Name: Into the Rabbit Hole: Grumpy Experts Shed Light on the Repeating AppSec Challenges
Uploaded: 2025-05-14T03:28:16+00:00
Duration: 56 min 56 s
Description: In this long-form episode of **Dan on Dev**, I’m joined by **Rafal Los**, veteran security strategist and host of *Down the Security Rabbit Hole*. We go deep into the persistent challenges of applicat

9 months ago

Technology AppSec AppSec Program Application Security Application Security Basics Application Security Testing DAST Dynamic Application Security Testing IAST Interactive Application Security Testing OWASP

In this long-form episode of **Dan on Dev**, I’m joined by **Rafal Los**, veteran security strategist and host of *Down the Security Rabbit Hole*. We go deep into the persistent challenges of application security—why they still exist, what we’ve learned (or failed to learn) over the decades, and what real maturity looks like for dev and security teams in 2025.

Whether you're a security leader, AppSec engineer, or developer trying to understand the tension between feature delivery and secure coding—this conversation is packed with insight, sarcasm, and truth bombs from two battle-tested voices in the industry.

🔍 **What you'll learn in this episode:**
- Why the same AppSec issues keep resurfacing—even decades later
- How metrics like time-to-fix and defect recurrence help (or don’t)
- The danger of building tech without business context
- Why many security efforts fail due to poor measurement and collaboration
- Balancing old code debt with future development priorities
- How developers, not just tools, must be enabled and incentivized
- The legacy of 2600, OWASP, and our collective history in security

---

⏱️ **Chapters:**
1. 00:00 – Introduction & welcome
2. 02:04 – Rafal’s AppSec background: from 286s to ExtraHop
3. 05:00 – Early frustrations: appsec at GE and “magic numbers”
4. 07:25 – Are we winning? Problem growth vs. solution pace
5. 10:30 – Cloud, frameworks, and expanding problem space
6. 13:02 – Fixing isn't just technical: org dynamics and dev behavior
7. 16:25 – Metrics that matter: magic numbers revisited
8. 19:45 – Why devs hate AppSec: legacy issues and bad engagement
9. 22:12 – Risk without business context = meaningless security
10. 25:01 – Real maturity = knowing when to stop spending
11. 28:30 – Law of diminishing returns in AppSec investment
12. 31:00 – The reality of legacy tech debt and microservices
13. 34:50 – Security vs. business pressure: the CTO’s lesson
14. 38:00 – Incentivizing safe code vs. just preaching it
15. 41:10 – Recurring defects and their hidden costs
16. 44:30 – Metrics wrap-up & philosophical closing