i
ITSPmagazine Blog — By Sean and Marco
43 articles matching · page 1 of 2
From Attacker's Weapon to Everyday Baseline: How AI Took Over the Archive
AI went from 2% of archive posts in 2022 to 32% in 2025, but the shift is toward governing and living with it, not offense overtaking defense.
Agentic Security Changes Everything | An On Location Conversation at Infosecurity Europe 2026 with John Sotiropoulos and Rock Lambros
The window between initial access and the next attacker move has collapsed from eight hours to twenty-two seconds, and no human-paced incident response process survives that math. John Sotiropoulos and Rock Lambros close out a day of OWASP GenAI Security work at Infosecurity Europe 2026 with the launch of an Agentic Se
Building a Real Security Culture: Why Most AppSec Champion Programs Fall Short | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 5 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9
Security champions were meant to bridge dev and AppSec—but most programs measure attendance, not outcomes. In this episode of AppSec Contradictions, Sean Martin explains why awareness isn’t culture, what research shows about champion success, and how to rebuild AppSec programs that actually reduce risk.
More Than Code: Why Human Skills Matter in AppSec | An OWASP AppSec Global 2025 Conversation with Maria Mora | On Location Coverage with Sean Martin and Marco Ciappelli
Maria Mora, Staff Application Security Engineer and OWASP events committee member, shares how contributing to the community has shaped her career and expanded both her technical and human skills. From first-time attendees to seasoned volunteers, this conversation highlights the power of showing up, getting involved, an
From Dashboards to Decisions: Why Your Security Metrics Might Be Leading You Astray | An OWASP AppSec Global 2025 Conversation with Aram Hovsepyan | On Location Coverage with Sean Martin and Marco Ciappelli
Aram Hovsepyan challenges the security industry’s overreliance on tool-generated vulnerability metrics and advocates for a goal-driven approach grounded in risk and business context. In this episode, he shares how organizations can shift from reactive dashboards to purposeful measurement strategies that truly support s
Why Global Community-Led Innovation Is Driving Real Application Security Progress | An OWASP AppSec Global 2025 Conversation with Starr Brown | On Location Coverage with Sean Martin and Marco Ciappelli
Starr Brown, Director of Open Source Projects and Programs at OWASP, shares how the organization’s global community is powering over 130 open source initiatives aimed at eliminating insecure software. From AI-focused security projects to interactive tools and policy-shaping efforts, this conversation reveals the scale
Turning AppSec into a Workflow, Not a Roadblock – Building Security Programs That Teams Actually Want to Use | An OWASP AppSec Global 2025 Conversation with Spyros Gasteratos | On Location Coverage with Sean Martin and Marco Ciappelli
What if your AppSec program could be both deeply technical and deeply human? In this On Location episode from OWASP Global AppSec EU 2025 Conference, Spyros Gasteratos shares how automation, open-source tools, and community collaboration can unify fragmented efforts and turn security into a strategic advantage, not a b
The API That Could Transform Software Transparency | An OWASP AppSec Global 2025 Conversation with Olle E Johansson | On Location Coverage with Sean Martin and Marco Ciappelli
Olle E Johansson shares how Europe’s Cyber Resilience Act is transforming the software industry by making manufacturers responsible for the security of their products—and how automation through the Transparency Exchange API can help meet that demand. Learn how this OWASP-backed project is reshaping supply chain transpa
Redefining What Secure Application Development Looks Like: Bringing Application Security into Focus with ASVS v5 | An OWASP AppSec Global 2025 Conversation with Josh Grossman | On Location Coverage with Sean Martin and Marco Ciappelli
Josh Grossman, co-leader of the OWASP ASVS project, shares how version 5 makes secure application development more accessible, actionable, and aligned with real-world engineering workflows. If you’re building or managing software security programs, this episode offers practical insight into how ASVS can become your fou
Outside the Ivory Tower: Connecting Practice and Science — Why Human-Centered Cybersecurity Needs Both | OWASP AppSec Global 2025 Pre-Event Keynote Conversation with Kate Labunets | On Location Coverage with Sean Martin and Marco Ciappelli
In this On Location episode, Kate Labunets explores how bridging the gap between cybersecurity research and real-world practice can lead to more effective, human-centered security solutions. In this conversation, she shares how understanding employee behavior—like shadow IT use—can inform better policies, communication
Building, Breaking, Defending: Inside a Global AppSec Movement | OWASP AppSec Global 2025 Pre-Event Conversation with Avi Douglen | On Location Coverage with Sean Martin and Marco Ciappelli
This On Location episode offers a firsthand look at what makes a tight-knit application security community so impactful, especially when the conversations go beyond tools and tactics to focus on real collaboration and growth. From AI risks to culture shifts, you’ll hear what to expect at this year’s global gathering an
Hackers, Policy, and the Future of Cybersecurity: Inside The Hackers’ Almanack from DEF CON and the Franklin Project | A Conversation with Jake Braun | Redefining CyberSecurity with Sean Martin
The latest OWASP Top 10 for LLMs reveals the biggest security risks in AI, from prompt injection and supply chain vulnerabilities to emerging threats like system prompt leakage. In this episode, Sandy Dunn and Rock Lambros break down the 2025 updates, explain why LLM security is unlike traditional software risks, and s
The 2025 OWASP Top 10 for LLMs: What’s Changed and Why It Matters | A Conversation with Sandy Dunn and Rock Lambros | Redefining CyberSecurity with Sean Martin
