A new episode of the Resilient Cyber Show just dropped, and this one is a conversation I’ve been looking forward to for a long time.

I sat down with Tanya Janca, better known to most of the AppSec world as SheHacksPurple. Tanya is the best-selling author of Alice and Bob Learn Application Security and Alice and Bob Learn Secure Coding, an OWASP Lifetime Distinguished Member, CEO of She Hacks Purple Consulting, and one of the most recognized voices in application security and developer education on the planet.

The timing of this conversation is hard to overstate. The OWASP Top 10 2025 was announced at the Global AppSec Conference last year, with two new categories, Software Supply Chain Failures and Mishandling of Exceptional Conditions, and SSRF folded into Broken Access Control. Recently, Anthropic released the Claude Mythos Preview system card, documenting a model that has already found thousands of high-severity zero-day vulnerabilities autonomously, including bugs in every major operating system and web browser, and a 27-year-old vulnerability in OpenBSD.

In other words, AppSec is at a hinge moment, and Tanya is exactly the right person to think out loud with about it.

Here’s what we get into:

What the OWASP Top 10 2025 got right, what it missed, and how teams should actually use it
AI-generated code, “vibe coding,” and Tanya’s brand-new free prompt library for secure coding with AI assistants, SecureMyVibe.ca
What Mythos-class capabilities mean for the offense/defense asymmetry AppSec has always lived with
How AI is genuinely changing the SDLC, where it creates lift, where it creates noise, and where it creates entirely new attack surface
Architecting real defenses at the prompt layer, across MCP servers, and inside RAG pipelines, not just bolting content filters onto the front door
Why developers are the new attack surface, and why a lot of what gets labeled as “supply chain attacks” lately is really a developer compromise that cascaded into the supply chain
Tanya’s threat model, defense framework, and maturity model for protecting developers themselves
DevSec Station, Tanya’s new podcast delivering 5–10 minute secure coding lessons in a format built for how developers actually consume content
What she’d change tomorrow about how AppSec programs are built and run if she could change just one thing

This is one of those conversations that ranges from the practical (what to do Monday morning) to the philosophical (what does it even mean to “secure software” when an AI can find more zero-days in a weekend than a Red Team finds in a year). Tanya brings the rare combination of deep technical chops, real teaching ability, and genuine warmth that makes a hard subject feel approachable.

If you lead an AppSec program, write code for a living, run a security team trying to keep up with AI-assisted development, or you’re just trying to figure out where this whole industry is heading, this is the episode for you.

Resources from the episode:

SecureMyVibe
DevSec Station Podcast (Tanya’s new show)
She Hacks Purple Consulting
Alice and Bob Learn Application Security and Alice and Bob Learn Secure Coding
OWASP Top 10 2025 — https://owasp.org/Top10/2025/
Claude Mythos Preview System Card — Anthropic

Thanks for being here. If this episode landed for you, the best thing you can do is share it with one person on your team who’d find it useful, that’s how this newsletter and show grow.