents. Clinton explores how agents can inherit user permissions and introduce insider risks, why security fundamentals and governance remain essential, and how the community...

Application security

The Primacy of Human Expertise in AI Cybersecurity – Andrew Wesie – OWSP26 #1

November 12, 2026

AI-enabled cyber attackers are able to check every side door of an application at a scale and speed unimaginable before. AI can help defenders just as much…but it’s only as effective as the human expertise guiding it. In this session, Xint co-founder and CTO Andrew Wesie explains how human engineering in harness construction is the determining fact...

AI agent secures digital finance platform with glowing padlock circuit board protecting data privacy and intelligent security

AI/ML

NVIDIA and Ory Bring Defense-in-Depth Security to AI Agents

Justin DollyNovember 8, 2026

NVIDIA and Ory combine layered security controls to enforce least-privilege access for AI agents.

Application security

OWASP Global AppSec 2026: Key Takeaways and AppSec Conversations – OWSP26 #1

November 12, 2026

Wrapping up our coverage of OWASP Global AppSec 2026! Mike Shema reflects on conversations with industry leaders about their presentations, insights, and discussions with the application security community. He also highlights Application Security Weekly, a podcast covering the latest AppSec news, industry interviews, and emerging security challenge...

Application security

Modelling for Agentic Failure: When Attack Trees Meet Safety Engineering – Petra Vukmirovic – OWSP26 #1

November 12, 2026

Security teams are getting leaner while the agents they secure keep gaining tasks and reach, so when agents fail, they fail at scale. Threat modelling tells you what could go wrong; Fault Tree Analysis, borrowed from safety engineering, works backwards from a single unacceptable Top Event to show the exact chains of failure that get you there and w...

Application security

Model Context Points of Failure: MCP Security Meets Scale – Moshe Siman Tov Bustan – OWSP26 #1

November 12, 2026

MCP servers have quickly become the connective tissue between AI agents, coding assistants and the tools and data they act on, but security hasn’t kept pace with adoption. We'll share findings from OX Security’s analysis of over 15,000 MCP servers on public registries and 3,000 open-source AI projects, including remote command execution, abandoned ...

Identity

How to Scale AI Agent Identity and Authentication Infrastructure

Justin DollyNovember 8, 2026

Scaling AI agents requires distributed, stateless identity systems built for high-volume authentication.

Application security

Context Confusion Is the New Broken Access Control – Anusha Vajha – OWSP26 #1

November 12, 2026

An AI assistant can authenticate a user, validate their session, and still produce an answer using information it was never supposed to access. Through controlled security experiments, this discussion examines how context confusion creates access-control failures across document retrieval, file switching, conversation history, and caching, includin...

Application security

OWASP Global AppSec 2026 Preview: Insights, Interviews & AppSec Trends – OWSP26 #1

November 12, 2026

CyberRisk TV is at OWASP Global AppSec 2026 in San Francisco, bringing viewers exclusive interviews with cybersecurity leaders and industry experts. Mike Shema introduces this year's conference coverage and highlights the latest conversations shaping application security. He also discusses Application Security Weekly, covering emerging threats and ...

Application Security

OWASP Global AppSec: Cybersecurity industry overdue for a ‘market correction’

Today's Top AppSec Headlines

UK retailers face surge in cyberattacks ahead of holiday shopping season

Threat actors abuse GSocket to maintain persistent access to linux servers

Notion discloses data exposure following security breach at AI vendor

Interviews from OWASP Global AppSec USA 2025

OWASP 2025 Wrap-Up: Community, AI Security, and the Future of AppSec – Avi Douglen – OWSP25 #2

The future of CycloneDX and software transparency – Steve Springett – OWSP25 #2

From Transparency to Trust: Shaping AI Security with OWASP AIBOM & AI Exchange – Aruneesh Salhotra – OWASP25 #2

AIVSS: Do we need a new Risk Management Approach in the era of Agentic AI? – Ken Huang – OWASP25 #2

Threat Modeling and The Four Question Framework – Adam Shostack – OWSP25 #1

Secure Coding in the Age of AI – James Manico – OWSP25 #1

Security Champions: You Already Have Them! How to Tap Their Potential – Dustin Lehr – OWSP25 #1

Beyond the Firewall: Why Traditional Web Security Still Matters in the AI Era – Felipe Zipitria – OWSP25 #1

Use OWASP SAMM for CRA compliance – Sebastien Deleersnyder – OWSP25 #1

CyberRisk TV Live from OWASP Global AppSec 2025 – Allan Friedman – OWSP25 #1

GenAI Security From Assessment to Action – Sandy Dunn – OWSP25 #1

Agentic Security Risks – John Sotiropoulos – OWSP25 #1

Application Security: Explained and Explored

Your AI pilot needs an offboarding plan

The shift from SDLC to ADLC: How the human role is changing in software development

OWASP Global AppSec: How to hide prompt injection in plain sight

Application Security News

ConnectWise investigating reports of unauthorized access to third-party extensions

Beyond the LLM Top 10: Putting AI security into practice – Scott Clinton – OWSP26 #1

The Primacy of Human Expertise in AI Cybersecurity – Andrew Wesie – OWSP26 #1

NVIDIA and Ory Bring Defense-in-Depth Security to AI Agents

OWASP Global AppSec 2026: Key Takeaways and AppSec Conversations – OWSP26 #1

Modelling for Agentic Failure: When Attack Trees Meet Safety Engineering – Petra Vukmirovic – OWSP26 #1

Model Context Points of Failure: MCP Security Meets Scale – Moshe Siman Tov Bustan – OWSP26 #1

How to Scale AI Agent Identity and Authentication Infrastructure

Context Confusion Is the New Broken Access Control – Anusha Vajha – OWSP26 #1

OWASP Global AppSec 2026 Preview: Insights, Interviews & AppSec Trends – OWSP26 #1

Fast Five

Selected by the SC Media Editorial team every Tuesday.

AppSec Events

Bridging the Gap from CISO-Developed Tools to Black Hat Hype: What AI Security Leaders Should Watch Next

Protecting Application User Data for Better Privacy, Governance, and Compliance

Scaling secure software in the age of AI: Turning intelligence into action