In a world where software vulnerabilities can lead to catastrophic failures, two experts unravel the chaos created by the recent PHP to Shell and Node for Shell incidents that impacted 70% of the internet. Cássio Pereira and Ben-Hur dive deep into the lessons learned from this unprecedented situation, offering vital insights for anyone involved in application security.
This episode is a must-listen for developers, security professionals, and tech leaders who want to navigate the murky waters of vulnerability management. Cássio and Ben-Hur share their experiences of grappling with real-time vulnerabilities, emphasizing the critical need for visibility and ownership in security practices. You’ll discover how to answer the pressing question, "Am I vulnerable?" and learn effective strategies to identify and mitigate risks before they escalate.
We break down essential topics such as:
- The complexities of understanding vulnerability exposure across multiple applications.
- How to categorize vulnerabilities and recognize the pathways they exploit.
- The importance of cross-team collaboration in addressing security issues.
- Practical steps to enhance visibility of application components and dependencies.
With the stakes higher than ever, failing to grasp these insights could leave your organization wide open to attacks. This episode sheds light on the opportunity to strengthen your security posture and avoid the pitfalls that come with ignorance in this fast-evolving landscape.
Join Cássio and Ben-Hur as they navigate these pressing issues, providing listeners with actionable takeaways and a deeper understanding of the security challenges we face today. Perfect for anyone in the tech industry looking to bolster their defenses and stay ahead of the curve, this episode is essential listening.

Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Support: Nova8, Checkmarx, Snyk, Conviso, Gold Security, CyberSec Games and PurpleBird Security.

#08 - 14 - Lessons learned 2 SHELL - O que aprendemos com Node2Shell & PHP2Shell

What happens when a fridge hack disrupts 700 supermarkets in France? Join Cássio Pereira and Marcos Santos as they dive into this startling incident and the crucial new legislation that could redefine application security in Europe and beyond. In this episode, we’re rejoined by Nariman Aga-Tagiyev, who unveils the implications of the impending Cyber Resilience Act and NIST 2 on developers and manufacturers alike. Nariman reveals why these regulations are not just bureaucratic hurdles but game-changers for anyone looking to sell products in the European market. With staggering consequences for non-compliance—including hefty fines and potential jail time for executives—this discussion is essential for developers, security professionals, and business leaders navigating the complexities of AppSec. You’ll discover:

 * The critical distinctions between NIST 2 and the Cyber Resilience Act, and what they mean for your organization.
 * How the recent fridge attack illustrates the urgent need for robust security measures in critical infrastructure.
 * The real-world impacts of these regulations on software development lifecycles and consumer rights.

As these laws take effect, failing to adapt could mean lost revenue and market access. This episode is not just about compliance; it’s about leveraging these changes to enhance security and build trust with consumers. Perfect for developers, security experts, and anyone in the tech industry, this conversation will equip you with insights to stay ahead in a rapidly evolving landscape. Don't miss out on this opportunity to understand the future of AppSec and the urgent need for proactive measures. Tune in now and learn how to navigate this new regulatory environment before it’s too late!

Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Support: Nova8, Checkmarx, Snyk, Conviso, Gold Security, CyberSec Games and PurpleBird Security.

#08 - 13 - The Shocking Truth About New Cyber Legislation That Could Transform Your Business

Transform your approach to cybersecurity training with this insightful episode featuring Max Alejandro Gomez Sanchez Vergaray, a pioneer in integrating gaming into application security. Discover how Max’s innovative methodology not only translates complex security principles into engaging formats but also empowers teams to prioritize cybersecurity without the usual resistance. If you’re in tech, especially in software development or security, this episode is a must-listen!
Max shares his journey from leading a top banking application security program to launching his own consulting firm focused on secure software development. He reveals the secret behind the success of the OWASP Cornucopia game—a tool that makes learning about security engaging and impactful. You’ll learn how to leverage gamification to enhance security awareness and foster a culture that values cybersecurity as an integral part of development.
You’ll discover:
- How to implement OWASP Cornucopia in your organization and the surprising benefits it offers.
- The importance of integrating security into your product backlog to ensure it’s not an afterthought.
- Practical tips for overcoming common challenges in security training, especially in environments resistant to change.
- The role of fun in training and how it can lead to better retention and engagement among team members.
Why does this matter? In today’s digital landscape, the consequences of neglecting security can be catastrophic. By adopting innovative strategies like gamification, you not only mitigate risks but also build a more informed and proactive team. This episode opens the door to new possibilities in your approach to cybersecurity, emphasizing that learning can—and should—be enjoyable.
Tune in for this essential discussion that promises to reshape your understanding of security training. Perfect for tech leaders, developers, and anyone involved in cybersecurity!

Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Support: Nova8, Checkmarx, Snyk, Conviso, Gold Security, CyberSec Games and PurpleBird Security.

#08 - 12 - The surprising game that transformed AppSec training

In a digital landscape where security breaches make headlines daily, the ability to engage developers and decision-makers on security matters is more critical than ever. In this episode, Lisi Hocke unveils the secret to transforming security champions from mere titles into influential advocates who drive meaningful change across teams. Lisi, a seasoned expert with over 17 years in tech, shares her insights from the frontlines of application security. You’ll discover how to capture the attention of developers and management alike, ensuring that security conversations resonate and lead to proactive measures. Learn the art of speaking their language, building trust, and contextualizing risks to make security relevant and compelling. We break down essential strategies for establishing effective security champion programs, tackling common pitfalls that lead to failure, and exploring innovative approaches that make security an integral part of the development process. You’ll also hear about the critical importance of automation and systems that inherently promote secure practices without overwhelming teams. The stakes couldn’t be higher: neglecting to engage effectively can lead to devastating breaches and costly repercussions. This episode offers a roadmap to not only prevent harm but also foster a culture where security is everyone's responsibility. Perfect for security professionals, developers, and anyone involved in product development, this episode is your guide to creating a more secure future. Tune in to learn how to elevate your security practices and empower your teams today!

Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Support: Nova8, Checkmarx, Snyk, Conviso, Gold Security, CyberSec Games and PurpleBird Security.

#08 - 11 - How Security Champions Can Transform Your Development Team's Approach to Safety

In a world where AI is rapidly becoming the cornerstone of technology, understanding its intricacies is more crucial than ever. Join Rob van der Veer, a veteran in the AI field with over three decades of experience, as he unveils essential insights from his journey, including the pivotal lessons that every child—and adult—needs to grasp about artificial intelligence. Rob, the Chief AI Officer at the Software Improvement Group, shares how he transitioned from building AI systems to consulting on security measures critical for protecting our data. You’ll discover the alarming truth about AI’s limitations, the importance of human oversight, and why the next generation must be educated on these concepts. In this engaging conversation, we delve into: - The genesis of Rob's children's book, *Luna and the Magic AI Paintbrush*, designed to teach kids about AI responsibly - Key strategies for parents and educators on introducing AI concepts to children effectively - Insights into the balance between security and innovation in software development - The critical role of discipline in using AI safely and responsibly Why does this matter? As AI technology advances, so do its threats. Without proper understanding, we risk creating a generation that is overly reliant on AI, unaware of its pitfalls. Rob’s mission is to ensure that both children and professionals alike are equipped with the fundamental knowledge to navigate this complex landscape. Don't miss this vital episode that bridges the gap between technology and education, making it essential listening for parents, educators, and anyone invested in the future of AI. Tune in now to empower yourself and the next generation with the knowledge that could shape a safer, smarter world.

Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

#08 - 10 - How to teach kids complext topics

In a world dominated by screens, how do we reignite the joy of face-to-face interaction? In this episode, Cássio Pereira and Marcos Santos sit down with Devika Gibbs, co-founder of Cybersec Games, to explore the transformative power of physical games in cybersecurity training. Devika reveals how her passion for board games is reshaping the way teams learn and collaborate, proving that true connection happens in person, not behind a screen. Devika shares the origin story of Cybersec Games, sparked by a simple index card idea, and explains why physical interaction is essential for building trust within teams. You'll discover:

 * The unique benefits of playing games in a physical setting versus digital platforms.
 * How to overcome generational shifts towards screen reliance in team training.
 * The surprising outcomes of using games to enhance empathy and communication in professional environments.
 * Real-life applications and success stories from organizations that have embraced this innovative approach.

