OWASP Global AppSec USA 2026: Full Schedule

arrow_back View All Dates

10:30am PST

Losing Context: Breaking & Binding MCP Sessions

Friday November 6, 2026 10:30am - 11:15am PST

Session Access Control – The Missing Validation Layer The Model Context Protocol (MCP) specification explicitly distinguishes sessions from authentication but provides minimal prescriptive guidance on authorization enforcement. This talk explores the theoretical security implications of this design, where session IDs function similarly to bearer tokens but often lack the granular security controls required for enterprise-grade deployments.

The SDK Security Gap: An analysis of current MCP SDK implementations reveals an inconsistency in how session security is handled. While the specification provides various validations, most SDK implementations provide only basic checks, leaving critical validation decisions to developers without clear documentation or guidance.

Session Hijacking in MCP – Attacks and Mitigations We will examine how session hijacking attacks apply to MCP’s stateful transport model. Through concrete architectural examples and demonstrations of three High Severity CVEs affecting officially supported MCP SDKs, we will analyze specific attack vectors that allow unauthorized parties to hijack valid session contexts. Additionally, we will briefly examine two further CVEs related to the broader MCP SDK ecosystem. We will also touch upon the upcoming MCP spec 2026-07-28 changes that eliminates protocol-level session management but the security problem remains in application-level state. We conclude with practical, defense-in-depth strategies, including duplicate connection prevention, user binding, strict session expiration mechanisms, and robust validation patterns that developers can implement to harden their MCP servers regardless of their chosen SDK.

Attendees will gain:
- A comprehensive understanding of MCP’s session model and the mechanics behind the two CVEs in MCP SDKs.
- Analysis of which SDKs provide built-in session security and which require custom implementation.
- Actionable security patterns for binding sessions to authenticated users.
- Practical mitigation strategies for preventing session hijacking and unauthorized resource access.

Speakers

Srikanth Ramu

Principal Security Engineer

I am an Application Security professional with extensive experience in product security, built on a solid foundation in development and QA. During the COVID-19 pandemic, I developed an interest in hunting bugs in open-source libraries specifically targeting Java Deserialization vulnerabilities... Read More →

Friday November 6, 2026 10:30am - 11:15am PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Intermediate

10:30am PST

When Finding Bugs Is the Easy Part: Lessons from an Agentic Vulnerability Harness

Friday November 6, 2026 10:30am - 11:15am PST

Room: Seacliff AB (Bay Level)

The finding that shifted our thinking on chain analysis was a session-handling weakness rated medium-severity in isolation. Once we traced the chain — an API leaking session identifiers without an access-control check, feeding a deterministic password derivation function — it was a full account compromise. Same code. Two severity tiers apart. Chain context doesn’t refine a finding; it changes what the finding actually is.

We ran a nine-step agentic harness across twenty large production applications at a financial-services organization: systems with years of prior pentest coverage, active bug-bounty programs, and conventional SAST already in CI. The harness surfaced over 400 verified vulnerabilities that the SAST tool did not catch — concentrated in categories pattern-based tools structurally cannot reach: absent authentication gates, authorization logic that exists but never enforces, secrets in configuration files outside the source scan boundary, unsigned token forgery, and multi-step attack chains.

Fewer than one in six findings overlapped between the two tools. SAST found roughly 90 true positives the harness missed — deep DAO-layer SQL injection, JSP template XSS — where its exhaustive per-call-site enumeration beat our coverage. The two tools are additive, not redundant. We nearly didn’t get there: the first run’s precision was too low to hand to any developer. Fixing it required structural changes — adversarial verification, deterministic filtering — not prompt tuning. That near-miss shaped everything that followed. This shift changed the primary metric we track — from how many issues are found to how quickly they are validated and closed in production. We now frame this as Mean Time to Adapt (MTTA) — the time from an initial signal to a validated fix in production.

The architecture is in enough detail to reproduce. The failure modes are specific: hallucinations that survived single-pass verification, chain severity that failed until it was made explicit in pipeline design rather than left to agent judgment.

