London Secure Software and AppSec Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

AI-generated code is becoming a bigger part of software development, but it is also creating new security challenges. The UK's National Cyber Security Centre (NCSC) has highlighted the risks of AI-generated and "vibe coded" software, raising important questions about how organisations review and secure code created with AI. This opening keynote explores how AI-generated code is changing application security, where traditional approaches may fall short, and how organisations can manage these risks at scale.

• Why AI-generated code is creating new security risks for UK organisations.
• How AppSec, code review, and testing practices need to adapt to AI-generated code.
• How organisations can manage the risk through stronger tools, processes, and accountability.

As AI becomes a bigger part of software development, organisations need to rethink how that software is governed. In the UK, AI is being addressed through existing regulators and evolving guidance, meaning organisations need to build their own approach rather than wait for a single set of rules. This keynote explores how governance needs to change as more code is created with AI, and how organisations can put the right oversight, processes, and accountability in place.

• How the UK's approach to AI regulation is shaping software governance.
• What approval and accountability look like when AI contributes to the codebase.
• Practical steps to strengthen governance and reduce compliance and security risks.

Shift-left security has been the industry mantra for years, yet most organisations still find security bolted on late, and security champions programs often stall without real developer buy-in. This panel examines what's actually working to embed security from the first line of code, rather than as a gate before release, and what's needed to make shift-left more than a slogan.

• What separates AppSec programs where shift-left genuinely works from those where it's nominal.
• The role of security champions programs and where they succeed or fail.
• Practical ways to give developers security context without slowing them down.

Many organisations rely heavily on open source software but don't always have a clear picture of what is inside their applications or where the risks are. With software supply chain requirements increasing in the UK and EU, having greater visibility is becoming more important. This case study explores how one team introduced a Software Bill of Materials (SBOM) and built a practical approach to managing open source and supply chain risk.

• What their first SBOM revealed about hidden dependencies and security risks.
• How they built an ongoing process to identify, track, and address open source risks.
• How they prepared for changing UK requirements and the EU Cyber Resilience Act.

A hands-on, interactive session working through a real software security scenario as a room. Details announced soon.

Cyberattacks are moving faster, putting greater pressure on organisations to detect and respond to application breaches quickly. Even with an incident response plan in place, the reality of managing a live breach can expose unexpected gaps. This case study explores how one organisation responded to an application breach, what didn't work as planned, and how they improved their approach afterwards.

• What happened during the breach and where the existing response plan fell short.
• What the team learned about responding to an incident under pressure.
• How they improved their tools, processes, and communication for future incidents.

Containerised and microservice architectures have multiplied the number of things that need securing while often reducing visibility into what's actually running. This case study details how one organisation closed critical gaps in container image security, runtime protection, and microservice-to-microservice access control, without slowing their deployment pipeline.

• Where their container and microservice environment was most exposed.
• Practical steps taken on image scanning, runtime protection, and east-west access control.
• How they maintained deployment speed while closing the gaps.

While AI creates new risk in how code is written, as the NCSC's own guidance acknowledges, it's also becoming a genuine tool for defenders, powering automated penetration testing, faster triage, and security review at a scale human teams can't match alone. This panel examines where AI is actually proving useful in AppSec today, and where it's still overhyped.

• Where AI-driven security tools are delivering real results in AppSec today.
• The limits of current AI pentesting and triage agents, and where human review still matters.
• What teams should evaluate before trusting AI agents with security decisions, in line with emerging NCSC guidance.

Small-group, discussion-based sessions where you'll work through real software security challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

With exploited vulnerabilities and attack timelines both accelerating, thanks in part to attackers using AI to weaponise flaws faster, incident response plans built for a slower era are being tested and found wanting. This case study walks through a real application breach, what the existing response plan got wrong in the moment, and what was rebuilt afterward.

• What actually happened in the breach, and where the response plan broke down in real time.
• The gap between their documented incident response plan and what worked under pressure.
• What they rebuilt afterward, in tooling, process, and communication.

Tools and automation only get an AppSec program so far; the organisations with genuinely strong security postures tend to have a culture where security is a shared responsibility, not a separate team's problem. This closing keynote covers what it actually takes to build that culture, and why so many DevSecOps transformations stall at the tooling stage.

• Why DevSecOps initiatives often succeed technically but fail culturally.
• What shared ownership of security actually looks like day to day between developers and security teams.
• Leadership behaviours that reinforce or undermine a security-first culture.

Automation has transformed security testing coverage and speed, but not every risk can be caught by a scanner, and over-reliance on automation has its own failure modes. This session puts the trade-off directly to the room with live voting, then debates where the balance should actually sit.

• What share of your security testing today is automated versus manual?
• Where has automated testing missed something a manual review would have caught?
• Is your organisation's AI-generated code subject to the same testing rigour as human-written code, in line with NCSC guidance?
• Who owns the decision on where to draw the line between automated and manual testing?
• Where will you invest next: test automation, manual review capacity, or AI-assisted testing tools?

