AI
What the Industry Underestimates about AI and AppSec
The panel opened with what the industry is underestimating. Ash Singhal pointed to the fundamental shift in how software is built and the need for new assumptions around security controls. Kevin McDermott highlighted non-deterministic AI outputs: “we don’t really know or control what they’re going to do at any given time.” Clint Gibler added that the speed of code generation and the ease of exploitation are both underestimated. Seth Law noted economic disruption as automated code review replaces manual consulting engagements.
How Tooling and Processes Are Changing
Clint Gibler argued that traditional static analysis still works for specific patterns, but LLMs enable new capabilities like scanning design documents for risk. Ash Singhal described an agentic SDLC where security controls are embedded in design, implementation, and post-build validation. Kevin McDermott shared that his team automated DAST triage using a Claude agent. “My appsec team doesn’t really look at DAST output anymore,” he said. All panelists agreed that building custom security tools is now tractable for teams without a Netflix budget for enterprise suites.
The Future of Bug Bounty and Secure Coding Training
Clint Gibler predicted that within 6 to 12 months, bug bounty will no longer be a good entry platform because top hunters or security products will scoop all low-hanging bugs. He also predicted secure coding training for developers may go away. Ken Johnson countered that AI-generated code is reintroducing basic SQL injection. “I’m seeing a resurgence of SQL injection that I haven’t seen in the last 10 years,” Ken Johnson said. The panel debated whether new vulnerability classes are emerging or old ones simply manifesting in different ways.
Building an AppSec Program from Scratch in the AI Era
Ash Singhal said she would hire security engineers who like to build and are curious. Kevin McDermott emphasized understanding the business need first. Clint Gibler agreed: “having some cracked AI builders would be a great place to start.” He stressed that engineering fundamentals like good review processes, fast patching, and visibility are even more important now. Ken Johnson noted that security teams operating as engineering functions rather than compliance functions will adapt faster and reduce risk more effectively.
What Won’t Age Well: Predictions and Mistakes
Kevin McDermott said retrofitting current processes to the AI world will not age well. Ash Singhal warned against bolting on AI security without building appropriate systems. Clint Gibler called out the failure to embrace evals and benchmarking. “Everybody has like oh here’s my security code review skill which one is better I don’t know,” he said. Seth Law predicted many blog posts will reveal initial success followed by hidden maintenance costs. The panel closed on optimism: Ash pointed out the opportunity is huge for teams that adapt.
Notable Quotes
I think it is like the most exciting time in application security ever Ash Singhal · ▶ 16:41
I’m seeing a resurgence of SQL injection that I haven’t seen in the last 10 years because of AI generated code. Ken Johnson · ▶ 24:38
I predict Bug Bounty will stop being a good entry platform for security people Clint Gibler · ▶ 21:19
Key Takeaways
- Panel predicts bug bounty entry will vanish in 6-12 months as AI scoops low-hanging bugs.
- AI-generated code is reintroducing basic SQL injection, requiring new detection approaches.
- Security teams must adopt agentic tools and rigorous evaluations, not simply bolt AI onto old processes.