Uploaded August 2026 | Updated September 2026, 2 weeks ago
Mike challenges a common AppSec recommendation: treating input validation as a first-line solution for vulnerabilities such as SQL injection, XSS, and prompt injection.
His argument is that these problems fundamentally involve separating code from data. Simply pattern-matching inputs or trying to determine whether a prompt matches an expected intent may not address that underlying separation.
The distinction changes where developers should look for the actual security control.
When does input validation genuinely solve a security problem—and when is it just treating the symptom?
Subscribe to our podcasts: securityweekly.com/subscribe
#AppSec #PromptInjection #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec
Mike challenges a common AppSec recommendation: treating input validation as a first-line solution for vulnerabilities such as SQL injection, XSS, and prompt injection.
His argument is that these problems fundamentally involve separating code from data. Simply pattern-matching inputs or trying to determine whether a prompt matches an expected intent may not address that underlying separation.
The distinction changes where developers should look for the actual security control.
When does input validation genuinely solve a security problem—and when is it just treating the symptom?
Subscribe to our podcasts: securityweekly.com/subscribe
#AppSec #PromptInjection #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec
