How will the advent of new AI-powered tools affect AppSec practices - and how can AppSec reap the best of it?

Chris Lindsey, an application security evangelist, opens by asking how AI-powered tools will change AppSec work and how teams can benefit from them. He describes AI as a way to connect scattered security data and surface patterns people miss. He cites a proof of concept at a large company where unsanctioned "shadow AI" use was far higher than leaders estimated, with AI features often hidden inside browser extensions and everyday IDEs. He also covers AI-assisted red teaming, such as automated attack exploration layered on DAST and plugins that link dependency versions to known vulnerabilities.

The middle of the talk looks at developer-facing uses. These include explaining scanner findings, suggesting fixes, helping junior staff learn, ranking risk through ASPM-style aggregation, and speeding up unit tests and QA automation. He warns that model output can be wrong or hallucinate, that generated code can add flaws that scanners miss, and that proprietary source code should not go into public chatbots. For models pulled from public hubs, he recommends sandbox testing before use and least-privilege access for any model connected to databases or file systems.

He closes by urging security teams to build working relationships with developers and QA. He suggests QA enforce a rule that releases must not add new vulnerabilities, and he argues that AI tools will keep evolving, so teams should engage with them now while keeping humans in the review loop.