State of (Absolute) AppSec
summary
Panel argues application security must adapt to non-deterministic AI-infused apps where models change runtime behavior, not just scan outputs. Concrete changes reported: DAST triage is auto-triaged DAST via Claude agent with tickets auto-created, cloud code and agent/skill hooks enforce post-generation checks, and Opus model shifts reintroduce basic SQL injection in generated PRs. Predictions include bug bounty entry shrinks as low-hanging bugs get scooped and secure-by-default libraries plus evals become the decisive controls.
AI-written summary · about
chapters (10)
- 0:00Introduction and panel welcome
- 1:47AI and AppSec industry impact
- 3:30Industry underestimations on AI and AppSec
- 8:08Modern AppSec tooling vs legacy expectations
- 16:12Is AppSec dead or evolving?
- 21:06Spicy takes on AppSec future
- 22:29OWASP Top 10 changes and risks
- 26:01Future of AppSec talent and training
- 30:15Building an AppSec program from scratch
- 34:28Closing remarks and predictions
related talks
43mThe State of AppSec in the Era of AI [Panel]
45mState of (Absolute) AppSec
49mPragmatic Approaches To Building Secure Software
44mApplication Security: Everything we know is wrong
33mBattle Tested Application Security
50mThe Application Security State of the Union
47mModern Appsec vs. GenAI Application: Is Your Appsec Ready?
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux