i
ITSPmagazine Blog — By Sean and Marco
28 articles matching · page 1 of 2
The Regulators Already Assume You Have an AI Inventory. Can You Prove It?
A look at the governance gap between compliance reports and ground truth, why SAST and SCA miss the AI supply chain, and what deterministic discovery of models, MCP servers, and agents actually requires.
The Hidden Risk Inside Your Build Pipeline: When Open Source Becomes an Attack Vector | A Conversation with Paul McCarty | Redefining CyberSecurity with Sean Martin
Malicious open source packages are no longer edge cases. They are deliberate, scalable attack paths targeting developers, CI pipelines, and the software supply chain itself.
Building a Real Security Culture: Why Most AppSec Champion Programs Fall Short | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 5 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9
Security champions were meant to bridge dev and AppSec—but most programs measure attendance, not outcomes. In this episode of AppSec Contradictions, Sean Martin explains why awareness isn’t culture, what research shows about champion success, and how to rebuild AppSec programs that actually reduce risk.
CI/CD Pipeline Security: Why Attackers Breach Your Software Pipeline and Own Your Build Before Production | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 4 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9
Attackers don’t need to breach production—they’re owning the CI/CD pipeline long before code goes live. Sean Martin unpacks why cloud and build systems remain the weakest links, the data proving it, and what teams can do to restore delivery integrity.
The Hidden Cost of Too Many Cybersecurity Tools (Most CISOs Get This Wrong) | A Conversation with Pieter VanIperen | Redefining CyberSecurity with Sean Martin
Pieter VanIperen, Chief Information Security and Technology Officer at AlphaSense, shares what it really means to simplify security by focusing on context, value, and relevance—not volume or complexity. This conversation challenges the assumptions vendors make and offers real-world principles that security leaders can
SBOMs in Application Security: From Compliance Trophy to Real Risk Reduction | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 3 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9
SBOMs promised to be the ingredient label for software, accelerating response and boosting trust. But adoption lags: less than 1% of GitHub repos use them, only 15% of developer questions get resolved, and fewer than half of EU firms fund supply chain programs. In this episode, Sean Martin breaks down the contradiction
AI in Application Security: Why False Positives Still Overwhelm Teams Despite the Hype | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 1 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9
In this first AppSec Contradictions episode, Sean Martin reveals how AI-powered tools—meant to reduce risk—often amplify false positives, overwhelm analysts with alert fatigue, and erode trust across developers, security teams, and business leaders.
From Dashboards to Decisions: Why Your Security Metrics Might Be Leading You Astray | An OWASP AppSec Global 2025 Conversation with Aram Hovsepyan | On Location Coverage with Sean Martin and Marco Ciappelli
Aram Hovsepyan challenges the security industry’s overreliance on tool-generated vulnerability metrics and advocates for a goal-driven approach grounded in risk and business context. In this episode, he shares how organizations can shift from reactive dashboards to purposeful measurement strategies that truly support s
Holding the Line on Quality in an AI-Driven SDLC | An OWASP AppSec Global 2025 Conversation with Sarah-Jane Madden | On Location Coverage with Sean Martin and Marco Ciappelli
Sarah-Jane Madden shares a practical and passionate take on how AI can enhance—not replace—secure software development, urging developers and business leaders alike to rethink how they balance speed, quality, and security. From architecture to code to culture, she challenges us to embrace change without leaving critica
Turning AppSec into a Workflow, Not a Roadblock – Building Security Programs That Teams Actually Want to Use | An OWASP AppSec Global 2025 Conversation with Spyros Gasteratos | On Location Coverage with Sean Martin and Marco Ciappelli
What if your AppSec program could be both deeply technical and deeply human? In this On Location episode from OWASP Global AppSec EU 2025 Conference, Spyros Gasteratos shares how automation, open-source tools, and community collaboration can unify fragmented efforts and turn security into a strategic advantage, not a b
Outside the Ivory Tower: Connecting Practice and Science — Why Human-Centered Cybersecurity Needs Both | OWASP AppSec Global 2025 Pre-Event Keynote Conversation with Kate Labunets | On Location Coverage with Sean Martin and Marco Ciappelli
In this On Location episode, Kate Labunets explores how bridging the gap between cybersecurity research and real-world practice can lead to more effective, human-centered security solutions. In this conversation, she shares how understanding employee behavior—like shadow IT use—can inform better policies, communication
Building, Breaking, Defending: Inside a Global AppSec Movement | OWASP AppSec Global 2025 Pre-Event Conversation with Avi Douglen | On Location Coverage with Sean Martin and Marco Ciappelli
This On Location episode offers a firsthand look at what makes a tight-knit application security community so impactful, especially when the conversations go beyond tools and tactics to focus on real collaboration and growth. From AI risks to culture shifts, you’ll hear what to expect at this year’s global gathering an
Resilience Is the Destination, Innovation Is the Path | An RSAC Conference 2025 Conversation | On Location Coverage with Sean Martin and Marco Ciappelli
