OWASP Global AppSec USA 2026: Full Schedule

10:30am PST

When the Fraud Analyst Becomes an Agent: Threat Modeling Autonomy in High-Stakes AppSec Workflows

Thursday November 5, 2026 10:30am - 11:15am PST

Most teams running fraud or abuse detection already have an AI assistant in the queue: it reads the signals on a flagged account, drafts a case summary, and a person decides what to do. What's changing is that these assistants are being given tools, memory, and the ability to act — to hold a transfer, freeze an account, file a report — usually a step at a time, without anyone treating it as a design decision.

That step changes the security problem. An assistant produces text a person reviews, so its mistakes get caught at the desk. An agent produces actions a system carries out, and the human review that used to sit in the path often no longer does. The failure modes you already know get more expensive, and a few new ones show up that don't exist when the output is only a summary.

This session is a threat model of that transition. It maps the agent's attack surface to the OWASP Top 10 for Agentic Applications, and for each risk it works through how an existing control has to change — input sanitization to intent checks, schema-constrained output to least-privilege tools, human-in-the-loop to hard limits on what an agent can do on its own.

The examples come from financial fraud and abuse work, where the actions are irreversible and have to hold up to an audit. The approach applies to any application, API, or workflow that lets an AI act. You'll leave with a checklist and a short list of decisions to take back to your own systems.

Assumes familiarity with application security and threat modeling. No machine-learning background required.

Speakers

Hamza Abubakar Kheruwala

Software engineer securing AI that can act

Hamza Abubakar Kheruwala is a software engineer whose work spans AI-assisted risk, fraud, and security systems in regulated environments, where automated decisions have to be auditable and hold up to review. That work covers telemetry pipelines, anomaly detection, and the LLM-assisted... Read More →

Thursday November 5, 2026 10:30am - 11:15am PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Advanced

11:30am PST

Cage the Confused Deputy: Infrastructure-Layer Defense for Voice AI Agents

Thursday November 5, 2026 11:30am - 12:15pm PST

Room: Grand Ballroom C (Street Level)

Deputies, like agentic AI models, do things on your behalf. A confused deputy does more than it should on your behalf. How do you unconfuse an inherently confused deputy? By telling it what it can and cannot do? But what if it gets confused, again?

Current LLM technology is not capable of being completely immune to prompt injection. It is going to happen. This means the security boundaries for voice agents cannot live solely inside the model's instructions. They have to live in the infrastructure around them. The right design assumes the model will be compromised and ensures that when it is, nothing irreversible happens.

This talk will discuss several of the defense-in-depth elements needed to create and deploy secure voice-based AI-powered agents. These elements will include defenses against transcription manipulation, agent goal drift, tool-abuse, data exfiltration through retrieval, and system-prompt extraction. Each control's effectiveness will be measured by: is it still effective even if the language model does exactly what the attacker asked?

You'll leave with a prioritized, vendor-neutral set of controls you can implement now. You will also gain a better understanding of the necessary defense-in-depth elements when deploying any type of agent. And finally, you'll walk away with a single phrase you can apply to every AI system you're responsible for, voice or not: "would this survive a fully compromised LLM?"

Speakers

Brian Cardinale

Principal Security Researcher, SecureCoders

Brian Cardinale is the Principal Security Researcher at SecureCoders. He holds a CISSP and has spent his career breaking things that aren't supposed to break. Brian built VoiceGoat, the first open-source vulnerable voice AI agent, and leads RedCaller's research into adversarial testing... Read More →

Thursday November 5, 2026 11:30am - 12:15pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience All

1:15pm PST

Controlling Decryption in Zero Trust Cloud Workloads

Thursday November 5, 2026 1:15pm - 2:00pm PST

Room: Grand Ballroom C (Street Level)

Cloud applications are increasingly used to process highly sensitive artifacts such as adversary simulation reports, threat intelligence, and vulnerability assessments. While encryption in transit and at rest is now standard, it does not answer a harder question: when and under what conditions should an application be allowed to see plaintext data?

This session presents a practical design for securely processing sensitive workloads in the cloud. The approach is simple in principle: data remains encrypted by default, and decryption is allowed only within explicitly authorized and tightly controlled execution paths.

We walk through a real-world architecture that combines client-side encryption, per-document keys, non-exportable asymmetric keys, policy-driven key release, role-based access control, and in-memory processing. In this model, documents are encrypted before upload, keys are isolated, and decryption happens only after identity, role, and workflow checks succeed. Plaintext exists only briefly during processing and is never persisted beyond that boundary.

What makes this approach different is how decryption itself becomes a controlled, auditable event, rather than an implicit capability of the application once access is granted.

The session also covers a production-inspired workflow where sensitive security reports are analyzed to extract actionable insights for defensive teams. This example shows how downstream processing systems (including AI-assisted analysis) can be introduced without expanding the attack surface.

