Name: When the Fraud Analyst Becomes an Agent: Threat Modeling Autonomy in High-Stakes AppSec Workflows
Start: 2026-11-05T10:30:00-0800
End: 2026-11-05T11:15:00-0800

When the Fraud Analyst Becomes an Agent: Threat Modeling Autonomy in High-Stakes AppSec Workflows

Thursday November 5, 2026 10:30am - 11:15am PST

Room: Grand Ballroom C (Street Level)

Most teams running fraud or abuse detection already have an AI assistant in the queue: it reads the signals on a flagged account, drafts a case summary, and a person decides what to do. What's changing is that these assistants are being given tools, memory, and the ability to act — to hold a transfer, freeze an account, file a report — usually a step at a time, without anyone treating it as a design decision.

That step changes the security problem. An assistant produces text a person reviews, so its mistakes get caught at the desk. An agent produces actions a system carries out, and the human review that used to sit in the path often no longer does. The failure modes you already know get more expensive, and a few new ones show up that don't exist when the output is only a summary.

This session is a threat model of that transition. It maps the agent's attack surface to the OWASP Top 10 for Agentic Applications, and for each risk it works through how an existing control has to change — input sanitization to intent checks, schema-constrained output to least-privilege tools, human-in-the-loop to hard limits on what an agent can do on its own.

The examples come from financial fraud and abuse work, where the actions are irreversible and have to hold up to an audit. The approach applies to any application, API, or workflow that lets an AI act. You'll leave with a checklist and a short list of decisions to take back to your own systems.

Assumes familiarity with application security and threat modeling. No machine-learning background required.

Speakers

Hamza Abubakar Kheruwala

Software engineer securing AI that can act

Hamza Abubakar Kheruwala is a software engineer whose work spans AI-assisted risk, fraud, and security systems in regulated environments, where automated decisions have to be auditable and hold up to review. That work covers telemetry pipelines, anomaly detection, and the LLM-assisted... Read More →

Thursday November 5, 2026 10:30am - 11:15am PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Advanced

OWASP Global AppSec USA 2026

Hamza Abubakar Kheruwala

Attendees (1)

Get help with the event

OWASP Global AppSec USA 2026

Hamza Abubakar Kheruwala

Attendees (1)

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event