OWASP Global AppSec 2026 Preview: Insights, Interviews & AppSec Trends – OWSP26 #1
CyberRisk TV is at OWASP Global AppSec 2026 in San Francisco, bringing viewers exclusive interviews with cybersecurity leaders and industry experts. Mike Shema introduces this year's conference coverage and highlights the latest conversations shaping application security. He also discusses Application Security Weekly, covering emerging threats and developments across modern applications, APIs, AI agents, and the evolving relationship between attackers and defenders.
Follow CyberRisk TV for more insights and interviews from the conference.
Context Confusion Is the New Broken Access Control – Anusha Vajha – OWSP26 #1
An AI assistant can authenticate a user, validate their session, and still produce an answer using information it was never supposed to access. Through controlled security experiments, this discussion examines how context confusion creates access-control failures across document retrieval, file switching, conversation history, and caching, including what happens when permissions change after data has been indexed. We'll explore why checking permissions alone is not enough and how security teams can test whether AI applications are using the right information, for the right user, at the right time.
Anusha Vajha is a cybersecurity practitioner focused on AI governance, product security, and enterprise AI risk. Her experience spans security operations, governance, risk and compliance (GRC), detection engineering, and product security across healthcare, financial services, and startup environments.
Her work sits at the intersection of product security, responsible AI adoption, and practical security governance, with an emphasis on helping organizations build, deploy, and use AI-enabled products securely. Beyond her professional work, Anusha contributes to the cybersecurity community through Women in CyberSecurity (WiCyS), where she leads the Threat Operations Affiliate, and through other cybersecurity education initiatives.
Model Context Points of Failure: MCP Security Meets Scale – Moshe Siman Tov Bustan – OWSP26 #1
MCP servers have quickly become the connective tissue between AI agents, coding assistants and the tools and data they act on, but security hasn’t kept pace with adoption. We'll share findings from OX Security’s analysis of over 15,000 MCP servers on public registries and 3,000 open-source AI projects, including remote command execution, abandoned servers that can be taken over, and data sovereignty risks. He also discusses how organizations can discover, govern and secure MCP usage at scale before it leads to their next breach.
Segment Resources:
Moshe is a Security Research Team Leader at OX Security, a company specializing in software supply chain security, and has worked in the security industry for 13 years. His work spans cloud security research, container security, memory forensics, and an in-depth understanding of programming languages. He also has extensive experience in mobile security, including iOS and Android research, deep analysis of Android malware, sandboxing, and memory forensics.
Beyond security research, Moshe has published multiple “Can It Run Doom?” projects online, and is also a professional guitarist in a progressive metal band.
Modelling for Agentic Failure: When Attack Trees Meet Safety Engineering – Petra Vukmirovic – OWSP26 #1
Security teams are getting leaner while the agents they secure keep gaining tasks and reach, so when agents fail, they fail at scale. Threat modelling tells you what could go wrong; Fault Tree Analysis, borrowed from safety engineering, works backwards from a single unacceptable Top Event to show the exact chains of failure that get you there and which few controls and tests actually stop it. Using HAL from 2001: A Space Odyssey as the running example, we discuss how pairing threat models and attack trees with FTA turns gut-feel risk into data-driven prioritisation, and helps build agents that fail safely and predictably.
Segment Resources:
Petra is a technology leader, public speaker and former emergency medicine doctor. After moving from medicine into technology, she progressed from cybersecurity intern to leadership roles including Director of Cyber Security at Jobandtalent and Head of Information Security at Numan. At Glasswall she invented a novel zero-day malware detection mechanism, which led to an approved patent. She now leads Information Security, AI and Internal Technology at Flagstone, bringing together security strategy, AI adoption and governance, and technology operations.
Petra co-leads the OWASP Threat Model Library and contributes to the CycloneDX Threat Model Bill of Materials (TM-BOM), advancing standardisation and automation in threat modelling. As an Advisor at DevArmor, she supports innovation in automated threat modelling and security design. A former competitive volleyball athlete, she thrives in challenging environments and enjoys bringing order to chaos.
Beyond the LLM Top 10: Putting AI security into practice – Scott Clinton – OWSP26 #1
At OWASP Global AppSec 2026, Scott Clinton, chair of the OWASP GenAI Security Project, joins CyberRisk TV to discuss the project’s expanding work to secure AI applications and agents. Clinton explores how agents can inherit user permissions and introduce insider risks, why security fundamentals and governance remain essential, and how the community is translating research into practical guidance. He also highlights new data security resources, the project’s MCP server, and opportunities for practitioners to contribute to the future of AI security.
This segment is sponsored by The OWASP GenAI Security Project. Visit https://securityweekly.com/owasp to learn more about them!
Scott Clinton is Chair of the OWASP GenAI Security Project, leading strategy, operations, and growth. A 25+ year industry executive and 20-year open source leader, he has built and scaled open source businesses and industry consortiums across security, DevOps, AI/ML, and data markets. Scott is a published author and research lead, including the Gen AI Security Landscape and AI Security Center of Excellence Guide. Scott also holds multiple board and advisory roles with technology companies helping guide organization scale and growth.
The Primacy of Human Expertise in AI Cybersecurity – Andrew Wesie – OWSP26 #1
AI-enabled cyber attackers are able to check every side door of an application at a scale and speed unimaginable before. AI can help defenders just as much…but it’s only as effective as the human expertise guiding it. In this session, Xint co-founder and CTO Andrew Wesie explains how human engineering in harness construction is the determining factor between real, autonomous exploit discovery and validation versus a machine that just generates more noise.
Segment Resources:
High-impact business logic vulnerabilities discovered by Xint: one bug that enabled large scale model reasoning distillation and another that enabled cutting output inference costs by 99% on OpenAI https://xint.io/blog/compaction-smuggling-reasoning-traces and https://xint.io/blog/openai-compaction-inference
How Woori Bank was the only Korean bank to avoid being breached during the most widespread attack on Korean financial system in part through their work with Xint to secure side doors https://xint.io/resources/the-side-door-problem-what-the-korean-bank-breaches-mean-for-us-banks
Working with DARPA to test all the surrounding infrastructure to messaging apps used in the military whether they have access to source code or not https://xint.io/blog/darpa-selects-xint-to-research-source-code-vulnerabilities-in-critical-messaging-applications-used-in-military-communications-330339
Team Xint won $240k at Pwn2Own Ireland in October, successfully 5/5 on their exploit submissions (on first attempts too), including the Home Assistant Green, Google Pixel 10, Oracle Autonomous AI Database, LiteLLM, and Philips Hue Bridge Pro and was the first team to successfully hack the Pixel 10 https://x.com/xint_official/status/2108585751512526887
This segment is sponsored by Xint. Visit https://securityweekly.com/xint to learn more about them!
Andrew Wesie is Co-Founder and CTO at Xint, where he leads technical strategy, product development, and offensive security research. He has deep expertise in vulnerability research, exploitation, and advanced security engineering, and has supported high-impact security work across some of the world’s most targeted platforms. Xint is an AI-native security platform designed to identify critical zero-day vulnerabilities at scale without human intervention.
OWASP Global AppSec 2026: Key Takeaways and AppSec Conversations – OWSP26 #1
Wrapping up our coverage of OWASP Global AppSec 2026! Mike Shema reflects on conversations with industry leaders about their presentations, insights, and discussions with the application security community. He also highlights Application Security Weekly, a podcast covering the latest AppSec news, industry interviews, and emerging security challenges, from secure-by-design practices to insecure-by-default approaches. Stay connected with the application security community and catch up on more conference interviews and editorial coverage.
