OWASP Foundation Courses

5 Steps to VEX Success: Managing the End-to-End Workflow

Discover how to implement VEX (Vulnerability Exploitability eXchange) effectively through a five-step workflow to combat CVE overload and streamline vulnerability remediation in your organization.

• YouTube
• 48 minutes
• Self-Paced
• Free Video

AI Code Generation - Benefits, Risks and Mitigation Controls

Explore the benefits and risks of AI code generation tools, including security vulnerabilities, quality issues, and potential biases, while learning effective mitigation strategies for safe implementation.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Self-Discovering API Key Permissions and Resources

Discover a new method for enumerating API key permissions and resources without accessing provider UIs. Learn to assess SaaS provider permissions through string analysis and HTTP request techniques, with a demo of an open-source automation tool.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Escaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams

Discover practical solutions to "Vulnerability Hell" through AI, penetration testing, and improved collaboration between developers and security teams for more effective web application security.

• YouTube
• 1 hour 6 minutes
• Self-Paced
• Free Video

Striding Your Way to LINDDUN: Threat Modeling for Privacy

Explore the LINDDUN privacy threat modeling framework to identify, analyze, and mitigate privacy risks in software systems, enabling privacy by design through a practical demonstration with a fictional application.

• YouTube
• 48 minutes
• Self-Paced
• Free Video

Slack's Vulnerability Aggregator: Managing Vulnerabilities at Scale

Discover how Slack built a vulnerability aggregation platform to centralize findings, standardize processing, and streamline reporting across their ecosystem, addressing challenges in managing vulnerabilities at scale.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Under the Radar: How We Found 0-days in the Build Pipeline of OSS Packages

Discover how to identify vulnerabilities in Open Source build pipelines through data analysis, with examples from AWS, Google, RedHat, and GitHub Actions, plus tools for detection and training.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

OWASP Top 10 for Large Language Models: Project Update

Discover the progress of OWASP's Top 10 for LLMs project, from its widespread adoption to the development of version 2, and learn how to contribute to this critical initiative shaping AI security standards.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Millions of Public Certificates Are Reusing Old Private Keys

Uncover the alarming trend of TLS certificate private key reuse, affecting millions of certificates and undermining web security, with insights from a study of 7 billion certificates and 58 million GitHub SSH keys.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

I Know What You Did Last Summer: Lessons Learned from Privacy Breaches and Scandals

Explore privacy breaches beyond typical security threats, from major scandals to smaller incidents, and learn actionable strategies to integrate privacy design into your security practices.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

Don't Make This Mistake: Painful Learnings of Applying AI in Security

Explore the challenges of AI in security through real-world examples, revealing limitations in auto-remediation and introducing the RAG Framework as a more reliable approach for responsible AI deployment.

• YouTube
• 41 minutes
• Self-Paced
• Free Video

Threat Modeling in the Age of AI

Discover how to identify and manage security risks in AI systems through systematic threat modeling. Learn methodologies to protect against AI-specific attacks like data poisoning and prompt injection from an OWASP AI Exchange expert.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

How to Get Developers to Want to Adopt AppSec

Discover a framework for AppSec leaders to integrate security into development processes, fostering developer adoption while maintaining velocity and translating security concerns into engineering priorities.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Learning to Build an Effective Security Design Review Program

Discover how to create a successful security design review program from scratch, with insights from 300+ reviews, proven strategies, and ready-to-implement materials for your organization.

• YouTube
• 40 minutes
• Self-Paced
• Free Video

The Broken State of DevSecOps and Its Maturity Model

Explore the gap between DevSecOps theory and practice, examining why current maturity models fail and how to implement meaningful cultural shifts and empower security champions for effective vulnerability management.

• YouTube
• 40 minutes
• Self-Paced
• Free Video