Relating to DevSecOps
Episodes
Episode #082: AI Hype, Human Cost
17 Mar 2026
Contributed by Lukas
Send a textKen and Mike are back from the grave to kick off 2026 with a timely debate on the AI panic cycle hitting software and security. They dig in...
Episode #081: Burnout by Budget Season: Surviving Q4 in Security
29 Oct 2025
Contributed by Lukas
Send a textIn this candid and cathartic episode, Ken and Mike unpack the chaos that is Q4 for security professionals. From budget burnouts to end-of-y...
Episode #080: Patch Me If You Can: Compliance, SLAs, and Other Fairytales
25 Aug 2025
Contributed by Lukas
Send a textIn this no-punches-pulled return from hiatus, Ken and Mike dig deep into the messy middle of vulnerability management, SLA fatigue, and the...
Episode #079: CISOver It: When Dashboards Replace Direction
10 Jun 2025
Contributed by Lukas
Send a textIn this episode of Relating to DevSecOps, Ken and Mike discuss the challenges faced by CISOs in today's security landscape, particular...
Episode #078: 🔥 Burn Your 30-page Policies: Tanya’s Got Better Ideas
22 Apr 2025
Contributed by Lukas
Send a textIn this must-listen episode of Relating to DevSecOps, Ken welcomes the ever-inspiring Tanya Janca, aka SheHacksPurple—author, AppSec expe...
Episode #077: Is Google Eating the Cloud? 🔥 Wiz.io Acquisition Hot Takes
24 Mar 2025
Contributed by Lukas
Send a textIn this episode of Relating to DevSecOps, Ken Toler and Mike McCabe dive deep into Google's blockbuster acquisition of Wiz.io for a re...
Episode #076: ShmooBalls & Open Source Brawls: DevSecOps, Risk, and the Final ShmooCon
04 Feb 2025
Contributed by Lukas
Send a textWelcome to 2025! Ken and Mike kick off the new year with their security resolutions (or lack thereof) before diving into the bittersweet fa...
Episode #075: Ghosts of DevSecOps: Past, Present, and Future
24 Dec 2024
Contributed by Lukas
Send a textIn this special holiday-themed episode of Relating to DevSecOps, hosts Ken and Mike channel their inner Dickens with a retrospective journe...
Episode #074: Battling Budgets in Security
09 Dec 2024
Contributed by Lukas
Send a textIn this episode of Relating to DevSecOps, hosts Ken and Mike tackle the complex challenges of managing security budgets in organizations of...
Episode #073: Staffing Security in DevSecOps
21 Oct 2024
Contributed by Lukas
Send a textIn this episode, Ken and Mike discuss the pressing issue of staffing security in the DevSecOps field. They explore the challenges of findin...
Episode #072: Measuring the Immeasurable: The Power and Pitfalls of Metrics in DevSecOps
28 Aug 2024
Contributed by Lukas
Send a textKen and Mike dive deep into the world of metrics and measurement in the context of security and DevSecOps. They explore the critical role m...
Episode #071: Retro Vibes with Retrospectives
19 Jun 2024
Contributed by Lukas
Send a textKen and Mike discuss the importance of postmortems in incident response and security incidents. They explore the definition of postmortems,...
Episode: #070: Putting da BOM in SBOM and SCA
08 May 2024
Contributed by Lukas
Send a textKen and Mike discuss supply chain security, including software composition analysis (SCA) and software bill of materials (SBOM). They highl...
Episode #069: Your SaaS is Grass
20 Mar 2024
Contributed by Lukas
Send a textIn this episode Mike and Ken dive into the wild world of SaaS products in DevSecOps. From vendors to security tooling hygiene they cover an...
Episode #068: Data Breaches and DevSecOps
21 Feb 2024
Contributed by Lukas
Send a textWith pep and full youtube energy Ken and Mike discuss the findings of the IBM "Cost of a Data Breach" report and its implications...
Episode #067: Welcome to 2024! AppSec Resolutions and A Smhoocon Recap
26 Jan 2024
Contributed by Lukas
Send a textKen and Mike discuss their new year's resolutions related to application security. They also reflect on the impact of AI and its adopt...