Speakers

Venkata Suresh Sanga

Sr Cybersecurity Engineer, Visa

Venkata Suresh, Sanga is a Sr Cybersecurity Engineer at Visa, where he runs the SAST, SCA, and DAST detection portfolio. His current focus is an agentic harness that cuts the noise those tools produce and is measured by one number: Mean Time to Adapt.

linkedin.com/in/venkatasu... Read More →

Milind Daftari

Cybersecurity Engineer, Visa

Milind Daftari is a Cybersecurity Engineer at Visa with a Masters in Cybersecurity from New York University who thrives on turning security from a blocker into an enabler. He’s built and owned security from the ground up—shaping secure architectures, automating vulnerability scans... Read More →

Yuliana Martirosyan

Visa

Do the good by doing right

Daniel Fernandez Coviella

Senior Cybersecurity Engineer, Visa

Daniel Fernandez is a Senior Application Security Engineer at Visa, where he focuses on application security, AI security, and secure software engineering at enterprise scale. His work includes integrating AI into the secure development lifecycle, building developer security tooling... Read More →

Friday November 6, 2026 10:30am - 11:15am PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

11:30am PST

Finding Pwn Requests in OSS: Auditing CI/CD Pipelines for Supply-Chain Vulnerabilities at Scale

Friday November 6, 2026 11:30am - 12:15pm PST

Room: Grand Ballroom A (Street Level)

CI/CD pipelines are one of the highest-leverage attack surfaces in the application supply chain. A single misconfigured GitHub Actions workflow can hand repository secrets and write tokens to any external contributor who opens a pull request.

This talk presents a methodology for finding these weaknesses at scale across open-source organizations. It covers four vulnerability classes: unpinned third-party actions (the CVE-2025-30066 pattern), pwn-request code execution via pull_request_target, excessive GITHUB_TOKEN scope, and expression injection into shell steps.

Two open-source scanners implement the methodology. One audits SHA-pinning across a GitHub org. The other does mitigation-aware triage: it detects when hardening like persist-credentials: false or insider-only gating neutralizes a finding, so output stays actionable rather than noisy.

The talk walks through real disclosed findings, including a CRITICAL-severity pwn request where a pull_request_target workflow executed attacker-controlled build scripts with secrets in scope. Attendees leave with two working scanners, a triage framework for separating real findings from false positives, and concrete fix patterns they can apply to their own organizations.

Validation at scale: the methodology behind this talk has produced over 320 merged security fixes across 75 open-source organizations (apache, google, kubernetes-sigs, containerd, prometheus, vuejs, eslint, mongodb, ruby, redis, OWASP, NASA, NIST), plus five private vulnerability disclosures including a CRITICAL-severity pwn request. Each merged PR represents an independent maintainer reviewing and accepting a scanner-identified fix.

Speakers

Arpit Jain

Security Researcher, Independent

Friday November 6, 2026 11:30am - 12:15pm PST
Room: Grand Ballroom A (Street Level)

Deployment and Maintenance

Audience Intermediate

11:30am PST

Modelling for Agentic Failure; when attack trees meet safety engineering

Friday November 6, 2026 11:30am - 12:15pm PST

Room: Grand Ballroom C (Street Level)

Security and engineering teams are leaner in 2026, while the agents they're securing keep scaling. We're handing agents more tasks and more reach, which means when they fail, they fail exponentially. Threat modelling tells you what could go wrong, the next step is to decide which few controls or tests actually stop the disaster you want to prevent.

This talk brings threat models together with safety engineering with the mission of a more data driven approach to securing complex and / or agentic systems. Starting from a single Top Event, FTA models failure as explicit chains of conditions. By modelling OR / AND branches and minimal cut sets you can identify test cases, derive probabilities or understand better which controls to prioritise. Threat modelling and attack trees tell you the routes to a bad outcome while FTA tells you which of those routes to close first, and how to test if you've closed them. Pairing the two gives you agents that fail safely and predictably, and a defensible way to justify where your limited security time goes. Using illustrative examples from the cult movie 2001: A Space Odyssey in this talk we'll walk through translating fault paths into prioritised controls and focused tests.

The audience will take away how pairing FTA-driven testing and prioritisation with threat modelling and attack trees closes the loop that helps us build systems and agents that can fail safely and predictably.

