Conclusion: The End…of Season 1

What defined the first season of the Application Security Podcast? Chris and Robert revisit clips that established the show’s early themes: thinking like an attacker, building security community, practicing threat modeling, collaborating during penetration testing, learning reverse engineering, and finding a path into the profession. Adam Shostack explains why “think like an attacker” can exclude developers, Chris describes internal security communities, Tony UcedaVélez introduces PASTA, and the hosts revisit lessons about testers working with development teams. Jon McCoy defines reverse engineering, while Tracy Maleeff shares career-transition advice and reading recommendations. The finale is both a retrospective and a statement of direction: application security improves when technical methods, empathy, learning, and community reinforce one another.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ PASTA Threat Modeling
→ Cybersecurity Canon
→ The Cuckoo's Egg
→ Adam Shostack
→ Tony UcedaVelez
→ Jon McCoy
→ BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Looking back at Season 1
02:00 Adam Shostack on thinking like an attacker
04:45 Why that phrase can exclude developers
06:38 Chris Romeo on security community
09:33 Tony UcedaVélez on PASTA threat modeling
11:05 Why penetration testing matters
12:26 Testers and developers working together
13:14 Jon McCoy on reverse engineering
15:19 Tracy Maleeff on entering security
16:39 Learning through books and history
17:17 The Cuckoo’s Egg and closing recommendations
18:21 Closing Season 1