Attendees will leave with a concrete design pattern for reducing plaintext exposure in cloud applications, along with practical guidance on applying these principles to their own systems. The focus is on patterns that can be applied broadly to sensitive workloads, not just this specific use case.

Speakers

Anjali Mangal

Principal Director of Security Research, Microsoft

Anjali Mangal is a Principal Director of Security Research at Microsoft, where she leads security validation, adversary emulation, and AI security initiatives across Microsoft Security products and services. Anjali's work spans threat intelligence, detection engineering, cloud security... Read More →

Vamshi Krishna Thotempudi

Senior Applied Data Scientist, focused on AI/ML, LLM-driven automation, and cloud-scale threat detection, Microsoft Security Research

Vamshi Krishna Thotempudi is a Senior Applied Data Scientist at Microsoft Security Research, working on AI/ML-driven automation, LLM-based security research, and cloud-scale threat detection. He has 13 years of experience across artificial intelligence, machine learning, natural language... Read More →

Mahima Agarwal

Senior Machine Learning Engineer, Microsoft Security

Mahima Agarwal is a Senior Machine Learning Engineer at Microsoft Security specializing in the intersection of AI, machine learning, and cybersecurity. Her work focuses on building large-scale systems for threat detection, security analytics, and detection engineering, including the... Read More →

Raghav Batta

Principal Manager in AI Security Research, Microsoft Security,

Raghav Batta is a Principal Manager in AI Security Research at Microsoft Security, where he leads research at the intersection of artificial intelligence and cybersecurity. His work focuses on applying large language models, agentic AI, and large-scale machine learning to improve... Read More →

Thursday November 5, 2026 1:15pm - 2:00pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Advanced

2:15pm PST

Prompt Injection Through the Image Channel of Multimodal LLMs: An Ignored Attack Surface

Thursday November 5, 2026 2:15pm - 3:00pm PST

Room: Grand Ballroom C (Street Level)

Almost every team shipping an LLM feature guards the text. There's a prompt filter, or a refusal-tuned model, or a policy check on the user's message. Then the same team turns on image upload and quietly assumes those guards still apply to what's in the picture. They don't.

When a multimodal model reads an image, the text inside that image ends up in the same embedding space as your prompt, but it got there through the vision encoder, a path your text filter never touches. And the model's refusal behavior was tuned on text; image-derived tokens land in a region that safety training barely covered. So the request is in the room, and the part of the model that's supposed to say "no" never wakes up.

This session shows two attacks that live in exactly that gap, both run live. First, FigStep: a request the model refuses as text say, "write a phishing email" is rendered as plain black-on-white text inside an image, paired with a harmless prompt, and the model complies. No adversarial noise, no gradients, just words a filter can't read; open models sit in the 60–82% success range. Second, anamorphic scaling: an image that looks like nothing at full size, until the app's own resize step downscales it without anti-aliasing and a hidden instruction snaps into focus at the model's input resolution. Flip anti-aliasing back on and the attack dies, which is exactly why it's dangerous, because that flag is off by default in a lot of image code.

Then the uncomfortable part: patching your text filter does nothing to either of these, because your text filter never runs on the image path. Defending this channel takes its own controls, treating image-derived text as data and never as instructions, logging the actual preprocessed pixels the model saw instead of the file you stored, and pinning your transforms so preprocessing stops being an attack surface. You'll leave able to design these two failures out of your own multimodal app, and to test for them where they've already slipped in.

Speakers

Pavan Reddy

AI Researcher and Engineer, Automata LLC

Pavan Reddy is principal developer at Automata LLC, leading FIPS 140-3, FedRAMP ATO, and AI security initiatives. He is an independent AI security researcher and educator focused on making secure AI accessible at scale. He founded QBTrain, a free platform for hands-on AI and AI security... Read More →

Thursday November 5, 2026 2:15pm - 3:00pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

3:30pm PST

Assume Code Execution: Securing Multi-Tenant Code-Ingestion Platforms

Thursday November 5, 2026 3:30pm - 4:15pm PST

Room: Grand Ballroom C (Street Level)

In December 2025 someone tried to break into a multi-tenant scanning platform. The payloads were the interesting part: a symlink pointing at /proc/self/environ, a beacon built to phone home, a dependency wired to a server the attacker controlled. They were templated, clearly meant to be fired at a dozen vendors with small tweaks. And they raised a question I don't think most teams ever ask about their own product. What happens when the code you ingest actually runs?

Here is the assumption I want to kill: that analyzing a repository is a read-only thing. It isn't. If your service takes in customer code or config, and that includes CI tools, dependency analyzers, SBOM generators, IDE plugin backends, scanners, and now AI coding assistants, then you are running attacker-controlled input whether you meant to or not. The line between parsing something and executing it has basically dissolved. A config file loads external checks, a package manifest runs lifecycle scripts during install, and a gemspec gets evaluated as code. A symlink walks right out of your sandbox.

