The Application Security Podcast
Jun 2, 2026 · 40 min · 12 segments
**AI coding tools are accelerating development fast, but they’re also exposing the limits of traditional AppSec tooling. Josh Grossman, CTO of Bounce Security and longtime AppSec consultant, joins the…
Chris RomeoHostNo entities detected.
Uh, so I guess, Josh, the best place we can start here is a lot of security teams, they're dealing with a lot of tooling.
So for you with this, this tool, AGAST, like what was the moment where you decided to build a solution rather than just trying to find a workaround with existing tools?
So I guess I, I sort of had a front row seat last year to just the absolute sort of takeover of AI in the development industry.
Um, I was sort of working with one particular client, and I, I basically in a, in a space of the first half of the year, I watched them go from sort of rough POCs.
"Okay, we'll, we'll evaluate this AI, AI provider and like this AI IDE." And this is early twenty twenty-five.
"Yeah, it will take a few weeks." And then suddenly like, "Yeah, we've bought cursor licenses for the entire organization." Um, and then I just sort of got mine set up to help work with a client.
They're like, "Oh, no, everyone's using Claude code now." You know, this is like within the space of a few weeks, one after the other.
And you know, I just saw the pace that it started moving and the pace that developers started moving as well.
Um, and that sort of culminated in a-- I, I sort of, I was lucky enough to be at Black Hat and DEF CON last year and I was helping out with OWASP community and I said, "You know what? I'd really like to do a discussion about like this sort of whole AI coding thing in general and trying to like discuss with other people who would be interested to come to OWASP community.
Okay, how, how are we handling this? What are we doing about this?" Um, and, uh, this, this, this talk ended up being I think a Sunday morning, and a Sunday morning at DEF CON's already a little bit quiet.
And I suddenly see like ten, twenty, thirty, forty, fifty people come into this, into the OWASP community to have this discussion because clearly everyone is ha- seeing the same thing.
Um, so it became clear that, you know, we can't just ig- we couldn't just ignore this.
And I think that, um, I think part of it is a- about at the actual writing code stage, but certainly what I was seeing at the client and what I was most worried about is, okay, well, how can I, how can I take advantage of this to actually figure out what's going on in code? How can I take advantage of this to sort of discover what's going on in this new volume of code that's being generated? And I'd already seen that static tools weren't really enough and sort of generic rules, off-the-shelf rules, you know, they weren't enough to begin with.
And now this extra sort of AI dimension gave a lot more flexibility and a lot more possibilities.
Okay, what can we actually discover? How can we use this sort of extra intelligence to discover better findings and find sort of more accurate findings as well?
Uh, so I guess, Josh, the best place we can start here is a lot of security teams, they're dealing with a lot of tooling.
So for you with this, this tool, AGAST, like what was the moment where you decided to build a solution rather than just trying to find a workaround with existing tools?
So I guess I, I sort of had a front row seat last year to just the absolute sort of takeover of AI in the development industry.
Um, I was sort of working with one particular client, and I, I basically in a, in a space of the first half of the year, I watched them go from sort of rough POCs.
"Okay, we'll, we'll evaluate this AI, AI provider and like this AI IDE." And this is early twenty twenty-five.
"Yeah, it will take a few weeks." And then suddenly like, "Yeah, we've bought cursor licenses for the entire organization." Um, and then I just sort of got mine set up to help work with a client.
They're like, "Oh, no, everyone's using Claude code now." You know, this is like within the space of a few weeks, one after the other.
And you know, I just saw the pace that it started moving and the pace that developers started moving as well.
Um, and that sort of culminated in a-- I, I sort of, I was lucky enough to be at Black Hat and DEF CON last year and I was helping out with OWASP community and I said, "You know what? I'd really like to do a discussion about like this sort of whole AI coding thing in general and trying to like discuss with other people who would be interested to come to OWASP community.
Okay, how, how are we handling this? What are we doing about this?" Um, and, uh, this, this, this talk ended up being I think a Sunday morning, and a Sunday morning at DEF CON's already a little bit quiet.
And I suddenly see like ten, twenty, thirty, forty, fifty people come into this, into the OWASP community to have this discussion because clearly everyone is ha- seeing the same thing.
Um, so it became clear that, you know, we can't just ig- we couldn't just ignore this.
And I think that, um, I think part of it is a- about at the actual writing code stage, but certainly what I was seeing at the client and what I was most worried about is, okay, well, how can I, how can I take advantage of this to actually figure out what's going on in code? How can I take advantage of this to sort of discover what's going on in this new volume of code that's being generated? And I'd already seen that static tools weren't really enough and sort of generic rules, off-the-shelf rules, you know, they weren't enough to begin with.
And now this extra sort of AI dimension gave a lot more flexibility and a lot more possibilities.
Okay, what can we actually discover? How can we use this sort of extra intelligence to discover better findings and find sort of more accurate findings as well?
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.