Securing Software's Journey with the OWASP SPVS - Ido Geffen, Rohan Ravindranath, Cameron W., Farshad Abasi - ASW #378

This episode of Application Security Weekly dives deep into the OWASP Secure Pipeline Verification Standard (SPVS), a new framework co-created by Farshad Abassi and Cameron Walters to address the growing security risks in CI/CD pipelines. The conversation explores why SPVS was needed beyond existing standards like the OWASP Top 10, emphasizing its broad scope—from code inception to deployment—and its focus on modern threats like AI-driven development and supply chain attacks. The guests highlight how SPVS introduces maturity levels, community-driven feedback, and AI-specific controls to tackle agentic engineering, AI bombs, and unpredictable AI behavior. They also discuss real-world applicability, using the Axios/NPM breach as a case study, and stress the importance of 'upgrade with intent' over passive cooldowns. Later segments feature Rohan Ravindranath on Zero Trust as Code, advocating for embedding security policies into infrastructure pipelines with automated drift detection, and Ido Geffen of Novi Security, who presents an AI-powered penetration testing platform that goes beyond vulnerability scanning by offering exploitability validation, full transparency, and custom remediation guidance—especially for business logic flaws and AI components.