Speakers

Petra Vukmirovic

Head of Information Security and Fractional Head of Product, Numan and Devarmor

Petra is a technology enthusiast, leader and public speaker. A former emergency medicine doctor and competitive volleyball athlete, she thrives in challenging environments and loves creating order from chaos. Initially pursuing a medical career, Petra's passion for technology led... Read More →

Friday November 6, 2026 11:30am - 12:15pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

11:30am PST

Shadow AI is the new Shadow IT

Friday November 6, 2026 11:30am - 12:15pm PST

Room: Bayview B (Bay Level)

Decades ago we identified Shadow IT as a major cybersecurity risk, and we realized that we can't secure what we don't see. As history likes to repeat itself, we are now back in exactly the same place with AI. And we are in a race against time, as currently AI adoption in most organizations is moving faster than their ability to govern it. This talk aims to shift the paradigm from AI as primarily a technology risk, to it being a governance challenge. And in doing so, to offer the audience a pragmatic, risk-based approach to governing AI without slowing innovation. We will visit current threats and emerging frameworks that can already be applied for bringing AI risk back under control. Because when an organization will have an AI security incident, the CISO will not have to answer about the AI technical failures, but rather about the lack of governance around it.

Speakers

Sebastian Avarvarei

Consulting CISO & Leadership Development Coach

With over 20 years of experience in cybersecurity at both strategic and operational levels, and a proven track record of building high-performing security teams, Sebastian takes a multi-faceted view on today's security challenges, successfully blending technical acumen with business... Read More →

Friday November 6, 2026 11:30am - 12:15pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

11:30am PST

Context Confusion Is the New Broken Access Control

Friday November 6, 2026 11:30am - 12:15pm PST

Room: Seacliff AB (Bay Level)

Broken access control has always been one of the most damaging application security risks. In traditional applications, the failure is usually clear: a user can access an object, record, file, or action they should not be able to access. AI applications make this problem harder because the security boundary is no longer just the object. It is also the conversation, retrieved context, generated answer, prior file selection, user role, and system memory around the interaction.

This talk focuses on a practical and under-tested failure mode in enterprise AI applications: context confusion. A user may be correctly authenticated and authorized, but the AI assistant may still answer using stale, over-broad, mixed, or unauthorized context. This can happen when users switch files mid-conversation, when retrieval pulls from a larger corpus than intended, when conversation history persists across data boundaries, or when the final answer combines allowed and disallowed information in a way that traditional access-control testing does not catch.

The session reframes AI data leakage as an AppSec testing problem rather than a model behavior problem. Attendees will learn how to test context boundaries across multi-turn conversations, file selection flows, retrieval systems, role changes, and generated responses. The talk will introduce a practical test matrix for identifying context bleed, authorization drift, stale retrieval, and response-level disclosure. It will also show how to capture useful evidence for engineering teams without turning the assessment into a vague “AI safety” review.

The goal is to give AppSec teams a concrete way to ask: did the application answer from the right context, for the right user, at the right time?

Speakers

Anusha Vajha

Security Engineer and Product Manager

Anusha Vajha is a cybersecurity practitioner focused on AI governance, product security, and enterprise AI risk. She has worked across security operations, GRC, detection engineering, and product security in healthcare, financial services, and startup environments.
Her work sits a... Read More →

Friday November 6, 2026 11:30am - 12:15pm PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

1:15pm PST

LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails

Friday November 6, 2026 1:15pm - 2:00pm PST

Room: Grand Ballroom A (Street Level)

Models are starting to make security decisions that used to be written as rules. Instead of matching an input against a policy, a model reads the request and decides what to do with it. OpenSearch is one of the first to put one in production as the only thing standing between an anonymous pull request and CI pipeline secrets.

When I reported a vulnerability, the team told me their model would catch it. So I tried to get past it the way you'd expect, hiding the attack. The model caught all of it, and going at it head-on wasn't going to work.

So I stopped trying to outsmart it and started thinking like it, reading why each attempt got caught until I understood what it could actually verify and what it only assumed. What got through in the end hid no attack, because the only dangerous part lived somewhere the model had no way to check.

This talk walks the whole path, from first failed attempt to the bypass that worked. Along the way I mapped the model's decision boundary - what it catches, what slips past, and how far an input bends before its judgment flips. The deeper gap is what it never sees at all, the blind spots built into how it reads a change. You'll see where a model can be trusted to make this call and where it can't, and what that means before you put one in front of something that matters.