Episode #066: Exploration of the Shifting Definition of Shifting Left
05 Dec 2023
Contributed by Lukas
Send a textWe are joined by incredible guests Mikhail Chechik and Marcus Hallberg as they help us define DevSecOps and emphasize the importance of a s...
Episode #065: LASCON 2023 Recap - AI, a Misunderstood Menace or Magic Bullet
10 Nov 2023
Contributed by Lukas
Send a textOn this episode of R2DSO Mike and Ken dive into their takeaways and experiences from LASCON 2023 in Austin, TX where AI was both a problem ...
Episode #064: Don't Instigate, Mitigate!
25 Sep 2023
Contributed by Lukas
Send a textIn this episode Ken and Mike dive directly into the meat with solutioning and mitigation. All too often security professionals finding them...
Episode #063: Unscrambling CloudSecSoup with CSPM, Vuln Management, SIEMs, and Log Aggregators
05 Sep 2023
Contributed by Lukas
Send a textIn today's episode, we untangle the web of alphabet-soup technologies: CSPM, VM, SIEM, and Log Aggregators. We go beyond the buzzwords...
Episode #062: Cyber Sentinels: Ken and Mike in the DevSecOps Labyrinth
07 Aug 2023
Contributed by Lukas
Send a textDive headfirst into AppSec and Terraform security with Ken and Mike in this electrifying podcast episode. They demystify complex security...
Episode #061: Fossilized Code & Future Clouds: Contrasting Worlds of Balance in Legacy Applications
18 Jul 2023
Contributed by Lukas
Send a textKen and Mike dive into the exciting world of modern application and cloud security, with a keen focus on the challenges posed by legacy sys...
Episode #060: Precise Angles for Automation in DevSecOps Adventures
22 Jun 2023
Contributed by Lukas
Send a textIn this captivating episode of R2DSO hosts Ken and Mike embark on an exploration of security automation in the realms of application and cl...
Episode #059: DevSecOps Pentesting, Possible or Preposturous?
08 Jun 2023
Contributed by Lukas
Send a textIn this action-packed episode, Ken, Mike, and Izzy (Ken's cat) dive headfirst into the wild world of DevSecOps Penetration Testing –...
Episode #058: Merging Your Mergers without Git Merge
01 Jun 2023
Contributed by Lukas
Send a textMike and Ken dive into the exciting topic of Mergers and Acquisitions. Take a bit of time out of your day to join them in their exploration...
Episode #057: Security Without Compromise!
19 May 2023
Contributed by Lukas
Send a textJoin Mike and Ken as they discuss collaborative security work and what working together looks like in enterprise and organizations. In an e...
Episode #56: Respond Well in Incident Response with DevSecOps
21 Apr 2023
Contributed by Lukas
Send a textJoin Mike and Ken in their discussion about Incident Response and how it fits into the DevSecOps world and arena. Incident Response, loggin...
Episode #055: Engineering Empathy with Hecber Cordova
31 Mar 2023
Contributed by Lukas
Send a textWe dive back into bringing guests onto the show focusing on real problems with real people on the ground. In this episode, we are joined by...
Episode #54: ChatGPT's Cryptic Insights: AI in Security for Developers and Operations Teams
23 Mar 2023
Contributed by Lukas
Send a textIn this episode, Mike and Ken will dive deep into the world of ChatGPT and explore how it can be used to generate code for developers and o...
Episode #053: DevSecOps on the Emerald Isle: Insights from Global OWASP AppSec Dublin, with a Side of Guinness and Frustrations with Application Security Vendors
08 Mar 2023
Contributed by Lukas
Send a textIn this episode, our hosts recap the Global OWASP AppSec Dublin conference and share insights into interesting talks about DevSecOps. They ...
Episode #052: Dude! Where's My Stuff? Application Inventory and Service Discovery
07 Feb 2023
Contributed by Lukas
Send a textToday's episode covers one of the most common problems for software development teams and their security partners. Application Invento...
Episode #051: Hiring for DevSecOps in 2023!
14 Jan 2023
Contributed by Lukas
Send a textHappy New Year! Another year of DevSecOps fun as we head into an unpredictable and volatile security market, Ken and Mike talk hiring and t...
