Application security, talked through by colleagues and their guests
Application Paranoia combines colleagues catching up with guest interviews: Colin Bell, Rob Cuddy and Chris swap news about vacations, holiday lights and graduations before the guest conversation begins. The guest conversations cover biometrics, coding standards, software supply chain risk, cloud security and elections.
PRESS PLAY
Application Paranoia is an application security show built around a steady ritual. Episodes open by stating their own season and episode number. Colin Bell then introduces Rob Cuddy and Chris, with a new adjective for them each time. They have been intelligent, buzzing, valued, authentic, unvarnished and amazing. It is a small joke, but it sets the tone. Before the guest conversation starts, the colleagues catch up: graduation season, a Christmas lights display kept short of over-the-top, a drive to Scotland to see castles and distilleries, and a floor repair at a parents' mobile home that turned into a roof job. Then the guest conversation takes over, and it tends to get specific. Tanya Janca, welcomed back as a returning guest, appears in an episode with a story about a developer's first encounter with an 80-page coding standard and the quick lesson that parameterized queries beat inline SQL. The digital identity episode with Kinny Chan explains authentication in everyday terms. Two-factor login is described as something you know plus something you have, and walking gait is offered as a different biometric modality. The same conversation stresses explaining technology simply enough for a parent or a 12-year-old to follow. Mike Khusid, introduced as the new head of product management for AppScan, appears in a trends episode covering software supply chain, the move toward a single platform view, posture management and AI. One observation stands out: posture management went from a term nobody used to one every vendor at the events seemed to be talking about, all within about a year. The episode with Ken Fanger, whom Colin calls a brilliant campaigner, is about humanizing security. It includes the story of a hacked Instagram account messaging every contact to ask for money, and of friends texting each other to ask whether it was real. The application modernization episode with Soloman Barghuothi questions the belief that data kept in your own data center is automatically safe, and it offers a vivid analogy: the safest safe in the world is useless if it is left open. Elsewhere, 'Cyber Security and Elections with Dr. Michael Owens' takes the show beyond code. Two episode titles mention words of the year, and another carries a May the 4th greeting, so the calendar tends to show up. In season six, episode one, the three note that they are recording in the same room rather than spread across the globe. The sign-offs are loose and affectionate, with a joke about all going to Ireland next time and, at the end of a holiday episode, an open invitation for would-be guests to get in touch on Twitter. What a listener gets is application security delivered with a relaxed, friendly ease: technical enough to name the query pattern, and relaxed enough to stop for a story about a roof.
Made for: Suits a listener who wants application security explained through stories and plain analogies rather than slides, and who does not mind a detour through castles or Christmas lights on the way to the technical point.
What sets it apart: It has its own ritual: a season-and-episode ident, a fresh adjective for the colleagues every time, and a catch-up before the guest. It is openly tied to AppScan, yet its guest conversations go well beyond the product, into biometrics, elections and the human side of security.
A podcast about Application Security DevSecOps and AppScan. Twice a month, we aim to bring you some technical insights, assorted facts and the latest news from the world of HCL AppScan. Our underlying mission is to deliver continuous application security to the masses.
A static scan that took days for one app: suddenly your backlog has company.
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A lively, accessible look at passwords, biometrics, and how systems try to prove identity.
Application Paranoia opens Season 6 by turning identity and authentication into something practical rather than abstract. The conversation moves from usernames, passwords, and one-time passcodes into biometric signals such as facial recognition, walking gait, palm readers, and…
A practical look at security guardrails, from 80-page standards to 20 findings worth fixing.
Application Paranoia frames developer experience as a practical security concern, with Tanya making the case that guardrails work best when they make the safer path easier to follow.
A practical security discussion about AI trust, software supply chains, and the hidden risks inside depended-on code.
Application Paranoia begins Season 5 with a grounded conversation about application security, AppScan, AI trust, software supply chains, and posture management.
A year-end security episode that connects incident response with the harder work of helping people feel safe online again.
Application Paranoia's year-end episode starts with a casual swing through Christmas lights, then settles into a sharper question: what happens to people after a security incident is technically contained?
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
Application Paranoia Season 6 opens with Colin Bell, Rob Cuddy, and Chris Stewart introducing a season built around 10 myths about application security and a recorded interview with Kenny Chan.
["Application Paranoia S5E3 brings back Tanya Janca with Colin Bell, Chris Durer, and Rob Cuddy, and it opens with Time Magazine's 2024 words like 'enshitification,' 'bed rotting,' and 'girl dinner.'", "Colin Bell introduces Tanya as SheHacksPurple, author of Alice and Bob Learn Application Security, founder of WeHackPurple, and Semgrep's head of education.", "Tanya argues that appsec has moved past the old 'Department of No' era, but many teams still have SAST and DAST only clearing the most critical findings.", "Her practical advice centers on IDE guardrails, fix guidance tied to findings, and threat modeling and training at the start of the lifecycle."]
Application Paranoia opens Season 5 with Mike Cusett, the new head of product management for AppScan, discussing six application-security trends with Colin Bell, Chris Dewar, and Rob Cuddy.
Application Paranoia S4EP7 features Colin Bell, Rob Cuddy, Chris Stewart, and cybersecurity speaker Ken Fanger discussing “humanizing security” through real incidents and practical responses.
Solomon Bargufi frames digital transformation around three outcomes: reducing operational cost, increasing revenue, and improving user experience.
Hosts discuss recent vacations and introduce a guest expert in application security.
Hosts discuss recent events and introduce an interview with the CISO of Taco Bell about application security.
This episode features an interview with Vandana Verma, Vice Chairman of OWASP Global Board, discussing application security and DevSecOps.
The hosts discuss the release of AppScan 10.0.2 and share best practices, with a planned interview with a sports broadcaster.