What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E. Schoenfield, CTO of Rezliant and author of Securing Systems, returns to warn about "the illusion of omniscient perfection," the cheerful confidence that makes AI output feel finished, and the "learned fragility" that sets in when nobody understands the code anymore. He, Chris, and Robert debate whether an AI threat model that gets 90% of the way there is a win, how Brook now uses AI for reachability analysis, and why prompt injection traces back to a 1975 design principle we ignored. They ask what architecture even means in the age of AI, where the next generation of architects will come from if nobody writes code, and why the collapsing cost of fixes means it's time to stop chasing vulnerabilities.
This episode is sponsored by Security Compass. Make modern software development secure, consistent, and provable.
About Security Compass
AI writes code faster than anyone reviews the design. Threats do not wait for an annual assessment. Security Compass models threats continuously and turns them into requirements developers act on, not a report read after ship.
→ Learn more about securing the AI-DLC with Security Compass
This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.
About Corgea
Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely.
→ Learn more about Corgea
Connect with Brook S.E. Schoenfield:
→ Brook S.E. Schoenfield on LinkedIn
→ brookschoenfield.com
Mentioned in this episode:
→ Rezliant
→ Securing Systems: Applied Security Architecture and Threat Models by Brook S.E. Schoenfield
→ Saltzer and Schroeder: "The Protection of Information in Computer Systems" (1975)
→ Izar Tarandach on LinkedIn
→ Dwarkesh Patel: "The Rise and Fall of Agent Civilizations" (essay on the OpenAI–Hugging Face incident)
→ Kadrey v. Meta (2025 fair use ruling on AI training)
Follow the Application Security Podcast:
➜ Home: appsecpodcast.com
➜ X: @AppSecPodcast
➜ LinkedIn: The Application Security Podcast
➜ YouTube: @ApplicationSecurityPodcast
➜ Instagram: @appsecpodcast
➜ Facebook: Application Security Podcast
Chapters:
00:00:00 - Cold open — The illusion of omniscient perfection
00:00:48 - Welcome back, Brook S.E. Schoenfield
00:01:51 - AI is writing code and filling the security skills gap
00:06:18 - Can AI threat model as well as the experts?
00:08:46 - Is 90% of the way there good enough?
00:13:47 - Closing one weakness beats chasing perfection
00:16:33 - When AI threat modeling is enough, and when it isn't
00:17:54 - Learned fragility
00:19:26 - Embrace securing AI or be left in the dust
00:23:41 - Against set and forget: agent drift and AI ethics
00:29:30 - What does architecture mean in the age of AI?
00:30:29 - Mixing control and data planes: the root of prompt injection
00:32:49 - Reachability: how Brook threat models with AI today
00:35:08 - Diagram drift and inclusive threat modeling
00:38:46 - Will developers disappear and architects emerge?
00:41:00 - The cost of code has collapsed
00:44:33 - Where will the next architects come from?
00:49:15 - Final thoughts: stop chasing vulnerabilities