Episode #050: The Evolution of Data Security in DevSecOps
03 Dec 2022
Contributed by Lukas
Send a textWe hope all of the turkey comas have worn off! These holiday delays are almost over, and in the meantime here we are with the second part o...
Episode #049: IAM! The Myers Briggs of DevSecOps
24 Oct 2022
Contributed by Lukas
Send a textIt's been tough getting together with the end of year madness, but we're back again after another unanticipated delay. In this ep...
Episode #048: Threat Modeling doesn't need to feel like pain and sorrow
16 Sep 2022
Contributed by Lukas
Send a textWe are back from vacation! Pick up where you left off as we jump back into DevSecOps with threat modeling experiences, lessons, and percept...
Episode #47: Geese aren't the only things migrating in the cloud, but we're more secure at least
08 Aug 2022
Contributed by Lukas
Send a textOne thing Mike and Ken have talked about at length at conferences, in board rooms, and in team chats is migrating workloads to the cloud se...
Episode #046: Security Spiderwebs with Kubernetes and how Cloud helps (and hurts)
11 Jul 2022
Contributed by Lukas
Send a textWe are BACK! after a hiatus of vacations, illness, and family gatherings, but while we may have been absent we are at no shortage of words ...
Episode #045: What is DevSecOps in 2022 an R2DSO anniversary redux
10 Jun 2022
Contributed by Lukas
Send a textMike and Ken take it back to the roots with a special anniversary episode on what is DevSecOps. Since we started this podcast we've ha...
Episode #044: Multiball Pinball with Multicloud Hot Takes and Infrastructure as Code
21 May 2022
Contributed by Lukas
Send a textMike and Ken are BACK after a small hiatus and they jump into hot takes on multi-cloud. What does multi-cloud even mean? How does it differ...
Episode #043: Security leaves the cave to go to Miami with the Blockchain People and this episode happened
20 Apr 2022
Contributed by Lukas
Send a textKen had a chance to attend a blockchain conference for Solana out in Miami and Mike hops into the interviewer seat. We talk about some di...
Episode #042: Perscription Lenses or Sunglasses for Eyes on Code
31 Mar 2022
Contributed by Lukas
Send a textIn this Episode we talk about the differences in code review depending on role and how you can be a better code reviewer on the "blue&...
Episode #041: Holistic Cloud Medicine in the Face of the Modularization of Cloud Components Affects Applications
16 Mar 2022
Contributed by Lukas
Send a textA continuing trend in cloud and application security has been the modularization of application functions that offloads the developer respo...
Episode #040: Over the hill with blockchain and DevSecOps with digital money
25 Feb 2022
Contributed by Lukas
Send a textIn this episode we introduce the general concepts of security in cryptocurrency in blockchain, what we see in our day to day with regard to...
Episode #039: Cloud Metal Detectors with Monitoring and Logging
16 Feb 2022
Contributed by Lukas
Send a textIn this episode we cover another security perspective on logging and monitoring in the cloud as opposed to web applications specifically. W...
Episode #038: Layers of the DevSecOps Onion, are we reversing time?
02 Feb 2022
Contributed by Lukas
Send a textIn this episode Mike and Ken talk about the magic of software defined things and how skill crossover is becoming a thing of the future. May...
Episode #037: New Year, New Security what can you do to level up?
19 Jan 2022
Contributed by Lukas
Send a textHappy New Year from R2DSO as we head into 2022. In this Episode we bring back Michael McCabe for a more permanent role on the show! Super e...
Episode #036: Trending Topics from Terraform to Testing
07 Dec 2021
Contributed by Lukas
Send a textIn this alliterative episode we bring back Mike McCabe to wrap up a security year in consulting with common trends and successes in securit...
Happy Holidays from R2DSO!
24 Nov 2021
Contributed by Lukas
Send a textWe've had a bit of an end of year rush so just wanted to give listeners a preview of what's to come in the next few episodes. We&...
Episode #035: Successful Unit Testing Through Collaboration with Your Unit
02 Nov 2021
Contributed by Lukas
Send a textWe know, we know! It's been too long between episodes, but we had some speaking engagements, conferences, and general life going into ...