The latest OWASP Top 10 for LLMs reveals the biggest security risks in AI, from prompt injection and supply chain vulnerabilities to emerging threats like system prompt leakage. In this episode, Sandy Dunn and Rock Lambros break down the 2025 updates, explain why LLM security is unlike traditional software risks, and s
Book | The Developer's Playbook for Large Language Model Security: Building Secure AI Applications | A Conversation with Steve Wilson | Redefining CyberSecurity with Sean Martin
In this episode of The Redefining CyberSecurity Podcast, join host Sean Martin and Chief Product Officer, Steve Wilson, as they explore the intricacies of developing secure AI applications and the unique challenges posed by large language models. Discover actionable insights and frameworks, including Wilson's Responsib
The Missing Link: How We Collect and Leverage SBOMs | An OWASP 2024 Global AppSec San Francisco Conversation with Cassie Crossley | On Location Coverage with Sean Martin and Marco Ciappelli
Join Sean Martin and Marco Ciappelli as they sit down with Cassie Crossley at the OWASP Global AppSec conference in San Francisco to explore the critical role of Software Bill of Materials (SBOMs) in securing applications. Dive into an engaging discussion on how SBOMs can help manage software risks, even for smaller co
OWASP Top 10 For Large Language Models: Project Update | An OWASP 2024 Global AppSec San Francisco Conversation with Steve Wilson | On Location Coverage with Sean Martin and Marco Ciappelli
In this On Location episode, Sean Martin and Steve Wilson, Project Lead for the OWASP Top 10 for Large Language Model AI Applications, discuss the newest security challenges revolving around large language models (LLMs) and the significant insights from the OWASP Top 10 project. Learn about the key issues like prompt i
Traceability in Cyber Security: Lessons Learned from the Medical Sector | A Conversation with Kostas Papapanagiotou | Redefining CyberSecurity with Sean Martin
In this episode of the Redefining CyberSecurity Podcast, host Sean Martin talks with Kostas Papapanagiotou about the critical importance of holistic cybersecurity practices for medical devices and the role of regulatory bodies like the FDA. Kostas shares valuable insights on shared responsibility, proactive threat mode
Punch Cards, Steam Engines, 48 Volt Batteries, Platform Engineering, and the AI Revolution: The Ongoing Evolution of Language-Based Software Development | An OWASP AppSec Global Lisbon 2024 Conversation with Oleg Shanyuk | On Location Coverage
Join Sean Martin and Oleg Shanyuk at the OWASP AppSec Global conference as they delve into the transformative impact of AI on application security, development processes, and platform engineering. This episode offers nuanced perspectives on the balance between technological innovation and practical efficiency, making i
From Theory to Process to Practice: Cracking Mobile and IoT Security and Vulnerability Management | An OWASP AppSec Global Lisbon 2024 Conversation with Abraham Aranguren | On Location Coverage with Sean Martin and Marco Ciappelli
Sean Martin sits down with Abraham Aranguren at the OWASP AppSec Global event to explore the complexities of mobile application security and effective strategies for identifying vulnerabilities. Tune in to hear real-world examples, actionable insights, and best practices for building and maintaining secure mobile apps.
Winning Buy-In: Mastering the Art of Communicating (the Value of) Security (Culture) to Management | An OWASP AppSec Global Lisbon 2024 Conversation with Ida Hameete | On Location Coverage with Sean Martin and Marco Ciappelli
In this episode of On Location, Sean Martin sits down with Ida Hameete at the OWASP Global AppSec Conference to explore how fostering a security culture within organizations can drive both security and business success. Discover practical insights on aligning security practices with company values and gaining executive
It's Just Software, What Could Possibly Go Wrong? Exploring Deterministic GenAI and AI Trust Cards | An OWASP AppSec Global Lisbon 2024 Conversation with Isabel Praça, Dinis Cruz, and Rob van der Veer | On Location Coverage
Join Sean Martin as he dives into a lively discussion with AI and cybersecurity leaders about the intersection of artificial intelligence and application security at the upcoming OWASP AppSec Global conference in Lisbon. Discover how AI is reshaping cybersecurity practices and why interdisciplinary collaboration is cru
In the Same Site We Trust: Navigating the Landscape of Client-side Request Hijacking on the Web | An OWASP AppSec Global Lisbon 2024 Conversation with Soheil Khodayari | On Location Coverage with Sean Martin and Marco Ciappelli
Join Sean Martin as he dives into the evolving landscape of web security with Soheil Khodayari, a leading security researcher, as they discuss the intricacies of request forgery attacks and the innovative defenses against them. Discover key insights and practical advice ahead of Soheil's session at OWASP Global AppSec
Practical Privacy by Design - Building Secure Applications that Respect Privacy | An OWASP AppSec Global Lisbon 2024 Conversation with Kim Wuyts and Avi Douglen | On Location Coverage with Sean Martin and Marco Ciappelli
Join host Sean Martin as he delves into the OWASP AppSec Lisbon event with guests Kim Wuyts and Avi Douglen, who explore the vital integration of privacy and security in application development. Discover how privacy by design and threat modeling can enhance your organization's security posture and ensure compliance.
Leaning in on ISO 5338, ISO 27090/27091, and the OWASP AI Exchange to Build Secure and Responsible AI Systems: Balancing Innovation and Ethical Boundaries | A Conversation with Rob van der Veer | Redefining CyberSecurity Podcast with Sean Martin
In this episode of the Redefining CyberSecurity podcast, host Sean Martin and AI expert Rob van der Veer dive into the intersection of engineering AI systems and security, discussing the risks, regulations, and ethical considerations in leveraging AI for business growth and data protection.