Toronto Cybersecurity Conference

Application security has become a forecasting exercise.

We rely on CVEs, scanners, and severity scores to predict what might go wrong. But in an AI-driven world, where code ships faster and attacks move faster, prediction is no longer enough.

Forecasts don’t tell you what’s being exploited. They don’t tell you what’s reachable. And they don’t tell you what’s under attack right now.

This talk shows why forecast-only security breaks down in the machine-speed-era, and what replaces it.

You’ll see how runtime visibility changes application security from a guessing game into an operational discipline – revealing real attack paths, reducing noise, and enabling teams to detect and stop attacks in production.

AI coding assistants promise massive productivity gains, but recent academic research shows they also introduce instability, security weaknesses, and developer overconfidence. In this talk, I present data from large-scale studies demonstrating how AI-generated code affects delivery performance, vulnerability rates, and developer decision-making. I then outline a practical, end-to-end approach for reducing AI-induced risk while preserving the benefits of AI-assisted development.

As organizations race to deploy AI agents, training pipelines, and autonomous workflows, a critical foundation is playing catch-up: identity. Without a unified, cryptographically backed identity framework—one that extends seamlessly across humans, AI agents, CI/CD pipelines, and arbitrary workloads—every layer of the AI lifecycle is exposed to unauditable, ungovernable risk.

This talk argues that cryptographic identity is not merely a security best practice but the essential building block for trustworthy AI. From model training environments where data provenance and access control determine integrity, to production systems where autonomous agents act on behalf of users and organizations, the ability to authenticate, authorize, and audit every actor in the chain is what separates experimentation from enterprise-grade AI. We will explore how a unified identity plane eliminates the fragmented, secret-laden approaches dominating today’s infrastructure and why organizations that solve identity first will unlock AI’s full potential: securely, at scale, and with confidence.