AI writes a lot of your code now, and some of it is vulnerable. That goes for the code it generates, and for the LLM calls and agents you're wiring into your own applications. Meanwhile, frontier models have started finding vulnerabilities on their own and at scale. One recent run surfaced 23,000 of them across 1,000 open source projects, most absent from any CVE database. This first part covers the build and break sides of the loop. We start with what AI-generated code gets wrong and the new attack surface you inherit when you build LLMs into your apps. From there we dig into LLM-driven pentesting and security testing. And here's the good news: you don't need a frontier lab's budget for this. With deterministic analysis and off-the-shelf models, you can find and break vulnerabilities in your own code yourself. That's what we're going to do in part two!

Attackers can now discover bugs faster than any human AppSec team can keep up with, so defence has to run at machine speed too. The catch: an LLM on its own hallucinates, and a rule-based scanner on its own buries you in false positives. The useful combination is deterministic analysis for the verifiable facts (call graphs, data flows, dependency trees, known CVEs) plus an LLM that understands what the code does. In this second part we put that combination to work on a real .NET application, using AI agents with composable skills: threat modelling generated from the code itself, static analysis with AI-assisted fixing, and CVE triage that checks whether vulnerable dependency code is even reachable before you spend time on it. Then comes the repeat: how to fit all of this into your own workflow so it runs on every commit, not just once. You'll see what works today and where it still breaks.

I'll answer all the questions you post during the show.