Speakers

Aviv Donenfeld

Security Researcher, Check Point Software Technologies

Aviv Donenfeld is a Security Researcher at Check Point Software Technologies. Before security research, he built distributed networking systems as a software engineer. His recent research centers on the attack surfaces of AI coding assistants, including critical vulnerabilities in... Read More →

Friday November 6, 2026 1:15pm - 2:00pm PST
Room: Grand Ballroom A (Street Level)

Deployment and Maintenance

Audience Intermediate

1:15pm PST

So you think AI writes secure code?

Friday November 6, 2026 1:15pm - 2:00pm PST

Room: Grand Ballroom B (Street Level)

Software development is becoming AI-assisted at every stage — design, coding, testing, bug fixing — and AI agents are increasingly doing it all. But do AI coding assistants actually write secure code by default? Most of the conversation around AI and security focuses on AI finding vulnerabilities. Far less attention goes to how state-of-the-art coding agents behave when they're the ones writing the software in the first place.

We built an automated harness to answer this directly — generating and evaluating over 2,500 code samples across multiple languages, models, and coding tasks, then scoring them with SAST tooling for introduced vulnerabilities. We tested vanilla generation against several security-steering approaches, from a single-line instruction file to a full set of layered security skills, to see which techniques move the needle, and at what cost.

In this talk, we'll walk through the harness architecture, share our full results — including where steering helped, where it hurt, and why — and lay out a practical framework for guiding coding agents toward secure defaults without paying an unsustainable token or performance tax. Attendees will walk away with a reusable methodology for evaluating their own AI coding assistants, and concrete, evidence-backed steering techniques they can apply immediately.

Key Takeaways
- A reusable methodology for benchmarking any coding assistant or model for security regressions before rolling it out to developers
- Evidence on which security-steering techniques actually reduce vulnerabilities, and by how much
- An understanding of the token-cost and latency tradeoffs of different steering approaches
- A practical framework for shifting security left into the AI-assisted SDLC

Speakers

Shruti Datta Gupta

Product Security Engineer, Adobe

Shruti Datta Gupta is a Product Security Engineer at Adobe where she works in the Security AI & Data Engineering team. Her current role involves building AI-powered tools to automate security processes and reduce engineering toil. She is passionate about applying AI to solve cool... Read More →

Joseph Seasly

Security AI & Data Engineer, Adobe

Joseph does Security AI and Data Engineering at Adobe. In his former life, he spent 13 years in the U.S. Intelligence Community working in a variety of agencies, technical roles, and missions.
linkedin.com/in/josephs1000
... Read More →

Friday November 6, 2026 1:15pm - 2:00pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Intermediate

1:15pm PST

Why Developers Can and We Can't: Making Security Findings That Agents (and Humans) Can Act On

Friday November 6, 2026 1:15pm - 2:00pm PST

Room: Bayview B (Bay Level)

Coding agents went from novelty to daily driver in less than three years. Developers are now using AI to generate, test, and ship code as part of their normal workflow. But the way security communicates guidance has barely changed: findings buried in long documents, review comments that arrive after key decisions are already made, and requirements that are too vague for a developer to act on — let alone a coding agent.

The issue is not that developers do not care about security. It is that security intent often never reaches them in a form they can actually use.

So why did AI change the engineering workflow so quickly, while security reviews still look the same?

This talk looks at the structural reason behind that gap. Coding agents can only act on guidance that is specific, contextual, and executable. Most threat models and design review findings do not meet that bar. We will look at where review output breaks down in practice: findings that are technically true but not relevant, likelihood ratings that drift from reality, recommendations that are impossible to implement, and issues that no one knows how to translate into engineering work.

A human developer may be able to interpret a vague finding and make a judgment call. A coding agent will not. It will simply keep building without the missing security intent.

The second half of the talk focuses on what to do about it. We will present a practical framework for turning security review output into findings that are grounded in the real architecture, aware of existing controls, scoped to threats that actually apply, and written in a way that developers can act on.

Attendees will leave with a framework they can apply to their own design review or threat modeling process immediately, along with quality signals for measuring whether security findings are accurate, useful, and actually acted on.

