Shows
Redefining CyberSecurityBuilding a Real Security Culture: Why Most AppSec Champion Programs Fall Short | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 5 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9Most organizations have security champions. Few have a real security culture.In this episode of AppSec Contradictions, Sean Martin explores why AppSec awareness efforts stall, why champion programs struggle to gain traction, and what leaders can do to turn intent into impact.🔍 In this episode:Why compliance training doesn’t build cultureThe data showing champion programs lack leadership and incentive alignmentHow developers, AppSec teams, and business leaders each contribute to the gapInsights from OWASP, ENISA, and Forrester on what’s missingSean’s Take:When security culture is treated as a checkbox...
2025-11-0602 min
ITSPmagazineBuilding a Real Security Culture: Why Most AppSec Champion Programs Fall Short | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 5 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9Most organizations have security champions. Few have a real security culture.In this episode of AppSec Contradictions, Sean Martin explores why AppSec awareness efforts stall, why champion programs struggle to gain traction, and what leaders can do to turn intent into impact.🔍 In this episode:Why compliance training doesn’t build cultureThe data showing champion programs lack leadership and incentive alignmentHow developers, AppSec teams, and business leaders each contribute to the gapInsights from OWASP, ENISA, and Forrester on what’s missingSean’s Take:When security culture is treated as a checkbox...
2025-11-0602 min
Redefining CyberSecurityCI/CD Pipeline Security: Why Attackers Breach Your Software Pipeline and Own Your Build Before Production | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 4 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9Organizations pour millions into protecting running applications—yet attackers are targeting the delivery path itself.This episode of AppSec Contradictions reveals why CI/CD and cloud pipelines are becoming the new frontline in cybersecurity.🔍 In this episode:A 188% surge in malicious open-source packages (Sonatype 2025)30% of 2024 cyberattacks traced to suppliers (Financial Times 2025)47% of organizations unable to assess pipeline risk (ENISA 2023)CISA labels build systems “high-value targets” (2025)Sean’s Take:The pipeline is production. Integrity beats visibility. Security must flow through delivery.Catch the full companion article in the Future of Cybersecuri...
2025-10-2903 min
ITSPmagazineCI/CD Pipeline Security: Why Attackers Breach Your Software Pipeline and Own Your Build Before Production | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 4 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9Organizations pour millions into protecting running applications—yet attackers are targeting the delivery path itself.This episode of AppSec Contradictions reveals why CI/CD and cloud pipelines are becoming the new frontline in cybersecurity.🔍 In this episode:A 188% surge in malicious open-source packages (Sonatype 2025)30% of 2024 cyberattacks traced to suppliers (Financial Times 2025)47% of organizations unable to assess pipeline risk (ENISA 2023)CISA labels build systems “high-value targets” (2025)Sean’s Take:The pipeline is production. Integrity beats visibility. Security must flow through delivery.Catch the full companion article in the Future of Cybersecuri...
2025-10-2903 min
Music Evolves PodcastFrom Sampling to Scraping: AI Music, Rights, and the Return of Creative Control | A Musing On The Connection Between Music, Technology, and Creativity | Music Evolves: Sonic Frontiers with Sean Martin and TAPE9 | Read by TAPE9Show NotesIn this episode, we unpack the core ideas behind the Sonic Frontiers article “From Sampling to Scraping: AI Music, Rights, and the Return of Creative Control.” As AI-generated music floods streaming platforms, rights holders are deploying new tools like neural fingerprinting to detect derivative works — even when no direct sampling occurs. But what does it mean to “detect influence,” and can algorithms truly distinguish theft from inspiration?We explore the implications for artists who want to experiment with AI without being replaced by it, and the shifting desires of listeners who may soon prefer hum...
2025-10-1610 min
ITSPmagazineFrom Sampling to Scraping: AI Music, Rights, and the Return of Creative Control | A Musing On The Connection Between Music, Technology, and Creativity | Music Evolves: Sonic Frontiers with Sean Martin and TAPE9 | Read by TAPE9Show NotesIn this episode, we unpack the core ideas behind the Sonic Frontiers article “From Sampling to Scraping: AI Music, Rights, and the Return of Creative Control.” As AI-generated music floods streaming platforms, rights holders are deploying new tools like neural fingerprinting to detect derivative works — even when no direct sampling occurs. But what does it mean to “detect influence,” and can algorithms truly distinguish theft from inspiration?We explore the implications for artists who want to experiment with AI without being replaced by it, and the shifting desires of listeners who may soon prefer hum...
2025-10-1610 min
ITSPmagazineBeyond the Title: What It Really Takes to Be a CISO Today — Insights Following A Conversation with Solarwinds CISO, Tim Brown | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9What does it really take to be a CISO the business can rely on? In this episode, Sean Martin shares insights from a recent conversation with Tim Brown, CISO at SolarWinds, following his keynote at AISA CyberCon and his role in leading a CISO Bootcamp for current and future security leaders. The article at the heart of this episode focuses not on technical skills or frameworks, but on the leadership qualities that matter most: context, perspective, communication, and trust.Tim’s candid reflections — including the personal toll of leading through a crisis — remind us that clarity doesn’t come f...
2025-10-1608 min
Redefining CyberSecurityBeyond the Title: What It Really Takes to Be a CISO Today — Insights Following A Conversation with Solarwinds CISO, Tim Brown | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9What does it really take to be a CISO the business can rely on? In this episode, Sean Martin shares insights from a recent conversation with Tim Brown, CISO at SolarWinds, following his keynote at AISA CyberCon and his role in leading a CISO Bootcamp for current and future security leaders. The article at the heart of this episode focuses not on technical skills or frameworks, but on the leadership qualities that matter most: context, perspective, communication, and trust.Tim’s candid reflections — including the personal toll of leading through a crisis — remind us that clarity doesn’t come f...
