Jon McCoy -- The Mindset to Reverse Engineer

How does a developer learn to take software apart and use that knowledge to build it more securely? Jon McCoy joins Chris and Robert to discuss reverse engineering, the habits of a breaker, and the connection between offensive research and everyday development. He explains what reverse engineering means, describes experiments with malware and .NET applications, and shows how familiar practices such as unit testing can incorporate security thinking. The conversation explores framework protections, how much coding knowledge penetration testers need, and the role of local developer and security communities. Jon’s advice for newcomers is practical: choose an application, inspect how it works, and learn by experimenting. The episode emphasizes curiosity and repeated hands-on work as foundations for deeper software understanding.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jon Mccoy:
→ Jon McCoy on X
→ Jon McCoy on GitHub

Mentioned in this episode:
→ NDC Conferences
→ DEF CON
→ Metasploit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Reverse engineering with Jon McCoy
01:53 Why a developer became interested in security
02:27 What reverse engineering means
03:24 Teaching security through familiar developer practices
04:06 Adding security thinking to unit tests
05:00 Malware experiments and the breaker mindset
07:56 Helping others learn to break software
11:22 Security in the .NET framework
14:39 How much code should a penetration tester know?
17:45 Learning through developer and security communities
19:47 A first month of learning to reverse engineer
21:26 Resources and hands-on experimentation