This session explores how traditional application security practices must evolve to address the emerging risks of AI-powered products. Participants will learn to identify AI-specific attack surfaces, threat-model emerging risks, and integrate security controls throughout the product lifecycle—from design and development to deployment and production monitoring.
Key Topics
- Understanding the AI Attack Surface: Exploring security risks across LLMs, data pipelines, Retrieval-Augmented Generation (RAG), APIs, AI agents, and supporting infrastructure.
- Threat Modeling AI-Powered Products: Identifying threats such as prompt injection, sensitive data leakage, insecure integrations, and excessive AI agent privileges.
- Beyond Traditional AppSec: Understanding where conventional security controls fall short and how to extend secure SDLC practices for AI systems.
- Building Security into the AI Product Lifecycle: Applying security-by-design, AI-specific testing, adversarial evaluations, and risk-based release gates.
- Securing AI Agents and Integrations: Implementing least privilege, access controls, guardrails, and safeguards against unauthorized actions.
- Continuous AI Security Assurance: Exploring AI red teaming, runtime monitoring, incident response, and continuous security evaluation.
- Practical Case Study: Examining an AI-powered application to understand attack paths, assess risks, and apply effective security mitigations.
Target Audience
- Product Security Engineers and Leaders
- Application Security (AppSec) Engineers
- AI/ML Security Engineers and Researchers
- Security Architects and Threat Modeling Specialists
- DevSecOps and Cloud Security Professionals
- Software Engineers and Engineering Leaders building AI-powered products
- CISOs and Security Leaders responsible for AI security strategy
Prerequisites
- Basic understanding of application security concepts, including the OWASP Top 10 and secure software development lifecycle (SDLC).
- Familiarity with APIs, authentication, authorization, and common web application vulnerabilities.
- A high-level understanding of AI/LLMs and how AI-powered applications use models, prompts, and data.
- Familiarity with threat modeling and security testing is helpful but not mandatory.
- Prior hands-on AI security experience is not required.
