Name: When Nobody Wrote the Code: Engineering Lessons from Building AI-Native Application Security
Start: 2026-11-06T14:15:00-0800
End: 2026-11-06T15:00:00-0800

When Nobody Wrote the Code: Engineering Lessons from Building AI-Native Application Security

Friday November 6, 2026 2:15pm - 3:00pm PST

Room: Grand Ballroom B (Street Level)

We didn't set out to rethink Application Security.

Our goal was much simpler: remove repetitive security work without reducing engineering confidence.

Like many security teams, we began introducing AI into parts of our AppSec workflow—reviewing pull requests, proposing remediation, assisting with threat modeling, validating findings, and helping developers move faster without sacrificing security.

Some things improved almost immediately.

Others became unexpectedly harder.

The first surprise wasn't model quality—it was review capacity. As AI started proposing fixes faster than engineers could reasonably validate them, we discovered that generating secure code was no longer the difficult part. Deciding whether that code could be trusted was.

We also found ourselves asking questions we hadn't expected. Why were experienced reviewers approving changes they couldn't realistically read? Why were different AI workflows confidently disagreeing with each other? Why were we spending less time finding vulnerabilities and more time deciding which results deserved human attention?

As these experiments accumulated, one theme kept reappearing. The biggest shift wasn't simply that AI generated more code—it reduced the cost of implementation while exposing new bottlenecks in review, verification, governance, and evidence. That, in turn, led us to question several engineering assumptions that quietly shape today's AppSec practices.

This session shares the implementation journey behind those discoveries. Through practical engineering experiments, implementation mistakes, and lessons learned, we'll explore how familiar AppSec practices—including secure coding, threat modeling, SAST, DAST, CI/CD security, and supply chain security—continue to matter while evolving for AI-assisted software engineering.

This isn't a talk about replacing today's AppSec practices.

It's about understanding which assumptions continue to hold, which ones deserve to be revisited, and how security teams can evolve their existing programs for a world where generating software is becoming easier while proving software is trustworthy is becoming the harder engineering problem.

Speakers

Manoj Kumar Yuvanesh

Senior Manager, Trust Data Platform, Autodesk Inc

Manoj Kumar Yuvanesh is a Senior Engineering Manager at Autodesk, where he leads the Trust Data Platform within the Trust Organization.

His work focuses on building large-scale data systems and security automation capabilities that help organizations understand and improve their security posture. With deep experience across security tooling, architecture, and cloud platforms, he drives initiatives that integrate security... Read More →

Uday Bhaskar Seelamantula

Principal Application Security Engineer, Autodesk

Uday is a principal security engineer at Autodesk, where he focuses on securing applications at the intersection of traditional software and emerging AI features. His work spans offensive research, fuzzing, threat modeling, building guardrails and integrating security into the SDLC... Read More →

Friday November 6, 2026 2:15pm - 3:00pm PST
Room: Grand Ballroom B (Street Level)

Implementation

Audience Intermediate

OWASP Global AppSec USA 2026

Manoj Kumar Yuvanesh

Uday Bhaskar Seelamantula

Get help with the event

OWASP Global AppSec USA 2026

Manoj Kumar Yuvanesh

Uday Bhaskar Seelamantula

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event