Application Security Weekly (Audio) · Security Weekly Productions

More WAFs in Blocking Mode and More Security Headaches from LLMs - Sandy Carielli, Janet Worthington - ASW #326

·1 hr 15 min·5 clips

5.4 billion records were stolen in 2024—more than triple the previous year's breaches.

Sandy Carielli and Janet Worthington, principal and senior analysts at Forrester, join the hosts to discuss lessons from 2024 breaches and evolving application security tools. They analyze the year's major security incidents and offer advice for improving defenses in 2025. Janet Worthington reveals that 5.4 billion records were stolen in the top 35 breaches of 2024, more than triple the previous year's total. She notes that privacy fines reached 3.1 billion dollars and highlights how healthcare breaches caused service disruptions like diverted ambulances and canceled surgeries. The Snowflake incident, affecting over 100 customers, is cited as an example where a lack of enforced multi-factor authentication on admin accounts was a critical factor. Sandy Carielli discusses the evolution of web application firewalls into unified protection platforms that now bundle bot management, API security, and client-side protection. She observes that customers are now deploying WAFs in blocking mode within weeks, a significant shift from past practices where they were often left in alert-only mode. The analysts emphasize that while tools like WAFs are important, they are layers of defense that can be bypassed, underscoring the need for secure-by-design principles from the start of development. A surprising insight is the concept of "slop squatting," where AI coding assistants hallucinate and recommend non-existent software packages, which attackers can then create and populate with malicious code. Janet Worthington explains that some software composition analysis tools now act as a "package firewall," using behavioral analysis and AI to block malicious packages from entering the development pipeline at the central repository level. Sandy Carielli states that "AI WAFs" designed to protect against threats like prompt injection are on the roadmaps of most WAF vendors and will likely become integrated into broader protection platforms. The tone is conversational and educational, blending analyst expertise with practical examples from recent security events. This episode is ideal for application security professionals, DevSecOps practitioners, and security leaders seeking data-driven insights on breach trends and the integration of new technologies like AI into the security toolchain. Listeners looking for highly technical, deep-dive tutorials on specific vulnerabilities or coding techniques might find the discussion too strategic.

As heard by us

Grounded AppSec discussion that treats new threats carefully and does not oversell the fixes.

The episode takes a practical look at application security when budgets are tight. It keeps coming back to the same tradeoff: cut the work that does not change outcomes, and spend more time on passkeys and other controls that shut down whole classes of problems.

Read the full review in PlayNext →

Why you'd press play

You want a clear read on how orgs are responding to last year's breaches, WAFs, and Secure by Design.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Application Security Weekly (Audio)