Speakers

Hai Maler

Head of Research, Clover Security

Hai Maler is Head of Research at Clover Security, where he drives research that brings advanced AI capabilities into practical product security workflows. He brings over 10 years of industry experience, from breaking systems and studying how they fail to building tools that help defenders... Read More →

Friday November 6, 2026 1:15pm - 2:00pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

2:15pm PST

When Nobody Wrote the Code: Engineering Lessons from Building AI-Native Application Security

Friday November 6, 2026 2:15pm - 3:00pm PST

Room: Grand Ballroom B (Street Level)

We didn't set out to rethink Application Security.

Our goal was much simpler: remove repetitive security work without reducing engineering confidence.

Like many security teams, we began introducing AI into parts of our AppSec workflow—reviewing pull requests, proposing remediation, assisting with threat modeling, validating findings, and helping developers move faster without sacrificing security.

Some things improved almost immediately.

Others became unexpectedly harder.

The first surprise wasn't model quality—it was review capacity. As AI started proposing fixes faster than engineers could reasonably validate them, we discovered that generating secure code was no longer the difficult part. Deciding whether that code could be trusted was.

We also found ourselves asking questions we hadn't expected. Why were experienced reviewers approving changes they couldn't realistically read? Why were different AI workflows confidently disagreeing with each other? Why were we spending less time finding vulnerabilities and more time deciding which results deserved human attention?

As these experiments accumulated, one theme kept reappearing. The biggest shift wasn't simply that AI generated more code—it reduced the cost of implementation while exposing new bottlenecks in review, verification, governance, and evidence. That, in turn, led us to question several engineering assumptions that quietly shape today's AppSec practices.

This session shares the implementation journey behind those discoveries. Through practical engineering experiments, implementation mistakes, and lessons learned, we'll explore how familiar AppSec practices—including secure coding, threat modeling, SAST, DAST, CI/CD security, and supply chain security—continue to matter while evolving for AI-assisted software engineering.

This isn't a talk about replacing today's AppSec practices.

It's about understanding which assumptions continue to hold, which ones deserve to be revisited, and how security teams can evolve their existing programs for a world where generating software is becoming easier while proving software is trustworthy is becoming the harder engineering problem.

Speakers

Manoj Kumar Yuvanesh

Senior Manager, Trust Data Platform, Autodesk Inc

Manoj Kumar Yuvanesh is a Senior Engineering Manager at Autodesk, where he leads the Trust Data Platform within the Trust Organization.

His work focuses on building large-scale data systems and security automation capabilities that help organizations understand and improve their security posture. With deep experience across security tooling, architecture, and cloud platforms, he drives initiatives that integrate security... Read More →

Uday Bhaskar Seelamantula

Principal Application Security Engineer, Autodesk

Uday is a principal security engineer at Autodesk, where he focuses on securing applications at the intersection of traditional software and emerging AI features. His work spans offensive research, fuzzing, threat modeling, building guardrails and integrating security into the SDLC... Read More →

Friday November 6, 2026 2:15pm - 3:00pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Intermediate

2:15pm PST

Post Quantum Crypto (PQC) - Field-Tested Strategies to Defeat Harvest Now, Decrypt Later

Friday November 6, 2026 2:15pm - 3:00pm PST

Room: Grand Ballroom C (Street Level)

Q-Day, the moment a cryptographically relevant quantum computer (CRQC) breaks RSA, ECC, and Diffie-Hellman, has no confirmed date. But for any data with a long secrecy shelf life, it has effectively already happened: adversaries are harvesting encrypted traffic today to decrypt it later (HNDL). Meanwhile, governments have stopped waiting. The recent US Government Executive Order 14409 (June 2026) mandates post-quantum encryption for sensitive federal systems by the end of 2030, CNSA 2.0 requires quantum-safe software signing by 2030, and the EU, UK, Germany, and Australia have all converged on 2030-2035 deadlines. France's ANSSI will no longer certify products without quantum-safe encryption. The mandates exist. What most organizations lack is an executable engineering path.

