Topic 1
Secure Vibe Coding: 5 Key Lessons
AI coding assistants like Cursor, Copilot, and Windsurf significantly increase productivity and assist with mundane coding tasks. But while powerful, these tools carry risks: trained on vast public datasets, they inherit bad patterns without necessarily ensuring secure application development. In this talk, we'll share five key lessons for security engineers and developers to improve code security:
- Implement guardrails
- Get real-time security signal
- Watch your dependency blast radius
- Compensate for non-determinism
- Invest in prompt engineering
Bio:
Nate Michalov is a seasoned application security professional with over 12 years of diverse experience. Throughout his career, Nate has contributed to organizations such as Endor Labs, Apiiro, Snyk, Veracode, and Annkissam, where he has focused on securing digital ecosystems while aligning technological strategies with business objectives. In various roles including customer success architect, senior sales engineer, and senior SAST specialist, Nate has consistently tackled complex challenges at the intersection of business and technology. Known for his collaborative approach and dedication to staying informed about emerging trends, Nate is recognized as a trusted advisor in promoting innovation and resilience in application security.
Topic 2
Title: From the Engineering Trenches: What Every CISO Needs to Know About AI Development
Abstract:
After leading our engineering team through the AI development transformation, from the introduction of the first copilot version to today's autonomous agents, I've learned that the most dangerous security risks are the ones created by well-intentioned security policies and practices that don't match AI development realities. This presentation walks through critical milestones where engineering and security are either aligned for success or misaligned for chaos. You'll learn how to spot the warning signs of engineering-security friction, practical approaches for building security that works at AI-enabled development speed, and why the engineering teams that partner best with security are the ones moving fastest with AI.
Bio:
Leading tech innovator David Hafley, Head of Engineering at Pixee, blends leadership with tech expertise. Known for shaping global engineering teams, he champions large language models at Pixee, driving content and vulnerability solutions. Prior roles include Chief Product Officer at Dyknow, VP of Engineering at Contrast Security, and varied leadership roles from AWS environments to DevOps culture building. A seasoned speaker, David Hafley brings a wealth of knowledge to the Python conference stage, connecting tech, leadership, and the Python community.
