OWASP San Antonio: Mythos/GlassWing Defense Strategies; AI Search

Presentation Sessions: 11am-3:00pm
Happy Hour: 3:00pm-4:30pm

Join us for a deep dive into the rapidly evolving intersection of artificial intelligence and application security. As AI accelerates vulnerability discovery, software development, and offensive security operations, traditional security models are being challenged to keep pace.

This meeting will bring together security practitioners and industry experts to explore emerging approaches to defending applications and software supply chains in an era of AI-powered attacks. We will examine how technologies and concepts such as Mythos, Glasswing, AI-assisted security operations, and runtime protection are changing the way organizations identify, prioritize, and respond to security risks.

From runtime-driven defense and intelligent vulnerability prioritization to emerging approaches for securing modern application environments, this session will focus on practical strategies organizations can use to adapt their AppSec programs to operate at the speed of AI.

(Virtual attendance is free. In-person attendance is $20 to help cover the cost of lunch.)

Featured Presentations

Beyond Detection: Operating Security at Runtime in the AI Era - Teddi Poehls, Head of Sales Engineering (Impart Security)
Artificial intelligence is reshaping cybersecurity faster than most organizations can adapt. AI agents, machine identities, and autonomous workflows are creating new attack paths while dramatically accelerating the pace of vulnerability discovery and exploitation. For many security teams, the result is more alerts, more patching, and more operational complexity. This session argues that the answer isn't simply more AI, it is a different operating model.

We'll explore how emerging approaches such as Glasswing, Mythos, and AI-assisted security operations are shifting the industry from reactive detection toward intelligent, runtime-driven protection.

Building on the idea that runtime is becoming the modern security control plane, this talk explores how runtime context changes the way organizations approach vulnerability management, prioritization, and incident response. We'll discuss why every CVE doesn't deserve an emergency patch, how virtual Layer 7 protections can dramatically reduce operational pressure, and how runtime intelligence enables security teams to make calmer, more informed decisions.

Attendees will gain insights into:

• How AI is changing the application security threat landscape
• The role of runtime context in vulnerability prioritization and response
• How virtual Layer 7 protections can reduce patching and remediation pressure
• Moving from reactive detection toward intelligent runtime-driven defense
• Practical considerations for adapting security operations to AI-powered threats

Designing an AppSec Architecture That Limits the Blast Radius of Attacks - John Gall, Solutions Engineer (Cloudflare)
Modern application security requires more than preventing attacks at the perimeter. As applications become increasingly distributed across APIs, cloud infrastructure, and edge networks, organizations need security architectures that can contain attacks and limit their impact when defenses are bypassed.
This session explores how organizations can design application security architectures that reduce the blast radius of successful attacks. John Gall will discuss practical approaches to WAF deployment, API security, distributed threat analysis, and defense-in-depth strategies across modern edge environments.
Attendees will gain insights into:

• Designing defense-in-depth security architectures for modern applications
• Using WAF and API security controls to reduce application attack exposure
• Applying threat intelligence to identify and mitigate emerging application threats
• Limiting the blast radius when vulnerabilities or attacks bypass preventative controls
• Protecting critical assets across distributed cloud and edge environments

The Trust Gap - Chris Wilburn, Senior Director of Strategic Growth & Partnerships (Veracode)
AI makes software creation abundant. Trust becomes scarce.
AI is not simply accelerating professional developers; it is expanding who can create software and how quickly. That creates a new enterprise trust problem. Probabilistic AI is powerful at reasoning, discovery, and contextual analysis, while deterministic analysis provides repeatability, verification, and evidence. As software creation becomes abundant, the security challenge shifts from simply finding risk to deciding — quickly and defensibly — what can be trusted.
This session explores the growing trust gap created by AI-driven software development and the need to combine the strengths of probabilistic AI with deterministic security analysis. Attendees will examine how organizations can build the visibility, governance, and evidence needed to make informed security decisions as the pace and scale of software creation continue to accelerate.
Attendees will gain insights into:

• How AI is changing the scale and speed of software creation
• The emerging enterprise trust challenges created by AI-generated software
• The complementary roles of probabilistic AI and deterministic security analysis
• Why repeatability, verification, and evidence remain important for application security
• How organizations can make faster and more defensible decisions about what software can be trusted

Security Panel Discussion
Our security panel will bring together practitioners and industry experts to discuss how artificial intelligence is changing application security, vulnerability discovery, and defensive operations.

The panel will explore emerging technologies and approaches including AI-assisted vulnerability discovery, runtime defense, software security automation, and the challenges organizations face as attackers and defenders increasingly operate at machine speed.

Discussion topics will be announced as the panel is finalized.

Call for Panel Topics: Send your suggestions to [Brent.Daugherty@owasp.org](mailto:Brent.Daugherty@owasp.org).

Facilitator: Joseph Gregorio, President OWASP San Antonio, VP Application Security Frost Bank

Additional Meeting Details
Lunch ($20 paid in person or via our Square account).
Square payment link: https://square.link/u/uTCUQggL

```
Disclaimer: You do not need to be a Meetup member to attend this event. In-person attendees may purchase lunch through our Square payment link or pay on-site at the event. Virtual attendance is completely free, and no payment is required through Meetup.
```

Location: Scuzzi’s Italian Restaurant - 4035 N Loop 1604 W #102, San Antonio, TX 78257
HAPPY HOUR & NETWORKING after session!!!

Happy Hour - Sponsors
* Impart Security
* Cloudflare
* Veracode

Join Zoom Meeting
https://us06web.zoom.us/j/87207794839?pwd=UFkak2WztdvOzfTMaIhZtrTwyr85JL.1
Meeting ID: 872 0779 4839
Passcode: 313910

We encourage everyone to attend in person. We will have door prizes and excellent food for all to enjoy, along with a great opportunity to connect with fellow security professionals.

Please feel free to pass this information on to your peers and team members. 😊

Future Presentation Topics To Vote On

• Post-Quantum Computing
• ASPM
• Pentest
• Ransomware
• DevSecOps - Security as Code
• Security Controls for AI