--- title: "AI Security Summit London 2026" description: "AI Security Summit London is in London, UK on May 14, 2026. Where security meets governance, and where the EU AI Act gets real." canonical: "https://aisecuritysummit.com/events/london-2026" --- # AI Security Summit London 2026 > Where security meets governance, and where the EU AI Act gets real. Where security meets governance, and where the EU AI Act gets real. One day. Two tracks. Boardroom governance in the morning, hands-on red teaming in the afternoon, with the people building and securing AI systems in the same building, on the same day. ## Event details - Date: May 14, 2026 - Starts: 2026-05-14T09:00:00+01:00 - Location: London, UK - Venue: South Place Hotel, 3 South Place, London EC2M 2AF - Venue: CodeNode London, 10 South Place, London EC2M 7EB - Format: 2 tracks: Leadership Track and Practitioner Track - Status: this event has already taken place. ## Leadership Track For Strategic Decision-Makers Built for: The people making AI risk decisions at scale, and who need a room where they can be honest about what's working and what isn't. Topics: - AI governance and org design - Board-level risk communication - Model and vendor due diligence - Staffing for threats that didn't exist two years ago - Real incident post-mortems: decisions made, trade-offs accepted ## Practitioner Track For Hands-On Experts Built for: The people who'll be breaking or fixing things on Monday. Engineers, red teamers, and AppSec teams who want to leave with something they can actually use. Topics: - LLM vulnerability patterns - Prompt injection & jailbreak defense - AI red teaming with live demos - Securing models, pipelines, and inference endpoints - Detection and incident response playbooks ## Agenda: Leadership Track ### May 14, 2026: Leadership Breakfast - **08:30 – 08:55** Networking Breakfast (networking) - **08:55 – 09:05** Opening Remarks - Speakers: Brian Vermeer (Staff Developer Advocate, Snyk) - **09:05 – 09:25** Agentic Development Security: The Three Problems Nobody Was Solving — and the One That Matters Most for 2026 (keynote) - Speakers: Manoj Nair (CTO & Chief Innovation Officer, Snyk) - Most enterprise AI discussions focus on agents in production. The bigger shift is upstream: software is now being written by agents, not developers. That introduces three security problems no existing category solves — the supply chain of tools the agent depends on (MCP servers, skills, plugins), the behavior of the agent itself, and the code it produces. This keynote breaks down what's changing, why traditional AppSec doesn't cover it, and the one problem that matters most heading into 2026. - **09:25 – 09:45** How agents won best bug at a live hacking event. - Speakers: Shlomie Liberow (Founder and CEO, Aisy) - We won best bug at a recent live hacking event - an invite-only competition where top-ranked hackers go head-to-head on live production targets, using agents built around bug bounty methodology. This talk digs into how it actually worked: the approaches that paid off, the bug classes that landed maximum impact, and the challenges of agents misclassifying real impact. You'll leave with a perspective on what's possible with current ungated SOTA models, a clearer sense of where agents add value vs. just slow you down, and what this means for the future of bug bounty programs and the defenders on the other side. - **09:45 – 09:55** Coffee Break - **09:55 – 10:15** Autonomous Offensive Security: Hacking McKinsey, BCG, and Bain - Speakers: Paul Price (Founder and CEO, CodeWall) - Autonomous AI agents can now execute the full offensive lifecycle without a human in the loop — and most organisations aren't ready for what that means. Within two hours, an agent had access to 46.5 million McKinsey records and the ability to silently rewrite their AI system prompts. No authentication needed to walk into BCG's 131-terabyte data warehouse. And Bain's credentials were in a public JavaScript file, found in eighteen minutes, chained into a backdoor through their identity infrastructure. Three of the most prestigious firms on earth compromised with $50 worth of tokens. This talk is the evidence and what it means for your threat model. - **10:15 – 10:30** Securing the Agentic Enterprise - Speakers: Ariel Dan (CEO, Rogue Security) - AI agents are already inside your organization. The question isn't whether to use them — it's whether you know where they are, what they're doing, and who's in control when something goes wrong. This session breaks down the three categories of agents operating in enterprise environments today: agents your team built, agents embedded in the SaaS tools you already pay for, and shadow agents spinning up without IT's knowledge. Each carries a distinct risk profile. Most organizations have no inventory of any of them. Includes a real attack chain walkthrough — a plain PDF, no malware, no zero-day; hidden white-on-white text entered an agent's context window, and in 93 seconds: credentials dumped, 12,000 employee records exfiltrated, a routine Slack update posted, and the agent moved on. Every traditional security tool in the stack missed it. - **10:30 – 10:35** Closing Remarks - Speakers: Manoj Nair (CTO & Chief Innovation Officer, Snyk) ## Agenda: Practitioner Track ### May 14, 2026: Practitioner Track - **09:45 – 10:45** Registration & Networking Breakfast (networking) - **10:45 – 11:00** Opening Remarks - Speakers: Brian Vermeer (Staff Developer Advocate, Snyk) - **11:00 – 11:20** A Practical Look at Insecure Agent Architectures - Speakers: Joe Bollen (Staff Forward Deployed Engineer, AI Incubation, Snyk) - The most interesting vulnerabilities in multi-agent systems often emerge at the interactions and chains between agents — requiring a different way of thinking about where