Leveraging OWASP Projects for DevSecOps

Mixed session of slides and demo showing how you can leverage a couple of OWASP open source projects to be able to supercharge a DevSecOps strategy in your enterprise

Event: OWASP Bay Area Meetup
Duration: 45min
Category: DevSecOps
Technical Level: Intermediate

CTF 101

Running a Capture the Flag event and explaining how to solve some of the challenges

Session run at the Pacific Hackers End of Year celebration Meetup at Hacker Dojo, Mountain View, CA, USA on 27-FEB-2025

Leveraging OWASP Projects for DevSecOps

Showing how you can use a couple of OWASP projects to benchmark security tools and also establish a DevSecOps culture

Talk at the OWASP San Francisco Bay Area Meetup, at Hacker Dojo, Mountain View, CA, USA on 23-OCT-2024

The Secure Autopilot: Hardening AI Agents and MCP ecosystems

AI agentic coding tools are redefining how developers build software — and how attackers exploit it. In this hands-on workshop, you’ll learn how to securely use tools like Cursor, Claude, and GitHub Copilot while identifying and mitigating AI-specific security risks. We’ll cover detection of tool poisoning, prompt injection, and toxic flow vulnerabilities in MCP servers, followed by AI-focused red teaming of LLM endpoints and AI-powered APIs to uncover jailbreaks, data leakage, and unsafe behaviors. Attendees will leave with practical skills, tooling, and security patterns for building safer AI-driven development workflows.

The presentation includes QR codes pointing to the technical resources needed to follow the demos. The presentation duration is ~45min

The Hacker's Guide to Life: Research, Optimize, and Achieve the Extraordinary

Javier has spent over a decade optimizing and securing the web, and applying a 'Hacker Mentality' to every challenge he comes across. In this fun and inspiring talk, Javier will share how this quest to 'hack' his own life expanded beyond his professional work, leading to extraordinary achievements in various areas.
Discover the methodology he used to go from a self-taught programmer hacking games to beating all computer games high scores, drastically optimizing a 27+ mile bike commute from 3 hours to just 54 minutes, and successfully getting waves in highly competitive Hawaii while surfing with people way better than him. Learn how to apply these same principles of optimization, lateral thinking, and strategic attack/defense to 'hack' your own life and reach your full potential in anything you pursue, including your professional challenges like Cybersecurity.

Duration: 45min

Keeping Your Agents on a Leash: Agentic guardrails, MCP Security, AI BOMs and Chatbot red-teaming

In this hands-on AI focused workshop you will learn how to: a) securely vibe coding using AI agentic coding tools like Cursor, Claude, Copilot, etc; b) how to detect Tool poisoning, Prompt injection risks, Toxic flow vulnerabilities in MCP servers using CLI tools; and c) how to do AI-focused red teaming against AI systems, LLM endpoints, and AI-powered APIs to uncover risks like jailbreaks, prompt injections, data leakage, and unsafe behaviors

AI Security Engineer Foundations

2-hour workshop on AI Security Engineer Foundations covering the following modules:
- OWASP Top 10 for Agentic Applications
- Addressing Shadow AI
- AI Governance and Policy as Code
- Securing Agent Skills & MCP
- Securing Vibe Coding
- AI Penetration Testing

See: https://aisecurity.engineer/ for more details, and to do the certification online for free

Beyond the Scanner: Frontier AI vs. Traditional DevSecOps in the Real World

Abstract
As frontier AI models become more capable, engineering teams are increasingly tempted to point LLMs at everything from static code analysis to threat modeling and incident response. But are frontier models actually here to replace your existing DevSecOps toolchain, or are they expensive hammers looking for the wrong nails?

This talk cuts through the hype to provide a pragmatic, battle-tested framework for combining frontier AI models with traditional DevSecOps tools. We will examine the distinct strengths and failure modes of both paradigms—comparing deterministic tools (SAST, DAST, SCA, linters) with probabilistic reasoning engines (frontier LLMs).

What You Will Learn:
The Core Divide: A clear breakdown of what deterministic security tools do best (speed, compliance, syntax) versus where frontier models excel (contextual reasoning, complex architectural review, nuanced threat modeling).

The Cost-Benefit Reality: How to evaluate latency, token costs, hallucination risks, and data privacy constraints against traditional scanning overhead.

Real-World Anti-Patterns: Common mistakes teams make when trying to use LLMs as drop-in replacements for standard security gates.

The Hybrid Playbook: How to build an integrated pipeline where traditional tools handle the heavy lifting and deterministic gating, while frontier models handle deep context analysis, remediation advice, and triage.

Whether you are a security engineer looking to adopt AI safely or a developer trying to cut through tool fatigue, you will walk away with a clear roadmap for when to leverage frontier AI—and when to stick to proven DevSecOps infrastructure.

Intermediate level talk, preferred duration 30-45min. Can be also a 2h workshop by running a lab where we would be running real world vulnerability scanning with agentic models and existing DevSecOps tools and comparing the results with a specific evaluation criteria