This session presents a practitioner's migration playbook derived from hands-on work with enterprises beginning their post-quantum transitions. We separate the two halves of the problem that are routinely conflated: confidentiality, where hybrid key agreement (X25519MLKEM768) neutralizes harvest-now-decrypt-later immediately, and authentication and PKI, which is the harder, unfinished half that only matters once a CRQC exists. The session walks through where real migrations stall: hybrid handshakes that fragment across the MTU in QUIC, HSMs that cannot accelerate lattice math, the TLS 1.2 dead end, and the unresolved external mu debate in ML-DSA that risks cross-protocol divergence.

Attendees will leave with a combat-tested roadmap for enterprise PQC migration, a PQC maturity model with a concrete 90-day starting plan, a Cryptographic Bill of Materials (CBOM) template, a vendor briefing checklist, pilot project and a governance RACI model. We will cover how to conduct a cryptographic inventory (discovery), the necessity of "hybrid" key exchange (mixing X25519 with ML-KEM), testing for latency, key sizes, interoperability, and how security teams can upskill and execute rapidly.

Speakers

Anshu Gupta

Founder, Fixin Security

Anshu Gupta is a seasoned global cybersecurity executive with Fortune 500 advisory experience at EY and KPMG, working with companies including Microsoft, Salesforce, Cisco, and Adobe. He has built and led security programs at high-growth startups and fintechs, including Coupa, HelloSign... Read More →

Friday November 6, 2026 2:15pm - 3:00pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

2:15pm PST

The Hidden Risks of Service-to-Service Trust in Microservice Architectures

Friday November 6, 2026 2:15pm - 3:00pm PST

Room: Seacliff AB (Bay Level)

Modern applications increasingly rely on microservice architectures where APIs, backend services, and cloud workloads continuously communicate with one another. While organizations focus heavily on authenticating end users, service-to-service trust relationships are often implemented with excessive implicit trust, weak authorization boundaries, and inconsistent validation controls.

This talk explores how attackers abuse trust relationships between internal services to move laterally, escalate privileges, and access unintended resources inside distributed application environments. We will examine practical attack scenarios involving internal API trust, token forwarding, over-permissioned service identities, and insecure authorization assumptions between microservices.

Through architectural walkthroughs and demonstrations, attendees will learn how trust propagation inside distributed systems creates hidden attack paths that are difficult to detect using traditional security testing approaches.

The session also provides actionable guidance for securing service-to-service communication, including zero-trust design principles, token validation between services, least privilege for service identities, and authorization enforcement at every layer of the application.

Attendees will leave with practical strategies for reducing lateral movement and strengthening trust boundaries in cloud-native applications.

Speakers

Bhaumik Shah

CEO, SecurifyAI

Bhaumik Shah is a cybersecurity leader and founder of Securify, where he helps organizations secure their cloud, applications, and infrastructure through penetration testing, red team operations, and compliance programs like SOC 2 and ISO 27001. With over a decade of experience uncovering... Read More →

Friday November 6, 2026 2:15pm - 3:00pm PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

3:30pm PST

Pre-Flight Security Review for MCP Servers Using the OWASP MCP Top 10

Friday November 6, 2026 3:30pm - 4:15pm PST

Room: Grand Ballroom B (Street Level)

Since Anthropic released MCP as an open standard, enterprises have started adopting it as a common way to connect AI agents with tools, data sources, and business workflows. Many teams are now building MCP catalogs for internal developers, platform teams and external partners.

However, the security posture of these MCP servers is often not reviewed before they are added to a catalog or connected to an AI agent. In many cases, deeper security testing starts only after the MCP server is already in use.

Recent research has shown how a malicious or poorly reviewed MCP server can expose sensitive data, influence an agent’s behavior or override instructions given by the user. This makes MCP discovery an important early checkpoint for developer pre-flight checks, security approval, third-party MCP review, vendor or partner assessment and agent platform onboarding.

For traditional applications, software bills of materials (SBOMs) and configuration drift checks help teams understand what is being adopted and what has changed. MCP servers need a similar approach. In this talk, I will walk through a three-layer MCP BOM model: Discovery, Verified, and Runtime.

I will focus on the Discovery BOM and show how static MCP discovery can surface early indicators of tool poisoning, command injection and execution, context injection and over-sharing, credential-like inputs and risky tool capabilities. I will demonstrate this using an open-source tool that discovers MCP metadata and capabilities, runs static checks with YARA rules and maps findings to the OWASP MCP Top 10.

