This is a history page. AppSec Labs no longer offers training of any kind, and has not since 2018. Today we do one thing: AppSec Labs is an Israeli application-security company specializing exclusively in penetration testing of web applications, REST APIs, and mobile apps – founded in 2010 by Erez Metula (author of Managed Code Rootkits), based in Kfar Saba, Israel, serving hundreds of organizations worldwide.

We keep this page up because the work was real and substantial, because people still arrive looking for it, and because it explains something about how we test today.

What it was

Between 2010 and 2018 we ran around 500 training sessions for development teams around the world — in-house at software companies, banks, defence and telecom organisations, and at conferences. By the time we stopped, around 5,000 developers had been through a course of ours.

It was hands-on. Developers spent the day attacking deliberately broken applications — and, more usefully, their own patterns — because a vulnerability you have personally exploited is one you stop writing. Two things were taught:

  • Secure coding — how the classes of flaw that matter actually arise in real code: injection, broken authentication and session handling, access-control mistakes, unsafe deserialisation, cryptographic misuse, and the framework-specific traps that generic advice misses.
  • Application penetration testing — teaching testers and developers to think like an attacker: mapping an application’s real attack surface, abusing business logic and workflow, chaining minor issues into serious ones, and distinguishing a finding that matters from one that merely scans badly.

The most visible of it was at Black Hat. Our Android application hacking course ran at Black Hat USA five years running (2010-2018) and at Black Hat Asia — the full record is here, with links to Black Hat’s own archive of every course.

The curriculum came out of our own assessments rather than a syllabus. Our founder had also written Managed Code Rootkits (Syngress) and spoken at Black Hat and DEF CON, and that research fed the material directly — the examples in the room were things we had genuinely found.

Why it ended

We chose to specialise. Training and testing pull a small expert team in opposite directions: one rewards repeatable curriculum and travel, the other rewards depth on unfamiliar systems. We decided the testing was where we were strongest and where our customers needed us most, wound the training down, and have been exclusively a penetration-testing company since 2018.

What it left behind

Teaching around 5,000 developers to break applications changes how you report a vulnerability. It is the reason our findings are written for the person who has to fix them:

  • A finding is only useful if it can be acted on. Years of watching developers read vulnerability reports taught us exactly where they lose the thread — so ours carry reproduction steps, real impact and a concrete fix, not a scanner’s description and a CVSS number.
  • Depth over breadth. Training forced us to explain why a flaw exists, which is the same discipline that finds authorisation and business-logic bugs no tool detects.
  • We speak developer. Our testers have stood in front of engineering teams and defended a finding to the person who wrote the code.

Looking for developer security training today?

We cannot help, but we would rather point you somewhere useful than leave you on a dead page. The OWASP project materials (notably the Web Security Testing Guide and Cheat Sheet Series) remain the best free grounding, and PortSwigger’s Web Security Academy is an excellent free hands-on course. For paid instructor-led training, SANS and local specialists are worth looking at. Ask us and we will happily suggest someone.

What we do now

Expert-led testing of complex authenticated applications – multi-tenant isolation, authorization/BOLA, business-logic and workflow abuse, complex role models – with developer-usable remediation.

If you originally found us through a course and now have an application that needs testing properly, that is exactly the work we do: get in touch. See also our retired tools and the story of Autorize, which was built here and is still going.