Topics / Application & Cloud Security
Application & Cloud Security Podcasts
5 shows and 2,578 episodes sit under Application & Cloud Security.
The best application and cloud security podcasts in 2026: secure design, DevSecOps, supply chain risk, API security, cloud posture, and AI-assisted code review
Photo: A Perry on Unsplash · Unsplash License
Swipe · Application & Cloud Security only
Swipe through Application & Cloud Security
Save time discovering your next favourite podcast by listening to just the best minute of an episode.
The application & cloud security slate · every cover a link
All 5 application & cloud security shows →
Next to this on the shelf
Explore by subtopic
A field guide
What Application & Cloud Security podcasts actually cover
The useful conversations begin where software design meets operational reality: permissions, dependencies, mobile clients, cloud visibility, and the awkward question of who owns the risk after deployment. Some episodes stay close to code. Others follow an application outward into networks, vendors, and executive decisions.
For the wider field, move up to Cybersecurity. Penetration Testing follows the people actively probing defenses, while Threat Intelligence & News tracks campaigns and emerging incidents. For training and professional development, prefer the Security Careers & Learning page.
Secure design before cleanup
Application Security Weekly (Audio) is the sharpest starting point for software teams. Its agenda reaches from In Search of Secure Design - ASW #325 to Avoiding Appsec's Worst Practices - ASW #324, with little patience for treating security as a final release gate.
The show also keeps pace with newer engineering problems. AppSec News Roundup on Claude Code Leak, Axios NPM Compromise, Secure Design - Idan Plotnik, Raj Mallempati - ASW #377 places AI tooling, package compromise, and design in the same briefing. For a standards-oriented entry, choose Securing Software's Journey with the OWASP SPVS - Ido Geffen, Rohan Ravindranath, Cameron W., Farshad Abasi - ASW #378.
Beyond the repository
Security Weekly Podcast Network (Audio) widens the frame without losing the technical thread. Defense-in-depth strategies for securing mobile applications - Ryan Lloyd - ASW #390 is the direct mobile-security route; Cloud Visibility, Fortibleed, hacking things the easy way - Sandy Bird - PSW #932 points toward cloud operations and exposed infrastructure.
Fortinet Cybersecurity Podcast takes a more measured, business-facing approach. Its question-led interviews translate specialist language for listeners who need consequences and decisions made clear. Fortinet ON AIR S1EP1 - Building Simplicity, Security, and Scale into the Future of Networking suits that audience, while Fortinet ON AIR S1EP3 - GenAI Isn't Just a Tool-It's a New Attack Surface brings AI into the security boundary.
When software risk reaches the boardroom
Supply-chain failures receive an executive treatment on CISO Insights: Voices in Cybersecurity. Start with The Digital Siege: Supply Chain Poisoning and the New Era of Cyber Warfare or the more pointed The Illusion of Trust: Fake Compliance and the LiteLLM Hack.
Redefining CyberSecurity sits nearby, especially when AI workflows blur the line between application behavior and organizational risk. Task by Task: The Workflows We're Handing to AI - One Decision at a Time | Lens Four by Sean Martin | Read by TAPE9 makes the route explicit.
Where to start
Developers should begin with Application Security Weekly (Audio) and its secure-design episodes. Choose Security Weekly Podcast Network (Audio) for mobile and cloud attack surface, or Fortinet Cybersecurity Podcast when the discussion needs to travel cleanly from technical teams to leadership. For supply-chain risk in executive language, try CISO Insights: Voices in Cybersecurity.
Featured shows below are part of the PlayNext catalog. Updated weekly.
Recommended clips
The strongest Application & Cloud Security clips
The highest-scoring 60-second moments anywhere in application & cloud security, one per show.
Drawn from 84 playable clips across 5 shows.
New on PlayNext
Just added to Application & Cloud Security
The newest application & cloud security clips in the library, one per show — ordered by when the clip was made, not when the episode came out.
10 clips, one per show, added between 2026-08-10 and 2026-09-04.
Featured shows
5 shows, described rather than listed
Each has a short write-up and a note on what it does best here.
The practical center of this hub: secure design, dependency risk, and code-to-release decisions — OWASP SPVS, AI-assisted review, and more.
Where AppSec meets compliance and AI-assisted code analysis — supply chain risk, CMMC, and DevSecOps in the same planning cycle.
Essay-format episodes that land directly on the weak points AppSec programs keep revisiting: CI/CD pipelines, SBOMs, threat modeling, and champion programs.
Measured, explanatory, interview-centric — the most executive-practitioner feel in the cloud slice, with sector-specific cloud security framing.
For deciding which code, cloud, and vendor risks deserve attention: DevSecOps blueprints, CSPM evolution, and supply chain leadership calls.
Where to start
4 routes in, one per reader
Start with 'AppSec News Roundup on Claude Code Leak, Axios NPM Compromise, Secure Design' — a live example of dependency risk and secure design in one episode.
'Ep. 77: Interactive Application Security Testing' and 'Ep. 55: Scoping an application security assessment' are plain, foundational, and durable.
'Orchestrating Security: The DevSecOps Blueprint for 2025' and 'Beyond CSPM: The Cloud Security Evolution' frame the ownership question more than the technical one.
'Analyzing Supply Chain Risk in Mobile Applications for Home Energy Storage Systems' and 'Dissecting the Software Supply Chain of Modern Industrial Control Systems' pull AppSec into hardware and energy contexts.
Glossary
Jargon you'll hear on Application & Cloud Security podcasts
A machine-readable inventory of software components and dependencies used in a build — increasingly required by regulators and procurement as a supply chain transparency tool.
A development practice that integrates security testing, access controls, and compliance checks into the CI/CD pipeline rather than treating security as a release gate.
A consensus list of the ten most critical web application security risks, maintained by the Open Web Application Security Project and widely used as an AppSec training and audit baseline.
A category of tooling that continuously assesses cloud environments for misconfigurations, policy violations, and compliance gaps — designed to close the gap between provisioning speed and security review.
An intrusion that compromises a target indirectly through a trusted upstream component — a compromised npm package, a poisoned CI/CD action, or a vendor with excess access.
A structured approach to identifying what could go wrong in a system, who might exploit it, and what mitigations are worth the cost — done at design time rather than after deployment.