Application Security

Mastering Application Security: Your Resource for Secure Development, Testing, Code Analysis, and More.

Content Partnership: OWASP Logo SC Media Logo

AI agent data tools and workflow automation concept with businessman typing on laptop and interacting with digital process interface for artificial intelligence development, integration, productivity

OWASP launches FinBot to help developers secure AI agents

OWASP GenAI Security Project Team May 28, 2026

OWASP’s FinBot gives developers hands-on training to secure AI agents.

Today's Top AppSec Headlines

Interviews from OWASP Global AppSec USA 2025

Training
OWASP 2025 Wrap-Up: Community, AI Security, and the Future of AppSec – Avi Douglen – OWSP25 #2
Supply chain
The future of CycloneDX and software transparency – Steve Springett – OWSP25 #2
AI/ML
From Transparency to Trust: Shaping AI Security with OWASP AIBOM & AI Exchange – Aruneesh Salhotra – OWASP25 #2
Risk Assessments/Management
AIVSS: Do we need a new Risk Management Approach in the era of Agentic AI? – Ken Huang – OWASP25 #2
Application security
Threat Modeling and The Four Question Framework – Adam Shostack – OWSP25 #1
AI/ML
Secure Coding in the Age of AI – James Manico – OWSP25 #1
Leadership
Security Champions: You Already Have Them! How to Tap Their Potential – Dustin Lehr – OWSP25 #1
AI/ML
Beyond the Firewall: Why Traditional Web Security Still Matters in the AI Era – Felipe Zipitria – OWSP25 #1
Governance, Risk and Compliance
Use OWASP SAMM for CRA compliance – Sebastien Deleersnyder – OWSP25 #1
Training
CyberRisk TV Live from OWASP Global AppSec 2025 – Allan Friedman – OWSP25 #1
Application security
GenAI Security From Assessment to Action – Sandy Dunn – OWSP25 #1
Application security
Agentic Security Risks – John Sotiropoulos – OWSP25 #1

Application Security: Explained and Explored

Application Security News

Glowing server core sits inside transparent cube on circuit board. Digital data streams flow, suggesting network security protection. Futuristic tech concept for system defense.

Application security

Docker security scanner uses AI to help explain, fix vulnerabilities

Stephen WeigandJune 12, 2026

AI-powered DockSec helps developers prioritize, understand and fix software vulnerabilities.

Application security

Scanner Results Are a Starting Point. Here’s What Comes Next. – Federico Kirschbaum – ASW #386

June 9, 2026

Most AppSec teams are working through more findings than their teams can validate. SAST surfaces thousands of potential issues. DAST generates alert volume that outpaces triage capacity. Somewhere in that output are the vulnerabilities that matter, the ones that are actually exploitable in production. This conversation explores why automated testin...

Application security

BadHost, Dead CTFs, Exploding NPMs, and the Verizon DBIR – ASW #385

June 2, 2026

We dedicate an episode to catching up on appsec news with Kalyani Pawar. We see parsing problems that led to the BadHost vuln, which exposed lots of LLMs, MCPs, and agents to potential compromise. We wonder where to look for security education and practice as the camaraderie of the CTF community becomes infiltrated by LLMs. We talk about the tradeo...

A user interacts with a laptop, surrounded by holographic icons representing security and digital privacy. This image captures modern technology in action.

AI/ML

How to defend at machine speed: A post-LLM era playbook

Picus SecurityJune 1, 2026

AI-era attacks now move at machine speed, forcing defenders to rethink validation and response.

Application security

AppSec Conversations on Agents, LLMs, and OWASP from RSAC – Scott Clinton, Janet Worthington, Merritt Maxim – ASW #384

May 26, 2026

We showcase recordings from this year's RSAC. At RSAC Conference 2026, Scott Clinton, Co-Chair and co-founder of the OWASP GenAI Security Project, shares insights from the project’s latest research, including new landscape guides and evolving approaches to securing generative and agentic AI systems. The conversation explores critical gaps in GenAI ...

(Credit: Araki Illustrations – stock.adobe.com)

Identity

New Mini Shai-Hulud attack targets npm ecosystem

Steve ZurierMay 20, 2026

Mini Shai-Hulud campaign hits 323 npm packages, GitHub Actions and VS Code tools.

Application security

The State of AI & AppSec – Keith Hoodlet – ASW #383

May 19, 2026

This year has been a dichotomy of established secure design fundamentals and burgeoning chaos of LLM-driven vuln discovery. Keith Hoodlet returns to share his latest observations on what the recent news about Mythos, models, and harnesses means for appsec. He walks through the problems of misalignment, the potential development doom that looms behi...