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

AI-generated code is becoming a bigger part of software development, but it is also creating new security challenges. The UK's National Cyber Security Centre (NCSC) has highlighted the risks of AI-generated and "vibe coded" software, raising important questions about how organisations review and secure code created with AI. This opening keynote explores how AI-generated code is changing application security, where traditional approaches may fall short, and how organisations can manage these risks at scale.

• Why AI-generated code is creating new security risks for UK organisations.
• How AppSec, code review, and testing practices need to adapt to AI-generated code.
• How organisations can manage the risk through stronger tools, processes, and accountability.

As AI becomes a bigger part of software development, organisations need to rethink how that software is governed. In the UK, AI is being addressed through existing regulators and evolving guidance, meaning organisations need to build their own approach rather than wait for a single set of rules. This keynote explores how governance needs to change as more code is created with AI, and how organisations can put the right oversight, processes, and accountability in place.

• How the UK's approach to AI regulation is shaping software governance.
• What approval and accountability look like when AI contributes to the codebase.
• Practical steps to strengthen governance and reduce compliance and security risks.

Shift-left security has been the industry mantra for years, yet most organisations still find security bolted on late, and security champions programs often stall without real developer buy-in. This panel examines what's actually working to embed security from the first line of code, rather than as a gate before release, and what's needed to make shift-left more than a slogan.

• What separates AppSec programs where shift-left genuinely works from those where it's nominal.
• The role of security champions programs and where they succeed or fail.
• Practical ways to give developers security context without slowing them down.

Many organisations rely heavily on open source software but don't always have a clear picture of what is inside their applications or where the risks are. With software supply chain requirements increasing in the UK and EU, having greater visibility is becoming more important. This case study explores how one team introduced a Software Bill of Materials (SBOM) and built a practical approach to managing open source and supply chain risk.

• What their first SBOM revealed about hidden dependencies and security risks.
• How they built an ongoing process to identify, track, and address open source risks.
• How they prepared for changing UK requirements and the EU Cyber Resilience Act.

A hands-on, interactive session working through a real software security scenario as a room. Details announced soon.

Cyberattacks are moving faster, putting greater pressure on organisations to detect and respond to application breaches quickly. Even with an incident response plan in place, the reality of managing a live breach can expose unexpected gaps. This case study explores how one organisation responded to an application breach, what didn't work as planned, and how they improved their approach afterwards.

• What happened during the breach and where the existing response plan fell short.
• What the team learned about responding to an incident under pressure.
• How they improved their tools, processes, and communication for future incidents.

Containerised and microservice architectures have multiplied the number of things that need securing while often reducing visibility into what's actually running. This case study details how one organisation closed critical gaps in container image security, runtime protection, and microservice-to-microservice access control, without slowing their deployment pipeline.

• Where their container and microservice environment was most exposed.
• Practical steps taken on image scanning, runtime protection, and east-west access control.
• How they maintained deployment speed while closing the gaps.

While AI creates new risk in how code is written, as the NCSC's own guidance acknowledges, it's also becoming a genuine tool for defenders, powering automated penetration testing, faster triage, and security review at a scale human teams can't match alone. This panel examines where AI is actually proving useful in AppSec today, and where it's still overhyped.

• Where AI-driven security tools are delivering real results in AppSec today.
• The limits of current AI pentesting and triage agents, and where human review still matters.
• What teams should evaluate before trusting AI agents with security decisions, in line with emerging NCSC guidance.

Small-group, discussion-based sessions where you'll work through real software security challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

With exploited vulnerabilities and attack timelines both accelerating, thanks in part to attackers using AI to weaponise flaws faster, incident response plans built for a slower era are being tested and found wanting. This case study walks through a real application breach, what the existing response plan got wrong in the moment, and what was rebuilt afterward.

• What actually happened in the breach, and where the response plan broke down in real time.
• The gap between their documented incident response plan and what worked under pressure.
• What they rebuilt afterward, in tooling, process, and communication.

Tools and automation only get an AppSec program so far; the organisations with genuinely strong security postures tend to have a culture where security is a shared responsibility, not a separate team's problem. This closing keynote covers what it actually takes to build that culture, and why so many DevSecOps transformations stall at the tooling stage.

• Why DevSecOps initiatives often succeed technically but fail culturally.
• What shared ownership of security actually looks like day to day between developers and security teams.
• Leadership behaviours that reinforce or undermine a security-first culture.

Automation has transformed security testing coverage and speed, but not every risk can be caught by a scanner, and over-reliance on automation has its own failure modes. This session puts the trade-off directly to the room with live voting, then debates where the balance should actually sit.

• What share of your security testing today is automated versus manual?
• Where has automated testing missed something a manual review would have caught?
• Is your organisation's AI-generated code subject to the same testing rigour as human-written code, in line with NCSC guidance?
• Who owns the decision on where to draw the line between automated and manual testing?
• Where will you invest next: test automation, manual review capacity, or AI-assisted testing tools?

Unwind with your peers for a couple of drinks on us!