New OWASP Stockholm event announced: September 14th at Scila
Daniel Hållbro
We have a new event coming up on Wednesday 14th of October, with talks on:
A Simple Guide to Security in the Agentic SDLC with Ernest Barosevic, Semgrep
The Coverage Failure in Autonomous Pentesting with Yacine Souam, Escape
🔗 https://owasp.org/chapters/stockholm
🗓️ When: 14th of October, 17:30 - 20:00
📍 Where: Scila AB - Sveavägen 17, 111 27 Stockholm.
Meetup link: https://www.meetup.com/owasp-stockholm/events/316666796
🚀 Agenda:
17:30 - 18:00 Gathering and meeting industry peers.
18:00 - 18:05 Intro.
18:05 - 18:40 Talk 1
18:40 - 19:00 Break and mingling.
19:00 - 19:40 Talk 2
19:40 - 20:00 Closing words & meeting industry peers.
🌟More about the talks:
A Simple Guide To Security in the Agentic SDLC
Ernest Bartosevic
The SDLC we built assumes security happens at gates: threat modeling during design, a review on the PR, scanning after deploy. That only works if humans have the time to look and actually care while juggling 30 different tasks.
Many people will tell you we are "cooked" - but security has adapted before. We rebuilt the whole practice when waterfall gave way to agile. This talk is a practical guide to turning coding agents into the guardians of your security, rather than the source of your next incident. It covers which gates still stand, which ones need to move, and how to give agents the context, guardrails and feedback loops to enforce your policies, so AI becomes a co-pilot you can trust.
The Coverage Failure in Autonomous Pentesting
Yacine Souam
Most autonomous pentesting systems use either a fixed pool of specialist agents or a single agent that recursively spawns copies. Both fail by losing control of breadth: fixed pools spread effort evenly, while pure recursion goes depth-first, burns budget on early leads, and leaves major surfaces untested.
The research reframes pentesting as an explore/exploit search problem. A dedicated coverage agent continuously maps the attack surface, identifies gaps, and routes work to an orchestrator that preserves breadth while spawning specialists only where needed.
The talk covers the harness internals behind this approach: persona-isolated browser contexts for Broken Object Level Authorization (BOLA) and cross-tenant testing, an independent reporter agent that reproduces findings on live targets, recursive delegation with depth governance, and a capability layer that keeps agent context scoped.
It presents benchmarks against public AI pentest tools and a frontier-model baseline, then closes on two questions: how to evaluate agent-spawning systems, and whether specialist agents can be persisted and reused.