2025-10-1608 min
Redefining CyberSecurityWhen the Coders Don’t Code: What Happens When AI Coding Tools Go Dark? | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9In this issue of the Future of Cyber newsletter, Sean Martin digs into a topic that’s quietly reshaping how software gets built—and how it breaks: the rise of AI-powered coding tools like ChatGPT, Claude, and GitHub Copilot.These tools promise speed, efficiency, and reduced boilerplate—but what are the hidden trade-offs? What happens when the tools go offline, or when the systems built through them are so abstracted that even the engineers maintaining them don’t fully understand what they’re working with?Drawing from conversations across the cybersecurity, legal, and developer communities—including a...
2025-10-0809 min
ITSPmagazineWhen the Coders Don’t Code: What Happens When AI Coding Tools Go Dark? | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9In this issue of the Future of Cyber newsletter, Sean Martin digs into a topic that’s quietly reshaping how software gets built—and how it breaks: the rise of AI-powered coding tools like ChatGPT, Claude, and GitHub Copilot.These tools promise speed, efficiency, and reduced boilerplate—but what are the hidden trade-offs? What happens when the tools go offline, or when the systems built through them are so abstracted that even the engineers maintaining them don’t fully understand what they’re working with?Drawing from conversations across the cybersecurity, legal, and developer communities—including a...
2025-10-0809 min
Redefining CyberSecuritySBOMs in Application Security: From Compliance Trophy to Real Risk Reduction | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 3 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9SBOMs were supposed to be the ingredient label for software—bringing transparency, faster response, and stronger trust. But reality shows otherwise. Fewer than 1% of GitHub projects have policy-driven SBOMs. Only 15% of developer SBOM questions get answered. And while 86% of EU firms claim supply chain policies, just 47% actually fund them.So why do SBOMs stall as compliance artifacts instead of risk-reduction tools? And what happens when they do work?In this episode of AppSec Contradictions, Sean Martin examines:Why SBOM adoption is laggingThe cost of static SBOMs for developers, AppSec teams, and business leadersReal-world examples wh...
2025-10-0102 min
ITSPmagazineSBOMs in Application Security: From Compliance Trophy to Real Risk Reduction | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 3 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9SBOMs were supposed to be the ingredient label for software—bringing transparency, faster response, and stronger trust. But reality shows otherwise. Fewer than 1% of GitHub projects have policy-driven SBOMs. Only 15% of developer SBOM questions get answered. And while 86% of EU firms claim supply chain policies, just 47% actually fund them.So why do SBOMs stall as compliance artifacts instead of risk-reduction tools? And what happens when they do work?In this episode of AppSec Contradictions, Sean Martin examines:Why SBOM adoption is laggingThe cost of static SBOMs for developers, AppSec teams, and business leadersReal-world examples wh...
2025-10-0102 min
ITSPmagazineThe Problem With Threat Modeling in Application Security: Too Slow, Too Theoretical, Not Agile | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 2 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9Threat modeling is often called the foundation of secure software design—anticipating attackers, uncovering flaws, and embedding resilience before a single line of code is written. But does it really work in practice?In this episode of AppSec Contradictions, Sean Martin explores why threat modeling so often fails to deliver:It’s treated as a one-time exercise, not a continuous processResearch shows teams who put risk first discover 2x more high-priority threatsYet fewer than 4 in 10 organizations use systematic threat modeling at scaleDrawing on insights from SANS, Forrester, and Gartner, Sean breaks down the gap betw...
2025-09-1203 min
Redefining CyberSecurityThe Problem With Threat Modeling in Application Security: Too Slow, Too Theoretical, Not Agile | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 2 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9Threat modeling is often called the foundation of secure software design—anticipating attackers, uncovering flaws, and embedding resilience before a single line of code is written. But does it really work in practice?In this episode of AppSec Contradictions, Sean Martin explores why threat modeling so often fails to deliver:It’s treated as a one-time exercise, not a continuous processResearch shows teams who put risk first discover 2x more high-priority threatsYet fewer than 4 in 10 organizations use systematic threat modeling at scaleDrawing on insights from SANS, Forrester, and Gartner, Sean breaks down the gap betw...
2025-09-1203 min
Redefining CyberSecurityAI in Application Security: Why False Positives Still Overwhelm Teams Despite the Hype | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 1 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9AI is everywhere in application security today — but instead of fixing the problem of false positives, it often makes the noise worse. In this first episode of AppSec Contradictions, Sean Martin explores why AI in application security is failing to deliver on its promises.False positives dominate AppSec programs, with analysts wasting time on irrelevant alerts, developers struggling with insecure AI-written code, and business leaders watching ROI erode. Industry experts like Forrester and Gartner warn that without strong governance, AI risks amplifying chaos instead of clarifying risk.This episode breaks down:• Why 70% of anal...
2025-09-0902 min
ITSPmagazineAI in Application Security: Why False Positives Still Overwhelm Teams Despite the Hype | AppSec Contradictions: 7 Truths We Keep Ignoring — Episode 1 | A Musing On the Future of Cybersecurity with Sean Martin and TAPE9 | Read by TAPE9AI is everywhere in application security today — but instead of fixing the problem of false positives, it often makes the noise worse. In this first episode of AppSec Contradictions, Sean Martin explores why AI in application security is failing to deliver on its promises.False positives dominate AppSec programs, with analysts wasting time on irrelevant alerts, developers struggling with insecure AI-written code, and business leaders watching ROI erode. Industry experts like Forrester and Gartner warn that without strong governance, AI risks amplifying chaos instead of clarifying risk.This episode breaks down:• Why 70% of anal...
2025-09-0902 min