The goal is not just to scan an MCP server once, but to use discovery output as a pre-flight check: to review MCP servers before approval, detect MCP configuration and metadata changes in CI/CD, build safer MCP catalogs and create the first version of runtime monitoring and policy decisions.

Attendees will leave with a practical way to inspect MCP servers before agents use them, map exposed capabilities to OWASP MCP risks, compare MCP configuration drifts over time and answer a basic but important question during MCP security review: "What should be allowed, reviewed, or denied before the agent uses this MCP server?"

Speakers

Vinothini Raju

Founder & CEO, gopaddle.io

Vinothini Raju, is the Founder & CEO at gopaddle.io. She has been awarded the B2B Woman Tech Entrepreneur of the Year, 2023 by Women In Cloud & Insight Enterprises. Under her leadership, gopaddle focuses on building a next-generation platform for cloud native applications. Her... Read More →

Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Intermediate

3:30pm PST

From Design Docs to Mitigations: Scaling Pre-Launch Security Review with Historical Decisions

Friday November 6, 2026 3:30pm - 4:15pm PST

Room: Grand Ballroom C (Street Level)

Security review is getting squeezed from both sides. Product teams ship faster, GenAI has accelerated how quickly new features get built, and review teams are still expected to read each design doc from scratch and decide what can ship. That breaks down long before the roadmap slows down.

This talk shows an AI-assisted pre-launch review pattern built for that problem. The pipeline does not stop at generating a generic threat list or a dashboard for leadership. It starts with a structured risk taxonomy, mapped control expectations, and a corpus of historically reviewed launches. Given a PRD or design document for any new feature or application—not only GenAI products—it produces a reviewer-ready first pass: likely risks (from OWASP and internal), targeted follow-up questions, relevant control areas, and concrete mitigations grounded in both reviewer expertise and decisions that were approved in similar launches before. The same structure can support rollups for leadership, but the real value is at review time: better questions and earlier mitigations.

A key step is similarity-based retrieval over historical reviews. After the initial pass, the system looks for comparable launches and reuses the risks, control signals, and mitigation patterns that mattered in those cases. This helps recover issues that a single pass often misses and keeps the review grounded in how the organization actually makes launch decisions. Every completed review becomes another case in the corpus, so future reviews start from a richer set of approved precedents.

We will walk through the architecture, the feedback loop, and the places where this fails: thin design docs, stale taxonomies, misleading historical matches, and overconfident model output. We will also share results from a labeled benchmark of 19 PRDs and 205 human-reviewed risk labels. At a recall-oriented operating point, the pipeline reached 75% recall and 60% precision, and historical retrieval recovered 4–9 additional relevant threats per PRD on similar cases. Next steps including adding more data sources such as code repositories & live traffic.

The initial deployment focuses on fraud, but the pattern is being extended to other threat domains that matter in large product organizations, including abuse, privacy, and product security. This is not about replacing reviewers. It is about giving them leverage. Attendees will leave with a practical blueprint for turning blank-page review into a faster, more consistent workflow that surfaces mitigations before the design is already on its way to launch.

Speakers

Liat Ben Porat

Director, AI Science, Intuit

Liat Ben Porat leads the AI science organization within Intuit's global trust, fraud, and security group, where she drives the strategy, development, and adoption of AI solutions across security, fraud, compliance, and workforce teams. She also serves as her organization's lead for... Read More →

Guy Shtar

AI Security & Safety Architect, Intuit

Guy Shtar is an AI Security & Safety Architect at Intuit, working on the intersection of GenAI, security, and Trust & Safety. His work focuses on turning subjective review workflows into measurable technical systems, including AI-assisted risk discovery, adversarial testing, and security... Read More →

Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

3:30pm PST

Breaking the Headcount Scaling Model: How GitLab's Product Security Teams Achieved Non-Linear Securi

Friday November 6, 2026 3:30pm - 4:15pm PST

Room: Bayview B (Bay Level)

Complete title that is cut by "Session Title" size limit: Breaking the Headcount Scaling Model: How GitLab's Product Security Teams Achieved Non-Linear Security Gains with AI

Engineering ships faster every quarter with AI assisted development, Security headcount grows slowly and the review backlog keeps growing at a rate you wish you didn’t know! This talk traces the struggles of building an AppSec function from scratch, through the scaling pain of supporting a fast-growing engineering organization, to the entirely new class of challenges created by the rise of AI-assisted software development.

