AppSec, Shopify-Style; State of Mobile Security; the News - Andrew Dunbar, Kern Smith - ESW #470

After 13 years at Shopify, Andrew has some valuable insights to share on application security. In this episode, we discuss how AI has changed application security processes where bug bounty now fits in a post-Mythos, post-AI harness world.

Andrew's Resources:

• https://shopify.engineering/building-an-agentic-harness-that-outlasts-the-model

Kern Smith, VP of Global Solutions at Zimperium, joins us to talk about the state of mobile security. This was a great conversation, talking about the history of mobile devices in the enterprise and how challenging securing mobile apps is in the age of vibe-coding.

Segment Resources

• https://zimperium.com/resources/new-zimperium-research-reveals-that-ai-based-attacks-are-targeting-and-succeeding-on-mobile
• Global Mobile Threat Report 2026

Finally, in the enterprise security news,

1. Pre-black hat funding goes nuts
2. we have 4 new cybersecurity unicorns!
3. Cyera acquires Oasis for one BILLION dollars
4. Lots of new product announcements with hacker summer camp next week
5. Hugging Face got hacked by a competitor's agent and are cool with it?
6. Finding out that wiping a burner phone is illegal the week before DEF CON is not ideal
7. Are open, local models the future of AI?
8. AI isn't coming for your job
9. lots of vendor reports
10. bad cybersecurity takes are apparently mainstream memes now???

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-470