Sean Martin and Marco Ciappelli walk the buzzing RSAC 2025 show floor to reflect on the real conversations shaping cybersecurity today—from quantum resilience and AI integration to the steady rise of zero trust and DevSecOps. With dozens of interviews recorded and more content on the way, this episode gives a quick but
From Code to Confidence: The Role of Human Factors in Secure Software Development | Human-Centered Cybersecurity Series with Co-Host Julie Haney and Guest Kelsey Fulton | Redefining CyberSecurity with Sean Martin
This episode explores the critical role of human factors in secure software development, featuring Dr. Kelsey Fulton’s insights on integrating security into the development lifecycle through collaboration, education, and thoughtful tool design. Discover how developers can overcome common challenges and shift towards a
The Missing Link: How We Collect and Leverage SBOMs | An OWASP 2024 Global AppSec San Francisco Conversation with Cassie Crossley | On Location Coverage with Sean Martin and Marco Ciappelli
Join Sean Martin and Marco Ciappelli as they sit down with Cassie Crossley at the OWASP Global AppSec conference in San Francisco to explore the critical role of Software Bill of Materials (SBOMs) in securing applications. Dive into an engaging discussion on how SBOMs can help manage software risks, even for smaller co
OWASP Top 10 For Large Language Models: Project Update | An OWASP 2024 Global AppSec San Francisco Conversation with Steve Wilson | On Location Coverage with Sean Martin and Marco Ciappelli
In this On Location episode, Sean Martin and Steve Wilson, Project Lead for the OWASP Top 10 for Large Language Model AI Applications, discuss the newest security challenges revolving around large language models (LLMs) and the significant insights from the OWASP Top 10 project. Learn about the key issues like prompt i
Punch Cards, Steam Engines, 48 Volt Batteries, Platform Engineering, and the AI Revolution: The Ongoing Evolution of Language-Based Software Development | An OWASP AppSec Global Lisbon 2024 Conversation with Oleg Shanyuk | On Location Coverage
Join Sean Martin and Oleg Shanyuk at the OWASP AppSec Global conference as they delve into the transformative impact of AI on application security, development processes, and platform engineering. This episode offers nuanced perspectives on the balance between technological innovation and practical efficiency, making i
From Theory to Process to Practice: Cracking Mobile and IoT Security and Vulnerability Management | An OWASP AppSec Global Lisbon 2024 Conversation with Abraham Aranguren | On Location Coverage with Sean Martin and Marco Ciappelli
Sean Martin sits down with Abraham Aranguren at the OWASP AppSec Global event to explore the complexities of mobile application security and effective strategies for identifying vulnerabilities. Tune in to hear real-world examples, actionable insights, and best practices for building and maintaining secure mobile apps.
Winning Buy-In: Mastering the Art of Communicating (the Value of) Security (Culture) to Management | An OWASP AppSec Global Lisbon 2024 Conversation with Ida Hameete | On Location Coverage with Sean Martin and Marco Ciappelli
In this episode of On Location, Sean Martin sits down with Ida Hameete at the OWASP Global AppSec Conference to explore how fostering a security culture within organizations can drive both security and business success. Discover practical insights on aligning security practices with company values and gaining executive
It's Just Software, What Could Possibly Go Wrong? Exploring Deterministic GenAI and AI Trust Cards | An OWASP AppSec Global Lisbon 2024 Conversation with Isabel Praça, Dinis Cruz, and Rob van der Veer | On Location Coverage
Join Sean Martin as he dives into a lively discussion with AI and cybersecurity leaders about the intersection of artificial intelligence and application security at the upcoming OWASP AppSec Global conference in Lisbon. Discover how AI is reshaping cybersecurity practices and why interdisciplinary collaboration is cru
In the Same Site We Trust: Navigating the Landscape of Client-side Request Hijacking on the Web | An OWASP AppSec Global Lisbon 2024 Conversation with Soheil Khodayari | On Location Coverage with Sean Martin and Marco Ciappelli
Join Sean Martin as he dives into the evolving landscape of web security with Soheil Khodayari, a leading security researcher, as they discuss the intricacies of request forgery attacks and the innovative defenses against them. Discover key insights and practical advice ahead of Soheil's session at OWASP Global AppSec
Practical Privacy by Design - Building Secure Applications that Respect Privacy | An OWASP AppSec Global Lisbon 2024 Conversation with Kim Wuyts and Avi Douglen | On Location Coverage with Sean Martin and Marco Ciappelli
Join host Sean Martin as he delves into the OWASP AppSec Lisbon event with guests Kim Wuyts and Avi Douglen, who explore the vital integration of privacy and security in application development. Discover how privacy by design and threat modeling can enhance your organization's security posture and ensure compliance.
Pentesting Done Right | It's Time To Re-Imagine Your Penetration Testing Program To Achieve Outcomes Over Activity | A Bugcrowd Brand Story With Justin Kestelyn
Traditional penetration testing has been a cornerstone of effective cybersecurity for decades, providing a vital baseline function for every security practice. But in the face of today's rapidly proliferating and diversifying cyberattacks, its consulting-heavy service delivery model is looking and feeling its age.
Everything Is Driven By Code And Code Is Controlled By APIs: Taking Application Security To The Next Level Through Research, Assessments, Scanning, And Training | A Checkmarx Origin Brand Story With Renny Shen And Bryant Schuck
Application development has become an extremely complex endeavor, and the only thing more complex than building an advanced application is securing it. But it doesn't need to be that way.