OWASP Toronto November 2026 Event

Finding Bugs Was Never the Hard Part: Why I Built mr.robot

Format:
Hybrid (in-person and online) event

In-person location:
Stan
1705-100 Queens Quay East, M5E 1Y3 ON
Livestream: To be announced

Note: In-person attendance is limited, in a first-come, first-serve basis.

Doors will open at 6:00 PM, with the event will start at 6:30 PM (ET).

For those who cannot attend in person, please join us virtually via the livestream!
**************************************************************************************
Finding Bugs Was Never the Hard Part: Why I Built mr.robot
We've gotten remarkably good at finding vulnerabilities. Between SAST, DAST, dependency scanners, and now AI-powered security tools, we're generating more findings than ever before. But here's an uncomfortable question: Are we actually making our products more secure?

While scaling product security across multiple 0-to-1 products at a 40M ARR fast-moving startup, I learned that finding vulnerabilities was rarely the hardest problem. The real challenge was getting engineers to understand the risk, prioritize the work, and ship fixes before those vulnerabilities became incidents. Traditional security tools often made this harder, producing noisy findings disconnected from the engineering and product decisions required to resolve them.

Now, AI-assisted development is accelerating how quickly we build software, and potentially how quickly we introduce security weaknesses. Simply finding more vulnerabilities won't solve that problem.

In this talk, we'll challenge the traditional vulnerability-centric approach to AppSec and explore what happens when we optimize for security outcomes rather than findings. We'll look at how to communicate risk in engineering and product language, identify recurring weaknesses, and build security into the path of least resistance for developers.

I'll also share the thinking behind mr.robot, a product example in using AI to bridge the gap between vulnerability discovery and remediation, with a practical demonstration of what this approach could look like.

The goal isn't to replace security engineers or eliminate vulnerability scanners. It's to rethink how we turn what we find into meaningful security improvements, without slowing down the teams building tomorrow's products.