OWASP Foundation Courses

A Taste of Privacy Threat Modeling

An introduction to privacy threat modeling through an application security lens.

• YouTube
• 51 minutes
• Self-Paced
• Free Video

Introducing Threat Modeling to Established Teams

An introduction to bringing threat modelling into established teams.

• YouTube
• 57 minutes
• Self-Paced
• Free Video

Attacking and Protecting Artificial Intelligence

A conference talk centered on attacking artificial intelligence and protecting it.

• YouTube
• 55 minutes
• Self-Paced
• Free Video

Why Winning in Cybersecurity Means Winning More Everyday

Jessica Robinson discusses why success in cybersecurity means making security part of everyday life.

• YouTube
• 58 minutes
• Self-Paced
• Free Video

Trusting Software: Runtime Protection as the Third Alternative

Jeff Williams presents runtime protection as a third alternative for building trustworthy software.

• YouTube
• 59 minutes
• Self-Paced
• Free Video

Passwordless Future: Using WebAuthn and Passkeys in Practice

Explains how WebAuthn registration and authentication ceremonies work, and how synced passkeys improve login usability across devices.

• YouTube
• 59 minutes
• Self-Paced
• Free Video

GitHub Actions: Vulnerabilities, Attacks, and Counter-Measures

Examines vulnerabilities in GitHub Actions, the attacks they enable, and ways to counter them.

• YouTube
• 55 minutes
• Self-Paced
• Free Video

TOTPs Are Not As Secure As You Might Believe

A talk examines why time-based one-time passwords may be less secure than commonly assumed.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Credential Sharing as a Service: The Dark Side of No-Code

An AppSec talk examines how credential sharing in no-code platforms can create security risks.

• YouTube
• 54 minutes
• Self-Paced
• Free Video

Server-Side Prototype Pollution: Detection and Exploitation Techniques - OWASP AppSec Dublin

Explore how server-side prototype pollution can disrupt applications, expose code, and be detected and prevented.

• YouTube
• 41 minutes
• Self-Paced
• Free Video

Narrow - SCA Reachability Analysis Without The Effort

A look at making reachability analysis in software composition analysis practical with less effort.

• YouTube
• 56 minutes
• Self-Paced
• Free Video

Ten DevSecOps Culture Failures

Chris Romero outlines ten recurring failures in DevSecOps culture at Global AppSec Dublin.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

More with Less Screen Time: An Application Security Toolchain

A talk on an application security toolchain aimed at achieving more with less screen time.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

Empowering the Guardians of Your Code Kingdom

A Global AppSec talk about empowering the people responsible for protecting software code.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

JavaScript Realms - The Blank Spot in Web Application Runtime Security

A conference talk examines JavaScript realms as an overlooked issue in web application runtime security.

• YouTube
• 35 minutes
• Self-Paced
• Free Video