How a compliance‑driven program became a visible, energizing part of engineering life.
Transform AI access into effective capability. Discover strategies for enhancing workflows, preparing teams, and ensuring responsible AI use in your organization.
Discover why AI guardrails fail to stop repeat vulnerabilities and how a closed-loop approach helps reduce rework and improve code quality.
In this session, we will explore how simply giving employees access to AI tools doesn’t create business value, and organizations must instead enable teams with proper training, workflows, and measurement to achieve real ROI.
In this session, we will explore what it means when AI becomes a core contributor to the development process.
The Secure VIBE Coding Framework from Security Journey treats vibe coding as a first-class workflow. Instead of banning AI or hoping reviews catch everything, this guide gives you a practical system: define Vision before code, constrain change boundaries, ship in small verified slices, and wire enforcement into how you already work. The result is reviewable diffs, visible promises, and proof, not vibes.
Learn how AI is reshaping secure development and what your team needs to stay efficient, proactive, and ready. Join Security Journey's webinar to explore AI learning paths, developer readiness assessments, and tools that accelerate secure coding in an AI-driven world.
Discover how AI is changing secure coding and what developers can do to keep up. Download the report to learn from AppSec and AI experts.
John joins the podcast to explore what it means to treat security like other mature safety disciplines. Drawing on safety science, economics, and hands-on AppSec experience, he shares a practical perspective on security as decision support and how empowering developers with the right time and tools leads to stronger security outcomes.
Delivered through the leadership lens of a former Special Forces Green Beret, this webinar focuses on what it actually takes to stand up a program that works in the real world.
Join Security Journey leaders for a forward-looking session on the future of secure development in the age of AI. You’ll see how we’re evolving our platform to meet real developer needs, how organizations are adopting these approaches today, and why a developer-centered strategy is essential for reducing risk and moving fast without compromise.
This paper examines the implications of PCI DSS 4.0 for development teams and outlines six actionable steps for organizations to ensure compliance.
Join application security expert Michael Burch for a technical, hands-on webinar on building an AI governance program that keeps teams productive while minimizing risk.
In this special year-in-review episode, hosts Dustin Lehr and Michael Burch look back on the standout conversations and greatest moments from The Security Champions Podcast throughout 2025.
This webinar covers the EU Cyber Resilience Act (CRA), which will mandate strict "security by design" standards and vulnerability reporting for digital products.
This guide offers essential insights and actionable steps to enhance your organization's software security. It addresses key questions about secure coding practices and fosters a security-conscious culture.
This study aims to understand the state of secure coding training and provide insights into how organizations are attempting to improve software security in the face of increasing regulatory pressure.
Derek Brink, VP and Research Fellow at Aberdeen Strategy and Research analyzed 140k Security Journey Hands-on exercises for training software developers to identify and fix Injection vulnerabilities.
This SC Media panelcast, sponsored by Security Journey, brings together secure development experts and AppSec leaders to explore what it takes to embed lasting, secure coding behaviors across the software lifecycle.
Tactical AppSec: An AI Security Field Guide is a hands-on guide built for real leaders. You’ll cut through the noise, uncover where AI is showing up, and put practical governance in place, fast. Whether you're flying solo or driving org-wide strategy, this is your battle plan to lead with confidence and keep innovation secure.
This webinar highlights Secure VIBE Coding. By turning feature ideas into safe specs, containing AI changes, enforcing rules, and preventing security gaps in production.
This guide shares practical strategies and actionable steps for planning, implementing, and maintaining an effective secure coding training program.
Data breaches and application attacks have severe consequences. Human involvement is critical for secure code release, alongside tools and automation.
Discover how Zoom transformed their application security training with Security Journey.
Roger A. Grimes, Data-Driven Defense Evangelist for KnowBe4, Inc., is the author of 15 books and over 1500 articles. He specializes in host security and preventing hacker and malware attacks.
Learn how to integrate threat modeling into your development process without slowing your team. This live webinar shows a practical, developer-friendly approach to building secure software faster.
Learn how this Leading Visitor Management Solution used Security Journey's solution to save time on SOC2 Compliance reporting and to get their developers more engaged with their application security.
Learn how this organization streamlined their PCI DSS requirements while engaging developers.
