The Application Security Podcast
The Application Security Podcast is a practitioner-led show for anyone building or securing modern software—and now AI-powered applications. Hosts Chris Romeo and Robert Hurlbut talk with the people shaping application security about AI and LLM security, threat modeling, secure development, OWASP, cloud, DevSecOps, security champions, and building programs that help engineering teams move faster and safer. With more than 300 episodes, the show turns real-world experience into practical guidance for developers, architects, AppSec professionals, and security leaders.
The Application Security Podcast
Josh Grossman--AI & SAST: Is it a match?
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Traditional SAST is deterministic but shallow; AI can reason about context but may answer differently every time. Can the two approaches make each other better? Bounce Security CTO Josh Grossman explains why he built AGHAST, an open-source framework that combines static discovery with LLM analysis to investigate authorization, business-logic, and organization-specific risks. He walks through reducing false positives, importing SARIF, controlling token costs, and deciding where AI-assisted checks belong in developer workflows and CI. Josh also shares how he used Claude Code to build most of the project while retaining the architecture, product judgment, and code-review responsibility himself. The episode closes with AGHAST's roadmap, supported languages, practical adoption advice, and a guided demonstration of the tool.
Connect with Josh Grossman:
→ Josh Grossman on LinkedIn
→ OWASP AGHAST
Mentioned in this episode:
→ OWASP AGHAST
→ Semgrep
→ Cursor
→ Claude Code
→ SARIF
→ NDC Security
→ Black Hat
→ DEF CON
→ ISACA
→ Manicode Security
Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook
Chapters:
00:00 Meet Josh Grossman
01:11 Why Josh built AGHAST
04:22 Will AI disrupt AppSec tooling?
06:09 How AGHAST combines static analysis and AI
08:48 Deterministic rules and pure AI checks
10:23 Reducing SAST false positives
11:49 Using SARIF from existing scanners
12:46 Building AGHAST with Claude Code
14:14 The product specification and human judgment
17:48 How much code did the AI write?
19:05 The architect and product-manager mindset
21:08 Token economics becomes its own industry
22:54 Authorization and business-logic checks
25:55 Context makes custom rules valuable
28:15 Where AGHAST belongs in the workflow
30:11 Languages, frameworks, and COBOL
32:10 The AGHAST roadmap
34:20 Key takeaway and call to action
36:56 Training and conference appearances
37:29 AGHAST demonstration
People on this episode
Podcasts we love
Check out these other fine podcasts recommended by us, not an algorithm.
The Security Table
Izar Tarandach, Matt Coles, and Chris Romeo