Episode 326 - AppSec Jobs, Benchmarking LLMs, Open Web Standards

Before we get into other things, there is training opportunities still available.

The classes for both Black Hat and DEF CON are filling up.

Just to be frank, we do need a couple more sign-ups for DEF CON to happen.

I don't know if Ken and I's liver or sanity can take Vegas for that long, but we're going to do our best to make sure that we deliver Both of those are AI-focused.

Obviously, that's had a huge impact on AppSec over the last couple of years.

So excited to get into that.

So check out training.absoluteappsec.com. And I am going to put up the link for...

Um, yeah, Ken, what do you want to start with today? Actually, I, a question for you really quick before we get into the articles and the actual, like, um, yeah, the content, the discussion that we, we wanted to start today with, um, Ken, what do you want to start with today? the training courses.

I know I end up talking about them a fair bit at the beginning of each episode.

In your mind, what is the differentiation between what we offer at Black Hat and what we offer at DEF CON?

And I know I'm

putting you on the spot, so yeah.

Yeah, you are actually, because this actually was not discussed.

Yeah, the biggest one is Defcon's pretty focused on just the sort of like how to build, yeah, how to use agents, how to build agents, how to build, not just agents, but how to build using all the like, tooling how to build tooling for agents um how to do a lot of things basically it's a lot of how to build something that's going to have some purpose insecurity meaning like how to build some agentic tool that's going to have some purpose so if it's threat modeling or if it's a code review or if it's dast or whatever you're going to walk away uh with knowing how to glue those bits together and be model agnostic so that's probably the number one the black the black hat one is much more involved in going deeper both in llms but also how to blend that into like specifically um We do a lot of code review on that one, a lot of code review on that one as well.

So I think it's basically just a deeper, more comprehensive course, but also with a bit more, okay, here's how you leverage AI for code review as well.

So there's, I don't know, it's just deeper.

That's how I'd say it.

Yeah, yep,

it is.

Is that accurate?

Yeah, I mean, from my perspective, I was just wondering how you were thinking about it as we promoted over the last month before we teach both of those courses.

The content does differ.

We've got very specific things that we're trying to address during Black Hat, and that is a longer course.

One of the things that you will get out of the four-day course is more hands-on.

The traditional complaint that we get is we try to cover way too much in a short amount of time, trying to get people from basically no knowledge, like in the DEF CON course in two days, no knowledge of agents or how to code like LLMs or how to interact with them outside of a chat window to, hey, now I've got like scripts and techniques and SDKs and actual code that I can use to harness those LLMs, right? And then on the flip side, so at Black Hat, you're gonna get more time with that as well as the you know secure code review methodology other tips and tricks that we have and the opportunity to ask more questions and to dig in further because you will get that hands on the keyboard um good all right so before the cop podcast um ken and i were talking a little bit about the wider influence and consequences that AI is having on the AppSec industry.