Episode #034: Attack of the Git PR through K8s
11 Oct 2021
Contributed by Lukas
Send a textIn this episode we squeeze one more git topic out with an attack through a PR. Based on a recent article posted on https://cloudseclist.com...
Episode #033: Getting out of git by branching out with branching strategies
21 Sep 2021
Contributed by Lukas
Send a textBad puns end this series with branching strategies and git. We start with Simon's preferred approach from a product engineering strate...
Episode #32: Hooks, Kits, and Git - putting security into your git pipeline
07 Sep 2021
Contributed by Lukas
Send a textIn this episode we cover a few technical topics, but primarily how to get started with getting security into your git pipeline through git ...
Episode 031: Git Security Done with Git
17 Aug 2021
Contributed by Lukas
Send a textWe head into an unknown number of episodes around git. In this episode we introduce git and common security concerns to folks who may be un...
Episode #030: Blueprints, Reference Architectures, and Plans - Building Apps Securely
26 Jul 2021
Contributed by Lukas
Send a textIn this episode we chat blueprints, security patterns, reference architectures, and plans. Basically what we've seen in terms of the l...
Episode #029: Does anyone REALLY do DevSecOps, and succeed?
06 Jul 2021
Contributed by Lukas
Send a textIn this somewhat makeshift, low-power episode recorded during the NYC power grid strain we do our best at getting inventive with recording ...
Episode #028: Non-technical management and Email as your IDE
22 Jun 2021
Contributed by Lukas
Send a textEpisode number 28 moves us back to a more people focused topic as we dive into technical vs non-technical management, leadership, managemen...
Episode #027: Hot Takes on Blogs: Part I - Are QA, BA, and DBAs Dead?
03 Jun 2021
Contributed by Lukas
Send a textIn this react video of a podcast we have a look at a recent blog post on whether the QA, DBA, and BA jobs are going away in favor of more c...
Episode #026: Starting right by shifting left - what to do at build time
21 May 2021
Contributed by Lukas
Send a textAfter such a fun conversation last week, we bring Mike back in to discuss applying security at build time and what we can do with infrastru...
Episode #025: Warm blankets around your cloud with CSPM and Michael McCabe
11 May 2021
Contributed by Lukas
Send a textEpisode 25 is all about CSPM and our good friend Michael McCabe. Mike has a ton of experience securing application and cloud workloads and ...
Episode #024: The first line of defense for MicroServices - AUTH
26 Apr 2021
Contributed by Lukas
Send a textAnd that means authentication and authorization. Once you start splitting up the monolithic apps and iterating faster and faster, how does ...
Episode #023: A call back to Microservices - do we even get it yet?
10 Apr 2021
Contributed by Lukas
Send a textKen and Simon talk engineering and security ramifications of microservices, why organizations choose to split up their treasured applicatio...
Episode #22: From Engineer to CTO and what security means along the way w/ Jonathan Schwartz
12 Mar 2021
Contributed by Lukas
Send a textAn exciting episode indeed! Jon Schwartz the CTO of Jetty joins us in a discussion about security through his career, leadership guidance, ...
Episode #021: An Outside-In Look at Application Inventory
26 Feb 2021
Contributed by Lukas
Send a textKeeping with the SecOps theme the crew discusses Application Inventory, arguably the most important part of any successful application secu...
Episode #20: Security Operations ain't what it used to be
14 Feb 2021
Contributed by Lukas
Send a textSimon, Ken, and Jamieson ponder what Security Operations brings to the table and discuss some of the misconceptions around responsibilities...
Episode 019: Welcome to 2021 - R2DSO goes visual and more
25 Jan 2021
Contributed by Lukas
Send a textWith Jamieson out of commission, Simon and Ken chat and relfect on 2020. In this episode we cover some of our favorites and look towards th...
Episode #18: Was 2020 just a giant Chaos Engineering Experiment? Part Deux: Tooling and Security Experiments
22 Dec 2020
Contributed by Lukas
Send a textIn our final episode of 2020 we dive into chaos engineering tools with a focus on security and unpack the differences between penetration t...
