Name: Pattern, Graph, Prompt: What Happens When You Layer Three Analysis Paradigms on the Same Codebase
Start: 2026-11-05T15:30:00-0800
End: 2026-11-05T16:15:00-0800

Pattern, Graph, Prompt: What Happens When You Layer Three Analysis Paradigms on the Same Codebase

Thursday November 5, 2026 3:30pm - 4:15pm PST

Room: Grand Ballroom B (Street Level)

We ran three fundamentally different security analysis approaches against the same production monorepo at a large tech company: a pattern-based static analysis tool, a code property graph analyzer, and LLM-powered code review. Together they surfaced over 150 confirmed or validated security findings.

Each approach has real strengths and real limitations. Pattern-based static analysis is fast and deterministic but struggles with complex taint propagation and cannot reason about logic. Graph-based analysis can trace dataflow across the entire codebase but has no concept of developer intent. LLM-powered review can reason about whether a security mechanism actually does what it claims, but it is non-deterministic, expensive, and cannot guarantee exhaustive coverage the way a static tool can.

We present a practical methodology for layering these approaches, share the detection overlap data from our analysis, and provide a framework for deciding which paradigm to apply where.

Speakers

Mudita Khurana

Staff Security Engineer, Airbnb

Mudita Khurana is a Tech Lead at Airbnb, where she builds scalable security tooling and automation across the software development lifecycle. Previously at Meta, she drove key initiatives in product security, including bug bounty strategy, privacy-focused reviews, and automated vulnerability... Read More →

Thursday November 5, 2026 3:30pm - 4:15pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Advanced

OWASP Global AppSec USA 2026

Mudita Khurana

Get help with the event

OWASP Global AppSec USA 2026

Mudita Khurana

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event