This is a design talk, and the thing you take home is a design artifact: a four-question threat model you can point at any boundary where your system ingests code, and five controls that map one-to-one onto those questions and shut the risk down. I call the questions the Four E's: Execute, Expose, Exfiltrate, Expand. Used at design time, they find the exposure before a single line of exploit code exists, and the architecture that answers them falls out almost on its own. You design so that even when the ingested code runs, and it will, none of it matters.

The questions came out of testing 20 hosted platforms, with out-of-band beacons doing the confirming because these attacks are completely blind from the outside. Five of those platforms failed all four questions in practice and leaked production credentials. I will show you enough of that to prove the model holds up, but the breakage is not the reason to come. The reference architecture is.

You will leave with four questions that find the risk and five controls that shut it down, plus a detection trick that turns an attacker's first probe into your first alert. There is also an open-source, MIT-licensed tool that lets you run it all against your own boundary, the same week.

Speakers

Raphael Karger

Co-founder and CTO, ZeroPath

Raphael Karger is Co-founder and CTO of ZeroPath, an AI-native application security company and RSAC 2026 Innovation Sandbox finalist. He leads the core product and security research, which has disclosed vulnerabilities in curl, ffmpeg, sudo, and the Linux kernel. Previously, he was... Read More →

Thursday November 5, 2026 3:30pm - 4:15pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Advanced

10:30am PST

CRA will be Cloud-Scale Engineering Change

Friday November 6, 2026 10:30am - 11:15am PST

Room: Grand Ballroom C (Street Level)

The CRA is coming, and those who want to sell products in Europe will have to change their engineering processes and documentation in dramatic ways. This talk will introduce the CRA, walk through the requirements, the deadlines and the latest guidance documents from the EU.

Speakers

Adam Shostack

Friday November 6, 2026 10:30am - 11:15am PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience All

11:30am PST

Modelling for Agentic Failure; when attack trees meet safety engineering

Friday November 6, 2026 11:30am - 12:15pm PST

Room: Grand Ballroom C (Street Level)

Security and engineering teams are leaner in 2026, while the agents they're securing keep scaling. We're handing agents more tasks and more reach, which means when they fail, they fail exponentially. Threat modelling tells you what could go wrong, the next step is to decide which few controls or tests actually stop the disaster you want to prevent.

This talk brings threat models together with safety engineering with the mission of a more data driven approach to securing complex and / or agentic systems. Starting from a single Top Event, FTA models failure as explicit chains of conditions. By modelling OR / AND branches and minimal cut sets you can identify test cases, derive probabilities or understand better which controls to prioritise. Threat modelling and attack trees tell you the routes to a bad outcome while FTA tells you which of those routes to close first, and how to test if you've closed them. Pairing the two gives you agents that fail safely and predictably, and a defensible way to justify where your limited security time goes. Using illustrative examples from the cult movie 2001: A Space Odyssey in this talk we'll walk through translating fault paths into prioritised controls and focused tests.

The audience will take away how pairing FTA-driven testing and prioritisation with threat modelling and attack trees closes the loop that helps us build systems and agents that can fail safely and predictably.

Speakers

Petra Vukmirovic

Head of Information Security and Fractional Head of Product, Numan and Devarmor

Petra is a technology enthusiast, leader and public speaker. A former emergency medicine doctor and competitive volleyball athlete, she thrives in challenging environments and loves creating order from chaos. Initially pursuing a medical career, Petra's passion for technology led... Read More →

Friday November 6, 2026 11:30am - 12:15pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

1:15pm PST

Panel Discussion

Friday November 6, 2026 1:15pm - 2:00pm PST

Room: Grand Ballroom C (Street Level)

Friday November 6, 2026 1:15pm - 2:00pm PST
Room: Grand Ballroom C (Street Level)

2:15pm PST

Post Quantum Crypto (PQC) - Field-Tested Strategies to Defeat Harvest Now, Decrypt Later

Friday November 6, 2026 2:15pm - 3:00pm PST

Room: Grand Ballroom C (Street Level)

Q-Day, the moment a cryptographically relevant quantum computer (CRQC) breaks RSA, ECC, and Diffie-Hellman, has no confirmed date. But for any data with a long secrecy shelf life, it has effectively already happened: adversaries are harvesting encrypted traffic today to decrypt it later (HNDL). Meanwhile, governments have stopped waiting. The recent US Government Executive Order 14409 (June 2026) mandates post-quantum encryption for sensitive federal systems by the end of 2030, CNSA 2.0 requires quantum-safe software signing by 2030, and the EU, UK, Germany, and Australia have all converged on 2030-2035 deadlines. France's ANSSI will no longer certify products without quantum-safe encryption. The mandates exist. What most organizations lack is an executable engineering path.

