I was on the podcast "Who is Agile", check out my episode "Saying no..." https://twp.ai/9PY8eW

How To Get Your First Job In #Cybersecurity: a blog post of all the steps you need to transition into #InfoSec! https://twp.ai/9PYTFH

I post on #CyberMentoringMonday when I remember to, and I’m happy to help out students as well! I’m not a CISO or founder or anything exciting and glamorous, but I’ve got a decade of experience building software and another 6 years securing it.

Insecure code? Need some training? Call me! Funny memes included! https://twp.ai/9PX67U

It happens to us all

It is Friday. PLEASE tell me your best cyber puns. 🙏 I shall start: Where did the hacker go? She ransomware. Womp womp! Send me your groaners!

Random Tanya Thoughts on Video: securing vibe coded apps built by non-software engineers. How do we handle that????? https://twp.ai/9PYWuo

OWASP Vancouver is kicking off with Greg Sienkiewicz speaking about #devsecops and pizza!!!!

When should security not block a release? Or should it never block? What is worthy of a block? Or, should we have fixed things before the CI? What are your thoughts? #talkappsectome 

FOLKS! The audiobook of Alice and Bob Learn Secure Coding is OUT on @audible now! If you buy it and like it, please rate it for me? I'm so pleased it's finally available. https://twp.ai/9PYWwR

"Malicious packages in npm evade dependency detection through invisible URL links: Report" Article by Howard Solomon, with quotes from me. https://twp.ai/9PY4ZG

I was on Darknet Diaries Ep. 165! Learn about dumb buildings with malware, how going to the dentist can get you in hot water, and that sharing breach information can you get buy in with software developers. YouTube: https://twp.ai/9PYFFl Or any podcast platform

How do we get people who are now releasing software, who previously did not because they don't have the skill, to care about Security? People who aren't software engineers. How do we reach them? How do we secure them? I need your advice. #appsec #ai youtu.be/Zj1uwsmWuAw?...

I hosted a webinar -> Metrics, Models, and Mindsets: A Conversation About the Future of AppSec, with my friends Spyros from Smithy and Aram! Blog post and video at the link. https://twp.ai/9PYJUk

It's difficult for me to express in words just how frustrating it is when Microsoft, Google, AND Apple try (constantly) to force me to save online (onto THEIR cloud) instead of locally, removing my options. I literally HATE it. Stop taking away my choices. Like if you agree.

It’s #CyberMentoringMonday!!!! Are you looking for a professional mentor or to learn more about InfoSec? Are you experienced and willing to ‘give back’? Use this thread and hashtag to connect!

I wrote a blog and made a video about the Vibe Check panel I was on at #SectorCA in Toronto. It talks about vibe coding, helping AIs create more secure code, and how to find shadow AI in your code! https://twp.ai/9PWWng

Android just suggested that I delete my memes to save space. Me: 😱😡🥺😥😵🤮

I was quoted in the following article by Howard Solomon: Self-propagating worm found in marketplaces for Visual Studio Code extensions. WOW supply chain attacks are becoming truly terrifying! https://twp.ai/9PWdEc

The Elephant in AppSec: Why AppSec Is breaking: Vibe Coding, DevSecOps backlogs & the new OWASP Top 10 Video: https://twp.ai/ImseWy Audio: https://twp.ai/E6DPKu

The famous "Try it now"

Compare and save? https://twp.ai/9PVfdy

Please join me this Friday (November 14, 2025 @ 3:30-4:30pm EST), LIVE on the Mindful Business Security Podcast to talk “Developing software safely and securely” with amazing host Matt Gehrisch!!! Bring your questions, concerns and comments! Let's talk!. https://twp.ai/9PYArF

What's the hardest part about scaling security in a fast-moving dev org? Please also give me tips of how to succeed anyway, if you can! If not, hopefully others will offer advice in the thread. :-D #talkappsectome 

Software Supply Chain: Bigger (and Scarier) Than We Realize - a blog post by meeeeeee! When we talk about the software supply chain security, most people think only of dependencies (open-source libraries and frameworks). https://twp.ai/9PYFTC #appsec #supplychain 1/2

Please join me this Friday (November 14, 2025 @ 3:30-4:30pm EST), LIVE on the Mindful Business Security Podcast to talk “Developing software safely and securely” with amazing host Matt Gehrisch!!! Bring your questions, concerns and comments! Let's talk!. https://twp.ai/9PYDwL