And it starts with the pain. Building an AppSec function inside a fast-growing engineering org means years of playing catch-up: hiring into a market with a shortage of talent, onboarding people who take months to become productive and sitting at a security engineer-to-developer ratio of 1 to 2%(and 2& when you’re lucky!) that never meaningfully improves. Somewhere along the way, it can become the team that slows things down and that’s when engineering teams no longer want you onboarded and be part of their workflow.

Then AI changed the game much faster than anticipated and in ways we did not plan for: engineering velocity jumped, AI-generated code brought volumetric challenges at the “diff” level as well as at scale. And teams started building features on top of AI. This creates threat surfaces that weren’t present before and that threat actors have leveraged extensively since the beginning of the year. We are now fighting on two fronts: securing AI-powered features while keeping up with AI-accelerated development speed.

This talk covers how we responded with AI-powered (and non AI-powered) automations, and which hard decisions we had to take to enable those improvements to happen. We will explain the change in how we had to think about the solutions to match not only human expectations, but also work with AI-powered tools as well as the capacity cost of building these tools. We will also cover some of the challenges we faced (and are still facing) when we had to leverage AI solutions and how we think our team will evolve in the coming months.

Speakers

Vitor Meireles

Senior Security Engineering Manager AppSec, GitLab

Vitor Meireles is a security professional with over 15 years of experience in the field. Currently serving as a Senior Security Engineering Manager at GitLab, he helps engineering teams build applications that are secure by design. Vitor has past experiences in the consulting, financial... Read More →

Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

3:30pm PST

Finding the Infrastructure Trust Layer: AI-Assisted Discovery of Cross-Product SSRF Classes

Friday November 6, 2026 3:30pm - 4:15pm PST

Room: Seacliff AB (Bay Level)

Standard SSRF mitigations are written around a specific threat model: an attacker reaching RFC 1918 space or link-local addresses through an application. Block 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, done. This model works for application-layer SSRF.

IaaS platforms have a second trust layer this model does not address. When a platform builds internal services - request routing, worker scheduling, data pipeline sinks - those services communicate over a network the application-layer blocklist does not see. CGNAT space (100.64.0.0/10) is one example: used for internal carrier routing and often present in IaaS backend networks, but it appears in neither RFC 1918 nor link-local blocklists.

I spent several months building an automated pipeline to probe IaaS attack surfaces, and the same root cause kept appearing across unrelated products from the same provider: different entry points, same internal network reachability, same CGNAT address class. Four products, one underlying issue.

The automation made the pattern visible. A human researcher testing one product at a time would likely miss the connection. The pipeline - scanner output fed to an LLM reasoning layer that classifies, clusters, and flags for human review - surfaces structural patterns that individual test results obscure.

This talk covers: the technical mechanics of CGNAT SSRF (probes, indicators, what a response tells you), how I built the LLM-assisted research pipeline, how to structure a consolidated disclosure when you find a vulnerability class instead of a single bug, and what to look for when testing your own IaaS-hosted services.

Research conducted via responsible disclosure. Will be fully public before November 2026.

Speakers

Ofri Ouzan

Security Researcher, JFrog Security

Ofri Ouzan is a security researcher at JFrog Security. With over 6 years of experience in the cybersecurity field, she specializes in conducting security research focusing on vulnerabilities and exploitation. Ofri excels at exploring new technologies and developing solutions to address... Read More →

Stav David

Founder building automated offensive security tooling

Stav David is a security researcher and founder who builds automated offensive security infrastructure. He started by building multi-cloud DDoS attack simulation tooling - real bot fleets testing whether mitigation vendors actually block what they claim to block. The recon pipeline... Read More →

Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

10:30am PST

10:30am PST

11:30am PST

11:30am PST

11:30am PST

11:30am PST

1:15pm PST

1:15pm PST

1:15pm PST

2:15pm PST

2:15pm PST

2:15pm PST

3:30pm PST

3:30pm PST

3:30pm PST

3:30pm PST

Get help with the event