Episode #017: Chaos in your Engineering, what to do if Zombies attack your cloud
04 Dec 2020
Contributed by Lukas
Send a textIn this episode we talk about Chaos Engineering, what it is, what it isn't, our thoughts on what chaos really means and how we approac...
Episode #016: Terraform CDK, finishing the Infra as Code series with its final form?
11 Nov 2020
Contributed by Lukas
Send a textWe wrap up this series with a talk through the terraform cdk and our initial reactions of the project and product. We all learned a ton thr...
Episode #015: Quest to Terraform CDK through the Amazon CDK
01 Nov 2020
Contributed by Lukas
Send a textIn our quest to discuss and debate the usefulness of the Terraform CDK we take a pit stop at the Amazon CDK and Cloudformation. All of us h...
Episode #014: Approaching Terraform and other "as-code" fun
17 Oct 2020
Contributed by Lukas
Send a textWe've listened to your feedback and started diving into infrastructure as code starting with terraform, our experiences learning it fo...
Episode #013: How a backend engineer looks at XSS
03 Oct 2020
Contributed by Lukas
Send a textSimon gives his perspective on Cross-Site Scripting (XSS) and we dig into some of the common protections. We also cover different views bet...
Episode #012: What DevSecOps means to a SCRUM master with Jenn Molyneaux
24 Sep 2020
Contributed by Lukas
Send a textJenn Molyneaux joins the crew as the very first guest! ( https://bit.ly/3ctCLJu ). Jenn is a Senior SCRUM Master who brings her wealth of e...
Episode #011: Bugs vs Vulns - what's your opinion?
18 Sep 2020
Contributed by Lukas
Send a textSecurity and Engineering go head to head in a conversation about bugs vs vulnerabilities and where we think they should fall in the grand s...
Episode #010: Security Configs, Default Configs, and other decisions we regret
11 Sep 2020
Contributed by Lukas
Send a textThis episode we riff on some of the hotter topics we discussed during Episode 9 as we cover security misconfigurations, default misconfigur...
Episode #009: OWASP Top 10: Awareness, not Measurement
04 Sep 2020
Contributed by Lukas
Send a textIn this episode we cover the OWASP Top 10, a popular security awareness document and how DevOps and Product Engineering are typically expos...
Episode #008: Testing Depths of the DevSecOps River with Both Feet
19 Aug 2020
Contributed by Lukas
Send a textThere are so many types of tests across DevSecOps and we try to cover as many as possible from SAST to Contract testing. Simon covers his d...
Episode #007: Service Mesh, more than a Sean Connery sidecar to your Indiana Jones App
12 Aug 2020
Contributed by Lukas
Send a textIn this episode we get back to tech in the DevOps centric topic of Service Mesh. Ken and Simon chat with Jamieson about concerns and first ...
Episode #006: How Engineering Titles Affect Your Communication with Development and Product Engineering Teams
05 Aug 2020
Contributed by Lukas
Send a textIn this episode we take another people centric approach with Simon Dollo as we explore the difference between developers and product engine...
Episode #005: Know Your Audience, the Face of Documentation and Training in a DevSecOps World
31 Jul 2020
Contributed by Lukas
Send a textIn this episode we discuss product engineering security Easter eggs and try to stay on track talking about how to get other departments and...
Episode #004: Be careful with your logs aka a hand grenade with a dictionary attached to it
22 Jul 2020
Contributed by Lukas
Send a textThis time on Relating to DevSecOps we cover application logging, how it's viewed by different teams and what those teams are looking t...
Episode #003: Bookending DevSecOps starting with Threat Models
08 Jul 2020
Contributed by Lukas
Send a textStarting on the left side of the SDLC, we talk about Threat Modeling experiences from all perspectives and the fundamental issues with chec...
Episode #002: A Product Engineering Perspective on DevSecOps
30 Jun 2020
Contributed by Lukas
Send a textSimon Dollo joins the crew and brings his product engineering perspective to the burning question "What is DevSecOps?" We explore...
Relating to DevSecOps #001: What is DevSecOps?!
23 Jun 2020
Contributed by Lukas
Send a textJoin us on our first episode of relating to DevSecOps where we introduce the first two co-hosts of 3 recurring players, Jamieson Colburn, r...