August Meetup

Join us for the August Bay Area OWASP Meetup, proudly sponsored by Freshworks .
Spend the evening connecting with fellow security professionals, learning from insightful presentations, and engaging in meaningful discussions on the latest security topics. Enjoy great networking opportunities along with food and refreshments, generously provided by Freshworks.

5:00 PM : Doors open, Networking, food and drinks
5.30 PM- 6.15 :- Agentic AI Security and Non Human Identity Governance
6.15-7:00 PM :- Enterprise AppSec That Scales Itself
7.00-7.30 PM :- Preparing for the Post-Quantum Era: A Practical Enterprise Roadmap to Quantum-Safe Security
7.30-8.00 PM :- Migrating to an AI Editor? Watch Out for the "Extension Confusion" Trap

Talk #1: Agentic AI Security and Non Human Identity Governance
Most enterprises run AI agents on borrowed identity - the agent authenticates as the employee who launched it or a system user, inherits their full permissions, and vanishes into the audit log as a human or system user action.
This talk covers how we made AI agents first-class non-human identities on our agent platform, with dedicated short-lived credentials, least-privilege scope, and dual attribution to both agent and delegating humans. It then covers the runtime governance layer: a fail-closed, non-bypassable policy enforcement point gating every model call, tool call, code execution, and sub-invocation, mapped to the OWASP Agentic Top 10 (2026) — including the categories no policy engine can actually enforce.

Speaker #1:- Sergey Kalashian is a Principal AI Security Architect at Freshworks, where he architects the governance, risk, and compliance (GRC) capabilities of the company’s AI Agent Platform . His work focuses on building secure, governable, and auditable AI agents, ensuring they operate safely while meeting enterprise security and compliance requirements. Previously, at LivePerson, Sergey led the architecture of secure internal and external API integrations for the company’s AI Agent Platform, Conversation Builder.

Speaker#2 Gaurav Gupta is a Distinguished Engineer at Freshworks, where he drives security-first engineering practices across identity, access management, and AI-powered development. He leads the implementation of comprehensive Non-Human Identity (NHI) security controls—monitoring and securing service accounts, API keys, machine-to-machine, and agent-to-service interactions at enterprise scale. With 8 years at Amazon building large-scale distributed systems for ML-based risk detection and protecting Amazon's retail business from bad actors, Gaurav brings deep expertise in security, fraud, and abuse prevention. At Freshworks, he leads the Admin Platform's governance and IAM capabilities, embedding shift-left security practices including automated security gates in PR workflows, and proactive threat prevention. He also pioneers the AI Product Development Lifecycle (AI-PDLC), ensuring autonomous AI agents operate within secure, auditable, and compliant frameworks while maintaining rigorous enterprise-grade security and compliance standards in Freshworks products.

Talk#2 Enterprise AppSec That Scales Itself
Every enterprise security team knows the math doesn't work: a portfolio of 1,000+ applications, a team that can comprehensively assess maybe 60 a year, and industry-standard tools (SSPM, DAST, etc.) that only cover about 20% of the environment. The other 80% — on-prem systems, custom-built apps, cross-application data flows — gets no continuous coverage at all. By the time you circle back to reassess anything, the environment has already drifted out from under you.
What This Talk Covers
Kailey and Dheven walk through how they stopped trying to win a losing game and built something different: an autonomous AppSec program that combines AI-driven assessments, compounding institutional knowledge, and self-accumulating drift detection to continuously evaluate their most critical applications.
You'll get a real look at:

• The design principles that made it work — codifying methodology as portable artifacts before bringing AI in, so the model executes the methodology rather than defining it (and the org isn't locked to one vendor)
• The "snowball effect" — how every assessment generates machine knowledge that compounds across runs, and how confirmed findings turn into daily automated checks that build toward continuous monitoring
• Governed, just-in-time access — the "AI identity problem" of giving an autonomous system privileged access to production applications, and why this is one of the hardest parts of the whole model
• The assessment methodology itself — nine security domains, three compromise scenarios (external attacker, compromised internal identity, hardening gaps), and portfolio-wide integration/attack-chain mapping
• Real results — 70+ applications assessed, most running autonomously end to end, plus the false-positive feedback loop and stakeholder visualization layer that built trust with app owners
• Lessons learned — per-app tailoring vs. scale, knowing which applications don't fit the autonomous model, and a roadmap for teams who want to try this themselves

If your team is drowning in a portfolio-to-coverage ratio that traditional tooling can't fix, this talk lays out a concrete, field-tested path forward — and a minimum viable approach to test it in your own environment.

***

About the Speakers
Kailey Stauble is a Staff Security Engineer focused on enterprise application security, working at the intersection of AI-driven security tooling, assessment methodology, and program design at scale.
Dheven Kara co-leads the autonomous AppSec program alongside Kailey, bringing hands-on experience building the governance, access, and knowledge-accumulation systems that make continuous AI-driven assessment possible across a large enterprise portfolio.

Talk#3 Preparing for the Post-Quantum Era: A Practical Enterprise Roadmap to Quantum-Safe Security
Description:- Quantum computing is forcing organizations to rethink how cryptography is discovered, managed, and modernized across applications, networks, data, cloud infrastructure, and connected devices. This session explains the practical challenges of preparing for post-quantum cryptography, from understanding cryptographic exposure and Harvest-Now-Decrypt-Later risk to building a cryptographic inventory, prioritizing migration, adopting NIST-standardized algorithms, and designing for crypto-agility. Attendees will leave with a vendor-neutral framework for moving from awareness to a measurable quantum-safe migration program.
Speaker:- Amit Tomar - CTO PQCrypto.ai
Seasoned Network, Post-Quantum Cryptography, Fintech, and IoT security expert. Architected and designed large scale enterprise network management systems. Indian Institute of Technology (Kanpur)

Talk#4 Migrating to an AI Editor? Watch Out for the "Extension Confusion" Trap
Description: Enterprises spend millions securing third-party libraries and CI/CD pipelines, but we routinely ignore the software running inside our own code editors. In this talk, we introduce Extension Confusion - a class of supply-chain vulnerabilities affecting modern IDEs and emerging AI-driven developer environments (e.g., Cursor, Windsurf). While similar in principle to dependency confusion, Extension Confusion exploits the subtle identity gap between Microsoft’s Visual Studio Marketplace and open registries like Open VSX.

About Speaker: Rajyavardhan Handa is a Senior Cybersecurity Engineer specializing in AI/ML security and offensive security for enterprise platforms. He currently works at Workday and has previously held security roles at Walmart, Salesforce, and Ernst & Young. He has authored peer-reviewed papers in AI security and is an active open-source contributor, with accepted contributions to the Rapid7 Metasploit Framework and Kubernetes. He is an IEEE Senior Member and holds multiple security certifications, including CISSP and Certified AI Security Professional. He holds an MS in Computer Science from Rutgers University, NJ and a BE in Information Science from VTU, India.