Big news in #AppSec: the #OWASP Top 10 2025 is now available! I'm part of the project team and ALL OF US want every dev, security engineer, and leader to read it (please). https://twp.ai/E6DVzW#AppSec:#OWASP1/5

We, as an industry, need to start giving very specific and clear advice, if we want to have better outcomes. No more high level, vague, and ambiguous advice please. #SpecificSecurity #BeSpecific https://twp.ai/ImslCp#SpecificSecurity#BeSpecific/2

Thank you to everyone who came to the #appsecdinner last week in Washington, DC with Jason Haddix, Daniel Miessler and me. I had a ton of fun, and appreciate you all taking the time!

#cybermentoringmonday Any takers? 🌞🌞🌞

Please join me this Friday (November 14, 2025 @ 3:30-4:30pm EST), LIVE on the Mindful Business Security Podcast to talk “Developing software safely and securely” with amazing host Matt Gehrisch!!! Bring your questions, concerns and comments! Let's talk!. https://twp.ai/9PYDpQ

The latest edition of the SheHacksPurple Nerd-a-licious newsletter is out! This month, sponsored by Palo Alto Networks, we cover: newsletter.shehackspurple.ca/p/shehackspu... * The NEW #OWASP Top Ten! * Darknet Diaries episode 'Tanya'

I still need at least one more person to be a caller on my call-in-radio style podcast to ask a question about appsec and secure development practices on Friday this week. @shehackspurple.bsky.social will join me to answer caller questions!

I was on Darknet Diaries Ep. 165! Learn about dumb buildings with malware, how going to the dentist can get you in hot water, and that sharing breach information can you get buy in with software developers. YouTube: https://twp.ai/9PYGmd Or any podcast platform

It’s #CyberMentoringMonday!!!! Are you looking for a professional mentor or to learn more about InfoSec? Are you experienced and willing to ‘give back’? Use this thread and hashtag to connect!

I'm hosting a free webinar, 'Metrics, Models & Mindsets: The Future of Application Security!', with Spyros Gasteratos and Aram Hovsepyan on Nov 12 · 8:30 AM PST. Wanna come? https://twp.ai/9PWkQ5

My talk from @defcon.bsky.social is finally out! Watch 'Secure Code Is Critical Infrastructure: Hacking Policy for Public Good' here: https://twp.ai/9PWUSj If you like it, please give it a thumbs up. 👍

We, as an industry, need to start giving very specific and clear advice, if we want to have better outcomes. No more high level, vague, and ambiguous advice please. youtu.be/XXtEpRN3ePc?... #SpecificSecurity #BeSpecific #appsec #cybersecurity

Application Security / #AppSec / #appsecurity is a key area in modern #CyberSecurity. Particularly with so many non-tech folk now building Web apps using #AI. If you're building apps I highly recommend reading the books by Tanya Janca @shehackspurple.bsky.social They have helped me a lot!

I'm a big fan of https://twp.ai/9PY1su, but I don't love receiving breach notifications when I'm IN them! 😥 https://twp.ai/4ismgq

Want to learn the absolute basics of application security? Check out this helpful YouTube playlist! #appsec

Dustin Lehr is helping us secure our apps, in a more friendly way! @katilyst at #owasp #globalappsec

It serves us all!

Adam Shostack is kicking off day 2 of #owaspglobalappsec with a conversation on the limits of risk. 🥳

"Malicious packages in npm evade dependency detection through invisible URL links: Report" Article by Howard Solomon, with quotes from me. https://twp.ai/9PWt48

I'm doing a book signing (free books!) at the Smithy booth at #owaspglobalappsec, at 3:00 pm this afternoon! Come join me in the vendor area for books, stickers and conversations!

What makes a “security champion” successful in a dev team? What makes them good at it? What makes a bad one? How can you tell if it's going well or not? #talkappsectome 

Daniel Miessler is kicking off #owaspglobalappsec with a talk about where everyone's career is going with the changes from AI. @DanielMiessler @owasp

Come see my talk with Neil Smithline about the new OWASP Top Ten, at #owaspglobalappsec, at 10:15 this morning!

Looking forward to this. www.youtube.com/watch?v=dU9u...