Melbourne Secure Software and AppSec Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

AI-generated code is becoming a bigger part of software development, but it is also creating new security challenges. The risks of AI-generated and vibe coded software are drawing growing scrutiny, raising important questions about how organisations review and secure code created with AI.

This opening keynote explores how AI-generated code is changing application security, where traditional approaches may fall short, and how organisations can manage these risks at scale.

• Why AI-generated code is creating new security risks
• How AppSec, code review, and testing practices need to adapt to AI-generated code
• How organisations can manage the risk through stronger tools, processes, and accountability

As AI takes on a bigger role in writing, reviewing, and deploying code, traditional software governance needs to evolve. Many existing processes were designed around human developers and may not provide the right oversight for AI-generated work.

This keynote explores how organisations can update their governance, processes, and accountability as AI becomes a bigger part of software development.

• Where existing software governance may fall short when AI is involved
• What approval and accountability should look like for AI-generated code
• Practical steps to strengthen governance and reduce security and compliance risks

Building security into software early can help teams identify and fix issues before they become bigger problems. But many organisations still struggle to make security a natural part of the development process without slowing developers down.

This panel explores how teams can make security part of everyday development, improve collaboration between developers and security teams, and make shift-left security work in practice.

• What makes shift-left security work effectively
• How security champions can help build stronger security practices across development teams
• How to give developers the right security guidance without slowing down delivery

Many organisations rely on open source software but don't always have a clear view of what is inside their applications or where the risks are. As software supply chain security becomes more important, organisations need better visibility over their software and dependencies.

This case study explores how one team introduced a Software Bill of Materials (SBOM) and built a practical approach to managing open source and supply chain risk.

• What their first SBOM revealed about hidden dependencies and security risks
• How they built an ongoing process to identify, track, and address open source risks
• How they made SBOM data useful for security teams, rather than just a compliance requirement

A hands-on, interactive session working through a real software security scenario as a room. Details announced soon.

Security testing needs to keep up with faster software releases. If testing takes too long or creates too many delays, development teams may find ways around it.

This case study explores how one team automated security testing across its development pipeline, what they chose to automate, and where human testing was still needed.

• Which security tests they automated first and why
• How automation helped improve security without slowing down development
• Where automated testing still had gaps and required human oversight

As organisations use more containers and microservices, managing security across these environments can become more complex. Teams need to protect applications and services without creating delays in development and deployment.

This case study explores how one organisation improved container and microservices security while maintaining the speed of its deployment pipeline.

• Where they identified the biggest security gaps across containers and microservices
• How they improved image scanning, runtime protection, and access between services
• How they strengthened security without slowing down deployments

AI is creating new security risks, but it is also giving security teams new ways to find and respond to vulnerabilities faster. From automated testing to reviewing and prioritising security issues, AI is becoming a growing part of AppSec.

This panel explores where AI and AI agents are delivering real value, where their limitations remain, and when human expertise is still needed.

• Where AI is helping AppSec teams improve testing and identify security risks faster
• Where AI-powered security tools still require human review and oversight
• What teams should consider before using AI agents to make security decisions

Small-group, discussion-based sessions where you'll work through real software security challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Cyberattacks are moving faster, making it more important for organisations to detect and respond to application breaches quickly. Even with an incident response plan in place, a real attack can expose gaps that weren't expected.

This case study explores how one organisation responded to an application breach, what didn't work as planned, and how they improved their approach afterwards.

• What happened during the breach and where the response plan fell short
• What the team learned about responding to an incident under pressure
• How they improved their tools, processes, and communication for future incidents

Technology and automation are important, but strong software security also depends on culture. Security works best when developers, security teams, and leaders see it as a shared responsibility.

This closing keynote explores how organisations can build a stronger DevSecOps culture, improve collaboration between teams, and make security part of everyday software development.

• Why DevSecOps can struggle when the focus is only on tools and technology
• How developers and security teams can share responsibility for security
• How leaders can help build and support a strong security culture

Automation is helping security teams test software faster and at greater scale, but not every security risk can be identified automatically. Human expertise and manual testing still have an important role to play.

This interactive think tank will use live audience voting to explore how organisations are balancing automated and manual security testing, where gaps remain, and how AI could change that balance.

1. How much of your security testing is currently automated?
2. Where has automated testing missed risks that manual testing could have identified?
3. Is AI-generated code tested to the same standard as human-written code?
4. Who decides when automated testing is enough and when manual review is needed?
5. Where will you invest next: automation, manual testing, or AI-assisted security tools?

