Name: Why Developers Can and We Can't: Making Security Findings That Agents (and Humans) Can Act On
Start: 2026-11-06T13:15:00-0800
End: 2026-11-06T14:00:00-0800

Why Developers Can and We Can't: Making Security Findings That Agents (and Humans) Can Act On

Friday November 6, 2026 1:15pm - 2:00pm PST

Room: Bayview B (Bay Level)

Coding agents went from novelty to daily driver in less than three years. Developers are now using AI to generate, test, and ship code as part of their normal workflow. But the way security communicates guidance has barely changed: findings buried in long documents, review comments that arrive after key decisions are already made, and requirements that are too vague for a developer to act on — let alone a coding agent.

The issue is not that developers do not care about security. It is that security intent often never reaches them in a form they can actually use.

So why did AI change the engineering workflow so quickly, while security reviews still look the same?

This talk looks at the structural reason behind that gap. Coding agents can only act on guidance that is specific, contextual, and executable. Most threat models and design review findings do not meet that bar. We will look at where review output breaks down in practice: findings that are technically true but not relevant, likelihood ratings that drift from reality, recommendations that are impossible to implement, and issues that no one knows how to translate into engineering work.

A human developer may be able to interpret a vague finding and make a judgment call. A coding agent will not. It will simply keep building without the missing security intent.

The second half of the talk focuses on what to do about it. We will present a practical framework for turning security review output into findings that are grounded in the real architecture, aware of existing controls, scoped to threats that actually apply, and written in a way that developers can act on.

Attendees will leave with a framework they can apply to their own design review or threat modeling process immediately, along with quality signals for measuring whether security findings are accurate, useful, and actually acted on.

Speakers

Hai Maler

Head of Research, Clover Security

Hai Maler is Head of Research at Clover Security, where he drives research that brings advanced AI capabilities into practical product security workflows. He brings over 10 years of industry experience, from breaking systems and studying how they fail to building tools that help defenders... Read More →

Friday November 6, 2026 1:15pm - 2:00pm PST
Room: Bayview B (Bay Level)

Process and Culture

Audience Intermediate

OWASP Global AppSec USA 2026

Hai Maler

Get help with the event

OWASP Global AppSec USA 2026

Hai Maler

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event