Tirsdag – 1 · Frimurerlosjen, rom 1
Head of Product Security @ Vend
Emil Vaagland is the Head of Product Security at Vend where he is trying to scale effective appsec across hundreds of developers and teams. Previously he has experience from being a part of both engineering teams developing products to doing hands-on security engineering work to scale appsec.
In 2024, the research consensus was clear: LLMs cannot reliably find security vulnerabilities. Not without hybrid architectures, static analysis scaffolding, and carefully engineered prompts. By early 2026, a single model had found over 500 zero-day vulnerabilities in open source code, including deep logic bugs that fuzzers had missed for years. No custom tooling. No specialized prompts. No scaffolding.
Finding bugs is one thing. Doing security work inside an organization is another. That takes context: your assets, your logs, your code, your tools.
This talk is about what happens when a small security team stops waiting for the dust to settle and starts building. Over the past year, we've been experimenting with AI agents for real security tasks: triaging bug bounty reports and code scanning alerts, running security assessments, automating security code review, and investigating incidents. We gave Claude the same skills our security engineers have, and the real power is in how it chains them together. Give it a vulnerability report and it can pull the source code, trace who calls the affected API using runtime data, analyze their code too, build a picture of the blast radius, fire off a proof of concept, and check the logs to see what actually happened. In one conversation, very fast, and without mistakes... after some guidance.
I'll cover what we built, the design patterns behind it, and how we evaluate whether the agents are actually right. You'll see real examples and real failures from building these tools over the past year.
For security engineers and anyone trying to figure out what AI means for their security workflow.
Programmet er oppdatert.