App Security Summit

Open-source software is now the backbone of application development—and a prime target for nation-state adversaries and automated malware. Recent incidents, including North Korea's Axios npm compromise, the Shai-Hulud worm, and TeamPCP's attacks on Trivy, all exploited common weaknesses: exposed maintainer accounts, unsecured publish tokens, vulnerable transitive dependencies, and gaps in CI/CD pipelines.

AI is accelerating both attack and defense. Anthropic's Claude Mythos Preview, intended to identify critical vulnerabilities ahead of adversaries, was itself compromised within hours. Threat actors are now using AI to automate the creation of malicious packages and orchestrate advanced social engineering campaigns.

Join Yesenia Yser for a focused discussion on actionable defense strategies: dependency pinning, SLSA attestations and OIDC-based publishing.

Key Takeaways:
- Identify recurring attack patterns to speed threat detection.
- Examine human trust and account security as core AppSec concerns.
- Reduce transitive dependency risk throughout build pipelines.
- Implement AI-driven provenance verification for all dependencies.
- Establish proactive security by enforcing strong dependency governance.