The stakes are high: without understanding the value of physical interaction, organizations risk losing the essence of teamwork and collaboration. Devika emphasizes that investing in physical games not only fosters deeper connections but also leads to better training outcomes compared to traditional digital methods.This episode is essential listening for cybersecurity professionals, educators, and anyone interested in enhancing team dynamics through the power of play. Dive into the world of Cybersec Games and discover how bringing people together can transform the way we learn and grow in the digital age. Don't miss out on this enlightening conversation that promises to change your perspective on training and teamwork!

Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

#08 - 09 - CyberSec Games: CyberSec conversations on the table

How mature is your DevSecOps program, and how do you know what to improve next?
In this episode, we talk with Timo Pagel, creator of DSOOM, the DevSecOps Maturity Model, about why organizations need structured guidance to build security into software development without turning maturity into a bureaucratic checkbox exercise.
We explore why many companies delay maturity assessments until their development environment becomes difficult to control, how security evaluations should reflect each organization’s actual context, and why copying a generic framework rarely produces meaningful improvement.
Timo also shares how DevSecOps maturity models must evolve as AI becomes part of everyday software development. As teams increasingly rely on AI-assisted coding, maturity models need to address new risks, practices, and responsibilities associated with AI-generated code.
The conversation also covers a topic that maturity models often ignore: failure. Progress does not come from pretending every initiative worked perfectly. It comes from learning what failed, adapting the approach, and using those lessons to build stronger and more resilient engineering practices.
A practical conversation about DevSecOps maturity, realistic assessments, AI-assisted development, organizational growth, and the value of learning from mistakes.


Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

#08 - 08 - DSOOM - DevSecOps Maturity Model

In this episode of the DevSecOps Podcast, we talk with Juliane Reimann about turning one of the most common tensions in software development into real collaboration: the relationship between agile teams and IT security.
Although both sides want reliable and robust software, security checks are still often left until the end of the development lifecycle. The result is predictable: vulnerabilities are discovered too late, remediation becomes expensive, delivery pressure increases, and security is treated as a blocker instead of a partner.
Based on her presentation, “From Conflict to Collaboration,” Juliane explains why security findings are often detected but not addressed quickly, what causes defensive reactions toward security tools and processes, and how early, continuous security integration can improve communication, ownership, and delivery.
A practical conversation about breaking silos, reducing friction, and making security part of the development workflow from the beginning.


Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

#08 - 07 - From conflict to collaboration

In this episode of the DevSecOps Podcast, we talk with Nariman Aga-Tagiyev about how behavioral science can help improve Application Security programs. Based on his presentation, “Keep It Between Us: Manipulating Humans for Better AppSec (Ethically),” we discuss motivation, skills, tips, habit formation, and how to transform security activities into sustainable behaviors within development teams. We also explore BJ Fogg's Behavioral Model, the Octalysis Framework, and the Habit Cycle in an Application Security context, including the risks of using gamification, pressure, or behavioral manipulation inappropriately.

Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

#08 - 06 - Manipulating people for a good AppSec

In this episode, we sit down with Michael Novack to talk about the AI Explainability Scorecard, a practical framework for evaluating whether AI explanations are actually useful, trustworthy, and actionable.
Michael walks us through the SCORE framework, covering five key dimensions: Sound, Consistent, Optimize, Readable, and Easy. We discuss why “the AI gave an explanation” is not enough, how convincing explanations can still be misleading, and why teams need a structured way to measure explainability before trusting AI-driven decisions.
From compliance and auditability to security, governance, and real-world accountability, this conversation explores what it takes to move AI explainability from vague promise to practical discipline.
If you are building, securing, reviewing, or approving AI systems, this episode is for you.


Become a supporter of this podcast: https://www.spreaker.com/podcast/devsecops-podcast--4179006/support [https://www.spreaker.com/podcast/devsecops-podcast--4179006/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Apoio: Nova8, Snyk, Conviso, Gold Security, Digitalwolk e PurpleBird Security.

#08-05 - AI Explainability Score Card

Cássio Pereira (@cassiodeveloper) · Zencastr

Cássio Pereira (@cassiodeveloper)

DevSecOps de um jeito prático e descontraído. Profissionais debatendo as mais variadas formas de tornar um software mais seguro.