Dustin Lehr joined Security Journey as Director of Application Security Advocacy. With nearly two decades of experience as a software engineer, application architect, and cybersecurity leader, Dustin has ample expertise in the industry.
You can use the STRIDE model to identify potential threats to your product and the DREAD model to prioritize them.
David Kosorok, the Director of Information Security Programs at Toast, Inc., has over 25 years of experience in software and security testing, including more than 16 years dedicated to security.
There are several secure coding training platforms available, each with unique philosophical and design foundations.
Mike Burch, Director of Application Security at Security Journey, will go beyond the technical details to uncover the policy blind spots, strategic vulnerabilities, and governance challenges introduced by AI at scale, especially when it comes to software development.
Adam Bruehl, a Senior DevOps Engineer at Security Journey, has a unique blend of expertise ranging from biology to technology.
This discussion embraces the needs of both the development and security teams to help everyone reach the combined goal of quality, secure software while still hitting your speed-to-market goals with new features.
Join Security Journey’s expert content team for an insightful discussion on AI security and the evolving landscape of AI threats, guided by the latest OWASP AI Top 10 list.
Tactical AppSec: A Champions' Field Guide is your hands-on playbook, crafted specifically for developers and champions like you—those who write, review, deploy, and secure code. It’s designed to meet you where you are, helping you tackle real-world security challenges with practical, actionable solutions.
Find out how this organization improved fixing vulnerabilities from 14% to 81%.
You can learn about secure coding practices from this company's training playbook.
Michael Erquitt is a Senior Security Engineer at Security Journey who develops educational content for all of our learners.
Watch our on-demand webinar and discover how to secure AI systems at the architectural level. Learn about emerging AI-specific threats, common blind spots, and how to apply threat modeling tailored for AI.
In this video, Amy Baker discusses the importance of security education in solving this application security issue.
Chris Romeo, the AppSec Expert and co-author of the Threat Modeling Manifesto, recently hosted a discussion on the benefits of threat modeling, including a live demo of the process.
Study, conducted by the Ponemon Institute and sponsored and published by Security Journey, aimed to understand the state of secure coding training.
Join us for this insightful webinar as we explore how to go beyond static security policies and tools to create a developer-centric security culture that embeds secure practices into everyday workflows.
This webinar will provide a deep dive into modern approaches, bestpractices, and essential resources to safeguard your software supply chain from end to end.
By leveraging Security Journey's training platform, organizations can drive PCI training success by providing highly effective, engaging, and customizable training programs that enable employees to learn and apply the best practices for securing payment card information.
Director of Application Security Mike Burch explores how thecapplication security industry has been failing and how adopting a few core concepts can help shape a new way forward.
In this webinar, we will discuss why codesecurity is important and how to implement security into your software development life cycle.
Watch former Green Beret turned AppSec expert Michael Burch in this Tactical AppSec Bootcamp focused on building an AI governance program that keeps teams productive while keeping risk under control.
Mike Burch, Director of Application Security at Security Journey, and his team took the time to evaluate these lists and compile what we believe is a list to rule them all – the top 10 biggest threats to our products across the different technologies.
In this video, Amy Baker from Security Journey will review the business impact of an application security risk, the cost of secure coding training, and show how you can calculate the ROI of secure coding training.
In this session, Mike Burch, Director of Application Security at Security Journey, went beyond the hype to uncover what truly made AI different and why traditional security approaches fell short.
Tactical Appsec: A Security Champion Leader's Guide is a hands-on guide to discovering how to scale application security through people, not just tools. Download this practical guide for Security Champion program leaders and start embedding security across your organization today.
Mark McMillan has been building and leading Information Security Champions programs for over five years and has spent nearly a decade shaping cybersecurity culture at Rocket. He's passionate about creating programs that empower, not punish, and help people understand their role in keeping data secure.
Ariel Shin is a Security Engineer at Stripe, specializing in threat modeling and proactively identifying and mitigating potential security risks. She is passionate about scaling application security while reducing engineering burdens and strives to create foundations that seamlessly integrate security practices into the development lifecycle.
In this episode of The Security Champions Podcast, hosts Dustin Lehr and Michael Burch got together to discuss the recent success of the first annual Security Champions Summit.
Eva Benn is a Principal Security Program Manager for the Microsoft Security and Response Center. She is deeply involved in the security community, having served/serving on the leadership boards of the OWASP Seattle Chapter, WiCyS Western Washington, ISACA Puget Sound Chapter, the EC Council CEH Advisory Board, and the GIAC Advisory Board. She is also a Co-Chair of the Microsoft Women in Security and Co-Founder of Women in Tech Global.
Jacob Salassi, former Director of Product Security at Snowflake, joined this episode of The Security Champions Podcast to share insights from his experience leading security transformation at scale.
Phillip Maddux is the founder of Deception Logic and a Staff Engineer on the Detection Engineering and Response Automation team at Compass. With close to two decades of experience in information and application security, Phillip's passion for honeypots led him to develop HoneyDB.io and his company, Deception Logic.
Irfaan Santoe is the leader of the OWASP Netherlands chapter and the creator of the OWASP Security Champions Guide. He is passionate about scaling security in AppDev, DevOps, and Cloud and has helped numerous multinationals solve information security challenges.
Noah Morse is an application security engineer at Security Journey focused on building vulnerable sandboxes for our Break/Fix lessons that teach developers how to secure applications.
Michael Bargury is a security researcher passionate about all things related to cloud, SaaS and low-code security, and he spends his time finding the ways they could all go wrong. He is the co-founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps and leads the OWASP No-Code/Low-Code Top 10 project.
Ahmad is an entrepreneur with three successful ventures who is currently the CEO at Corgea. He led various products at Coupa after they acquired his previous venture, Riskopy. He built his current company due to frustration with the manual and inefficient processes companies take around security.
Join Micheal Burch, host of The Security Champions Podcast, as he reminisces about the standout moments from this season's conversations, from unraveling the intricacies of elegant code to exploring the human side of coding.
Derek is a multifaceted professional with expertise in information security, serving as an author, leader, speaker, and university instructor. His commitment to enhancing information security has defined his career, steering high-performing cybersecurity teams and crafting strategic initiatives that effectively mitigate risks and safeguard sensitive data. He excels in uniting teams, implementing regulatory compliance systems, and establishing comprehensive enterprise security services to ensure organizations' secure digital landscape navigation.
Tanya Janca, also known as SheHacksPurple, is the best-selling author of 'Alice and Bob Learn Application Security' and founder of We Hack Purple. Tanya has been coding and working in IT for over 25 years, has won countless awards, and has been everywhere, from public service to tech giants writing software, leading communities, founding companies, and 'securing all things'.
Jason Haddix has had a distinguished 15-year career in cybersecurity, previously serving as the CISO of Ubisoft, Head of Trust/Security/Operations at Bugcrowd, Director of Penetration Testing at HP, and Lead Penetration Tester at Redspin. He is a hacker and bug hunter to the core and has authored many talks, speaking at cons such as BlackHat, RSA, and many more.
Ron Woerner, CISSP, CISM, is the President and Chief Security Officer at Cyber-AAA, plus a Senior Security and Risk Consultant for Forrester Research. With over 20 years of experience in IT and Security experience, Ron works with leaders worldwide to advise on security, compliance, and privacy.
Dustin Lehr is the Sr. Director of Platform Security at Fivetran & the Co-founder and Chief Solutions Officer at Katilyst Security. Before shifting into cybersecurity leadership, Dustin spent 13 years as a software engineer and application architect in various industries.
Kenneth Buckler, CASP, is a research analyst of information security/risk and compliance management for Enterprise Management Associates, a technology industry analyst and consulting firm. With over 15 years of experience, Ken is an author on cybersecurity topics and has spent several years working for federal contractors in cybersecurity practitioner roles.
Tim Brown is the CISO of SolarWinds, responsible for overseeing the company's internal IT security, product security, and security strategy. With over 25 years of experience and 18 issued patents on security-related topics, Tim is a trusted advisor for business executives, AppSec leaders, and the White House.
Chris Romeo, AppSec expert and CEO of Kerr Ventures, joins to talk about The Security Champions Framework and the biggest mistake organizations make with security champion programs.
This SC Media panelcast, featuring experts from Security Journey, explores how leading organizations are putting AI-assisted security into practice by pairing machine-driven insight with a human-first culture of secure development.
See how leading teams are keeping AI productive while staying mission-ready, closing security gaps before they appear, and turning speed into an advantage rather than a liability.
