The APIsec security testing platform discovers the most serious API vulnerabilities that lead to data theft and compromise.
San Francisco, CA 94103, USA
Joined April 2020
- Tweets186
- Following25
- Followers3.2K
- Likes47
Bashar Abouseido's one-line board message at apisec|con: "Hyper offense will require hyper defense." AI attacks run at machine speed. Defense has to use AI at scale too, focused on exploitability and validation. What would your one line to the board be?
Watch the full fireside chat with Bashar Abouseido from apisec|con 2026: youtu.be/kM1C-k3nZSg
Read the takeaways for security leaders: apisec.ai/blog/hyper-defense…
26,000 agents. 48 hours. About $15,000. That's the cost Bashar Abouseido cited at apisec|con for an AI agent test. Massive, parallel offense is cheap now, and getting cheaper. If you're learning AppSec, this is the threat model you're training for.
Watch the full fireside chat with Bashar Abouseido from apisec|con 2026: youtu.be/kM1C-k3nZSg
Read the takeaways for security leaders: apisec.ai/blog/hyper-defense…
Thousands of AI-generated fixes. Who vets them?
OWASP OASIS: AI → community validation → maintainer.
Michael Cartsonis walks through it Wednesday.
conf.apisecuniversity.com
Your coding agent rediscovers your API from scratch every session.
Which endpoint goes first. Which field is really required. Which call returns 200 and does nothing.
Sterling Chin on where that knowledge should live. apisec|con, Oct 21.
Code review used to ask "why did you write this?"
Now the author is an agent whose session already ended.
Sterling Chin on reviewing agent-written API code when nobody remembers why. Free, virtual, Oct 21.
Most AppSec programs aren't short on scanners.
They're short on capacity, context, and evidence.
Perry Menezes (ex-KPMG, Deutsche Bank) on running AI as a governed AppSec program, not another tool. apisec|con, Oct 21.
You can't recall an open-weight model.
No vendor safeguards. No usage monitoring. Capability months behind the frontier.
What has to change for defenders this year? Bashar Abouseido (ex-Schwab CISO) on it at apisec|con, Oct 21.
"Critical" findings that don't matter. Board reports that answer the wrong question.
Prioritize by exploitability, not severity.
Perry Menezes, apisec|con, Oct 21.
25 minutes. No demo. No code.
You leave with a 90-day plan, an agent risk register, and five metrics to take to your CISO.
Perry Menezes: How to Build an AppSec Program with Claude. apisec|con, Oct 21.
Your triage workflow assumes breathing space.
AI-assisted research is shrinking the gap between "vulnerable" and "exploitable."
A bug can become exploitable before your org decides whether it matters.
@HackWitHerr breaks it down 👇
#AppSec #AISecurity