This session presents a practitioner's migration playbook derived from hands-on work with enterprises beginning their post-quantum transitions. We separate the two halves of the problem that are routinely conflated: confidentiality, where hybrid key agreement (X25519MLKEM768) neutralizes harvest-now-decrypt-later immediately, and authentication and PKI, which is the harder, unfinished half that only matters once a CRQC exists. The session walks through where real migrations stall: hybrid handshakes that fragment across the MTU in QUIC, HSMs that cannot accelerate lattice math, the TLS 1.2 dead end, and the unresolved external mu debate in ML-DSA that risks cross-protocol divergence.

Attendees will leave with a combat-tested roadmap for enterprise PQC migration, a PQC maturity model with a concrete 90-day starting plan, a Cryptographic Bill of Materials (CBOM) template, a vendor briefing checklist, pilot project and a governance RACI model. We will cover how to conduct a cryptographic inventory (discovery), the necessity of "hybrid" key exchange (mixing X25519 with ML-KEM), testing for latency, key sizes, interoperability, and how security teams can upskill and execute rapidly.

Speakers

Anshu Gupta

Founder, Fixin Security

Anshu Gupta is a seasoned global cybersecurity executive with Fortune 500 advisory experience at EY and KPMG, working with companies including Microsoft, Salesforce, Cisco, and Adobe. He has built and led security programs at high-growth startups and fintechs, including Coupa, HelloSign... Read More →

Friday November 6, 2026 2:15pm - 3:00pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

3:30pm PST

From Design Docs to Mitigations: Scaling Pre-Launch Security Review with Historical Decisions

Friday November 6, 2026 3:30pm - 4:15pm PST

Room: Grand Ballroom C (Street Level)

Security review is getting squeezed from both sides. Product teams ship faster, GenAI has accelerated how quickly new features get built, and review teams are still expected to read each design doc from scratch and decide what can ship. That breaks down long before the roadmap slows down.

This talk shows an AI-assisted pre-launch review pattern built for that problem. The pipeline does not stop at generating a generic threat list or a dashboard for leadership. It starts with a structured risk taxonomy, mapped control expectations, and a corpus of historically reviewed launches. Given a PRD or design document for any new feature or application—not only GenAI products—it produces a reviewer-ready first pass: likely risks (from OWASP and internal), targeted follow-up questions, relevant control areas, and concrete mitigations grounded in both reviewer expertise and decisions that were approved in similar launches before. The same structure can support rollups for leadership, but the real value is at review time: better questions and earlier mitigations.

A key step is similarity-based retrieval over historical reviews. After the initial pass, the system looks for comparable launches and reuses the risks, control signals, and mitigation patterns that mattered in those cases. This helps recover issues that a single pass often misses and keeps the review grounded in how the organization actually makes launch decisions. Every completed review becomes another case in the corpus, so future reviews start from a richer set of approved precedents.

We will walk through the architecture, the feedback loop, and the places where this fails: thin design docs, stale taxonomies, misleading historical matches, and overconfident model output. We will also share results from a labeled benchmark of 19 PRDs and 205 human-reviewed risk labels. At a recall-oriented operating point, the pipeline reached 75% recall and 60% precision, and historical retrieval recovered 4–9 additional relevant threats per PRD on similar cases. Next steps including adding more data sources such as code repositories & live traffic.

The initial deployment focuses on fraud, but the pattern is being extended to other threat domains that matter in large product organizations, including abuse, privacy, and product security. This is not about replacing reviewers. It is about giving them leverage. Attendees will leave with a practical blueprint for turning blank-page review into a faster, more consistent workflow that surfaces mitigations before the design is already on its way to launch.

Speakers

Liat Ben Porat

Director, AI Science, Intuit

Liat Ben Porat leads the AI science organization within Intuit's global trust, fraud, and security group, where she drives the strategy, development, and adoption of AI solutions across security, fraud, compliance, and workforce teams. She also serves as her organization's lead for... Read More →

Guy Shtar

AI Security & Safety Architect, Intuit

Guy Shtar is an AI Security & Safety Architect at Intuit, working on the intersection of GenAI, security, and Trust & Safety. His work focuses on turning subjective review workflows into measurable technical systems, including AI-assisted risk discovery, adversarial testing, and security... Read More →

Friday November 6, 2026 3:30pm - 4:15pm PST
Room: Grand Ballroom C (Street Level)

Planning and Design

Audience Intermediate

10:30am PST

11:30am PST

1:15pm PST

2:15pm PST

3:30pm PST

10:30am PST

11:30am PST

1:15pm PST

2:15pm PST

3:30pm PST

Get help with the event