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

AI-generated code is becoming a bigger part of software development, but it is also creating new security challenges. The risks of AI-generated and vibe coded software are drawing growing scrutiny, raising important questions about how organisations review and secure code created with AI.

This opening keynote explores how AI-generated code is changing application security, where traditional approaches may fall short, and how organisations can manage these risks at scale.

• Why AI-generated code is creating new security risks
• How AppSec, code review, and testing practices need to adapt to AI-generated code
• How organisations can manage the risk through stronger tools, processes, and accountability

As AI takes on a bigger role in writing, reviewing, and deploying code, traditional software governance needs to evolve. Many existing processes were designed around human developers and may not provide the right oversight for AI-generated work.

This keynote explores how organisations can update their governance, processes, and accountability as AI becomes a bigger part of software development.

• Where existing software governance may fall short when AI is involved
• What approval and accountability should look like for AI-generated code
• Practical steps to strengthen governance and reduce security and compliance risks

Building security into software early can help teams identify and fix issues before they become bigger problems. But many organisations still struggle to make security a natural part of the development process without slowing developers down.

This panel explores how teams can make security part of everyday development, improve collaboration between developers and security teams, and make shift-left security work in practice.

• What makes shift-left security work effectively
• How security champions can help build stronger security practices across development teams
• How to give developers the right security guidance without slowing down delivery

Many organisations rely on open source software but don't always have a clear view of what is inside their applications or where the risks are. As software supply chain security becomes more important, organisations need better visibility over their software and dependencies.

This case study explores how one team introduced a Software Bill of Materials (SBOM) and built a practical approach to managing open source and supply chain risk.

• What their first SBOM revealed about hidden dependencies and security risks
• How they built an ongoing process to identify, track, and address open source risks
• How they made SBOM data useful for security teams, rather than just a compliance requirement

A hands-on, interactive session working through a real software security scenario as a room. Details announced soon.

Security testing needs to keep up with faster software releases. If testing takes too long or creates too many delays, development teams may find ways around it.

This case study explores how one team automated security testing across its development pipeline, what they chose to automate, and where human testing was still needed.

• Which security tests they automated first and why
• How automation helped improve security without slowing down development
• Where automated testing still had gaps and required human oversight

As organisations use more containers and microservices, managing security across these environments can become more complex. Teams need to protect applications and services without creating delays in development and deployment.

This case study explores how one organisation improved container and microservices security while maintaining the speed of its deployment pipeline.

• Where they identified the biggest security gaps across containers and microservices
• How they improved image scanning, runtime protection, and access between services
• How they strengthened security without slowing down deployments

AI is creating new security risks, but it is also giving security teams new ways to find and respond to vulnerabilities faster. From automated testing to reviewing and prioritising security issues, AI is becoming a growing part of AppSec.

This panel explores where AI and AI agents are delivering real value, where their limitations remain, and when human expertise is still needed.

• Where AI is helping AppSec teams improve testing and identify security risks faster
• Where AI-powered security tools still require human review and oversight
• What teams should consider before using AI agents to make security decisions

Small-group, discussion-based sessions where you'll work through real software security challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Cyberattacks are moving faster, making it more important for organisations to detect and respond to application breaches quickly. Even with an incident response plan in place, a real attack can expose gaps that weren't expected.

This case study explores how one organisation responded to an application breach, what didn't work as planned, and how they improved their approach afterwards.

• What happened during the breach and where the response plan fell short
• What the team learned about responding to an incident under pressure
• How they improved their tools, processes, and communication for future incidents

Technology and automation are important, but strong software security also depends on culture. Security works best when developers, security teams, and leaders see it as a shared responsibility.

This closing keynote explores how organisations can build a stronger DevSecOps culture, improve collaboration between teams, and make security part of everyday software development.

• Why DevSecOps can struggle when the focus is only on tools and technology
• How developers and security teams can share responsibility for security
• How leaders can help build and support a strong security culture

Automation is helping security teams test software faster and at greater scale, but not every security risk can be identified automatically. Human expertise and manual testing still have an important role to play.

This interactive think tank will use live audience voting to explore how organisations are balancing automated and manual security testing, where gaps remain, and how AI could change that balance.

1. How much of your security testing is currently automated?
2. Where has automated testing missed risks that manual testing could have identified?
3. Is AI-generated code tested to the same standard as human-written code?
4. Who decides when automated testing is enough and when manual review is needed?
5. Where will you invest next: automation, manual testing, or AI-assisted security tools?

Unwind with your peers for a couple of drinks on us!