Just went off the keynote stage at OWASP Global Vienna, 2026.
A keynote is hard, where you need to satisfy different audiences, from grandma to vulnerability researchers, and provide with “inspiration” without it being seen as b/s by either.
Meaning, challenging status quo so that the audience has the opportunity to deeply rethink their assumptions (beyond time to exploration: from patches even existing and constant concurrent data breaches, to fixing third party software on your own), while not losing the techies who just want the bottom line.
AppSec is dead. Long live AppSec.
While most current AppSec capabilities are now outmoded and (almost) pointless, people, for now, are not. The world has never been this exciting, and the future with AI, especially in AppSec, is bright.
VulnOps isn’t just a buzzword securing l more budget for leaders, either.
From autonomous patching and Sounil Yu’s DIE Triad DevOps (with self healing infra) to threat modeling at plan mode and dynamically updated secure coding rules - the possibilities are endless.
While defense hasn’t yet hit its singularity moment, attack has. And guess what? Because of this, AppSec has as well.
Use an agent today. Defend your agents and their supply chain. Point agents at your code. And, take someone with you on the AI journey - let’s not leave people behind.
Thank you OWASP® Foundation for the opportunity.
Josh Grossman, Lauren Thomas, Stacey Ebbs, Izar Tarandach, and Missie Lindsey - my direct connections for the speaking role - I appreciate all the hard work you and the wider team put in, making this such a successful event!
Avi Douglen, thank you for putting me on your panel on personal relevance in the age of AI, along-side Grant Ongers, Marisa Fagan, and Hanna Foxwell. Man it’s hard finding a good moderator for panels, and you’re it.
#owasp