State of {Absolute} AppSec

A live panel recorded in front of a conference audience looks at the state of application security. The hosts of the Absolute AppSec podcast are joined by industry practitioners who share their views on the field. The discussion opens by separating product security from application security. Panelists note that the terms are used inconsistently, and that product security often covers firmware, cloud services and wider enterprise controls.

The middle of the session covers progress and pain points. Panelists credit modern web frameworks with eliminating many classic bug classes, and they point to developer-focused tooling that fits into existing workflows. The struggles they describe include scanners that slow developers down, legacy tools that handle modern JavaScript frameworks poorly, and pentest reports whose advice developers find unclear. They also discuss how shifting security left can push heavy tooling onto developers who were never its intended users. AI gets a long look. Coding assistants are already widespread, and panelists weigh their productivity gains against subtle bugs, data exposure through public platforms, and prompt injection in tools built on language models. A proposed loosening guide, paired with secure-by-default software, draws skepticism.

The closing segment turns forward. Panelists argue that application security teams should stick to fundamentals, treat security as part of the wider software quality effort, and build processes flexible enough to keep pace with new technology. The session makes clear that the field is changing quickly while many of its core communication problems persist.