Engineering teams are shipping more code than any AppSec program was built to handle, while autonomous agents commit at 4 a.m. and merge on weekends. Meanwhile, autonomous security analysis is surfacing what legacy tooling missed for decades: 21 zero-days in FFmpeg, and an 18-year-old NGINX RCE powering a third of the web.

The uncomfortable second half is economic. When frontier-model security tooling is priced at enterprise scale, teams quietly skip scans and narrow coverage. Budget decisions become security decisions. This session challenged leaders on two fronts: whether their tooling can reason about AI-speed development at all, and whether the economics of their stack are silently creating the exact coverage gaps attackers exploit.