Abstract
The emerging AI-native SDLC is being described as a transformation of software development, but many of the security visions attached to it are remarkably conventional. Generate some documentation, update a threat model, run a security review tool, and give developers another list of vulnerabilities to manage. That is not a reimagining of application security. It is the existing AppSec operating model with agents performing some of the steps.
That model is already reaching its limits. As AI systems take on more responsibility for designing, writing, testing, reviewing, and deploying software, the volume and velocity of change will exceed what security teams can inspect, triage, and govern. AppSec cannot respond by building faster scanners, producing larger backlogs, or placing humans at the end of increasingly automated pipelines. The discipline itself must evolve.
This talk explores what comes after human-scale AppSec. It presents a model in which security practitioners govern an increasingly agentic workforce, establish the conditions under which software can be trusted, and continuously evaluate the risk state of applications and services. Threat modeling, secure design, guardrails, verification, defect management, and incident response become interconnected capabilities rather than isolated activities or checkpoints.
Using OWASP SAMM’s five business functions as a lens, we will examine how AI changes not only Implementation and Verification, but also Governance, Design, and Operations. Attendees will leave with a practical framework for deciding where automation can replace mechanical security work, where expert judgment remains essential, and how AppSec programs can begin preparing for software delivery that no longer operates at human scale.
Speaker Bio
Ken Johnson “cktricky”, has been hacking web applications professionally for 18 years. Ken is both a breaker and builder and is the CTO & Co-Founder of DryRun Security. Previously, Ken was a Director with GitHub’s Product Security Engineering team and has held both technical and leadership roles both within the consulting world as well as a corporate defender. Previously, Ken has spoken about varying AppSec topics at RSA, You Sh0t the Sheriff, Insomnihack, CERN, DerbyCon, AppSec USA, AppSec DC, AppSec California, OWASP Global events, DevOpsDays DC, LASCON, RubyNation, and numerous other events. Ken’s current passion project is the Absolute AppSec podcast with Seth Law and the practical secure code review course they offer thru BH/ DEF CON and other training venues.