Topic
Product security and AppSec in practice: threat modeling, secure SDLC, developer-friendly guardrails and closing the gaps tools leave behind.
20 episodes · 6 questions answered
What security controls are non-negotiable when building products for AI-powered workplaces?
Start with the fundamentals, because AI-generated code is built on the same patterns humans have written for years. Neelu lists authentication that can identify every entity making changes (users, machines and agents), data security, auditing, hardened configurations, and logging and monitoring beyond application telemetry. AI-specific controls are added on top of these.
Neelu Tripathy · Adobe
What product security gaps do architecture reviews commonly find?
User authentication is usually covered, because developers treat it as functionality; the gaps are elsewhere. Neelu points to build systems, development environments and promotion between environments (the supply chain), encryption and network segregation of data stores, observability, and throttling for spikes in access. Supporting systems such as message brokers and caches can be attacked too, so check whether services authenticate to each other and whether their tokens are short-lived.
Neelu Tripathy · Adobe
Where should you start when prioritising security in the SDLC?
Neelu's practical answer is to secure the build systems and build infrastructure first, before the code itself. Then make sure security and compliance requirements reach the backlog, security is automated in the pipeline, and designs are reviewed. In agile teams, stay release-focused (secure a feature like checkout before it ships) and iterate on security with every release.
Neelu Tripathy · Adobe
Why do security tools fail to stop breaches?
Neelu sees no direct correlation between owning tools and avoiding breaches. Tools in blocking mode can overwhelm developers with thousands of findings, many of them false positives, unreachable or not exploitable, so issues stay unfixed; other breaches come from zero days or new changes that pull in libraries. Her answer is to focus on controls rather than detection tools, and to build fixes into the system through automation.
Neelu Tripathy · Adobe
How do you keep product security from slowing down engineering velocity?
Treat velocity as the North Star, since time is currency for fast-moving and agentic teams. First, decide what security systems you can provide, built or bought; second, embed security requirements into concentrated places of engineering power such as pipelines, artifactories, registries and shared storage to reach the most developers. Third, package security so it is easy to consume, like a golden image or an automated upgrade PR from Dependabot or Renovate that developers only need to review and accept.
Neelu Tripathy · Adobe
What security controls does agentic development need?
Beyond the fundamentals, Neelu points to a vetted registry for AI tools and MCP servers, which she treats like dependencies, and to identifying and registering agents so their actions can be traced. She also calls out controls on agent-to-agent and LLM gateway traffic, sandboxed, isolated and ephemeral agent runtimes, and security for context: how it is stored, traced and linked, and what data access it grants an agent.
Neelu Tripathy · Adobe
61 min Ep 110 ·
Adobe's Neelu Tripathy on bridging product security gaps: foundational controls first, then security built into the platforms and pipelines engineers use.
Ashish Bhadouria, Security and Privacy Manager at IKEA, on securing the SDLC in the AI era and defending modern enterprises.
Brad Geesaman on adopting AI in application security, managing non-deterministic LLMs, and knowing when agentic AI fits.
Lalit Kumar on building good and lasting cloud security, transforming AWS India Security, and advising CXOs on cloud posture.
Bonnie Viteri on building a security-champions programme from scratch, enablement vs empowerment, and measuring impact.
Anshuman Bhartiya on product security, risk-driven prioritisation, and building secure-by-default development practices.
Adam Shostack on threat modelling fundamentals, secure-by-design principles, and making threat analysis accessible to all teams.
Jim Manico on safeguarding applications in the AI era, verifying AI-generated code, and applying OWASP best practices on top of frameworks.
Shivani Arni, CISO at TransUnion CIBIL, on emotional intelligence in security leadership and third-party risk management.
Kayra Otaner on DevSecOps, cloud-native security, and unleashing security capabilities without slowing engineering teams.
Matt Tesauro on revolutionising the SDLC with DevSecOps, automation for team velocity, and training security professionals.
François Proulx, Senior Product Security Engineer at Boost Security, on supply-chain security, threat modelling, and SBOMs.
Kalyani Pawar on threat modelling, scaling security with checklists and champions, and celebrating small wins.
Michele Chubirka on restorative justice as a new framework for resolving cybersecurity conflict and restoring team trust.
Kyle Fossum on DevOps and DevSecOps practices, self-serve security tooling, and why hardware security keys beat SMS-based MFA.
Dustin Lehr on application security, threat modelling, and building security-champion programmes through long-term relationships.
Brook Schoenfield on the secrets of effective threat modelling, integrating threat analysis into design, and scaling the practice.
Ariel Shin on balancing production speed with security, the advisory role of security teams, and the value of empathy.
Chris Romeo on application security beyond tools, prioritising with a data-driven approach, and starting with open source.
Jeevan Singh on threat modelling, integrating security into the development workflow, and scaling with limited resources.
New episodes twice a month
Follow Scale To Zero wherever you listen, or send us the question your team is stuck on and we will put it to an expert.