failures come from. This talk walks through practical work attacking and defending these systems, covering ways to find unsafe paths, approaches to containing them, and how to test whether these controls actually hold. - **11:20 – 11:40** Don't Secure the Code, Secure the Coder: Can Security Keep Up With Agentic Dev? - Speakers: Guy Podjarny (Founder and CEO, Tessl) - AI agents are becoming the primary authors of software, and they break the assumptions AppSec was built on. Agentic development is non-deterministic, driven by intent rather than code, and moves faster than cloud ever did. Bolting traditional controls onto this won't cut it — security has to move from securing the code to securing the coder. - **11:40 – 12:00** VASO: Open-Source Security Testing for AI Agents - Speakers: Simon Roses Femerling (Founder & CEO, VULNEX) - Everyone is shipping AI agents into production, but almost nobody is testing the components that actually make them dangerous: Skills, MCPs, and tool integrations. The ClawHavoc campaign showed what happens when that gap gets exploited — over 1,184 poisoned Skills ended up on a major marketplace with malicious payloads hidden in plain sight. VASO is an open-source scanner built to catch exactly this kind of thing. Live demo against real targets, with a walkthrough of how to integrate it into day-to-day security workflows. - **12:00 – 12:20** Unpacking the Riskiest Agentic Threats: The OWASP Top 10 for Coding Agents - Speakers: Bar Kaduri (Head of Research, Capsule Security) - AI coding agents now sit directly in the critical path of how software is written, modified, and shipped. Tools like GitHub Copilot, Cursor, Amazon Q Developer, and Replit's AI assistant routinely generate code, execute commands, manage dependencies, and in some cases push changes straight into production. Yet the security implications of giving autonomous systems this level of access remain poorly understood. Recent incidents—including the Amazon Q prompt poisoning attack that risked file wipes, Cursor's multiple RCE vulnerabilities, and the Replit "vibe coding" meltdown where an agent deleted a production database—demonstrate that coding agents present a unique attack surface requiring dedicated security guidance. While the OWASP Agentic Security Initiative (ASI) provides essential foundations for agentic AI security, coding agents operate in uniquely privileged environments with direct filesystem access, shell execution capabilities, package installation rights, and often production deployment permissions. This talk proposes a rethink of our current assumptions, which are continuously breaking down in this new agent threat reality. We present an alternate and more specialized framework to address these risks: the OWASP Top 10 for Coding Agents, adapting the newly released OWASP Agentic Security Initiative (ASI) Top 10 specifically for the coding agent context. Drawing from real-world CVEs (including CVE-2025-31491, CVE-2025-43051, and others documented in the ASI Exploits Tracker), this talk provides actionable mitigations for security teams, developers, and organizations deploying coding agents. Attendees will leave with a practical checklist for securing their AI-assisted development pipelines and contributing to the proposed OWASP standard. - **12:20 – 13:00** Beyond the Chatbot: Orchestrating the Agentic Enterprise at Scale - Speakers: Kevin Keller (Field CTO Lead EMEA (AI Agents & Hybrid Cloud Architecture & Observability), Snowflake); Massimo Angelino (Principal Specialist Solution Architect GTM AI/ML EMEA, AWS); Oliver Neuberger (Cybersecurity Lead, Accenture) - **13:00 – 13:40** Networking Lunch (networking) - **13:40 – 14:10** Snyk Workshop: Securing Vibe Coding (workshop) - Speakers: Micah Silverman (Director, AI Acceleration, Snyk); Javier Garza (Staff Developer Advocate, Snyk) - As AI coding tools become embedded in daily development, they bring both a new wave of productivity and new security risks. We'll break down the security implications of Vibe Coding and share actionable strategies to secure AI-generated code at scale. - **14:15 – 14:45** Snyk Workshop on AI Red Teaming: Hack a Chatbot (workshop) - Speakers: Javier Garza (Staff Developer Advocate, Snyk); Micah Silverman (Director, AI Acceleration, Snyk) - Securing AI-native applications is fundamentally a problem of predictability. Traditional security tools, built for deterministic code, cannot validate systems that plan, act, and evolve. In this hands-on Capture the Flag workshop, you won't just learn about AI risks — you'll exploit them. Step into the role of an attacker, where your mission is to bypass guardrails, manipulate model instructions, and exfiltrate protected data from a live AI assistant. You'll learn the art of prompt injection, how to exfiltrate data in the blind spot, and how to apply Snyk AI Red Teaming principles to move from manual penetration testing to an always-on validation layer that catches vulnerabilities before they reach production. - **14:50 – 15:00** Break - **15:00 - 15:30** Snyk Workshop on Agentic Development Security: Securing Agents & MCP (workshop) - Speakers: Micah Silverman (Director, AI Acceleration, Snyk); Javier Garza (Staff Developer Advocate, Snyk) - The rise of autonomous AI agents is creating a new paradigm in software development, powered by an exploding ecosystem of reusable Skills. But as developers rush to extend their agents with capabilities from public registries like ClawHub, a dangerous new attack surface has emerged: the humble SKILL.md file. We'll dissect the ToxicSkills research and step into the shoes of an attacker. You'll understand the lethal trifecta (access to private data, exposure to untrusted content, and external communication) that makes compromised agents dangerous insider threats; dissect real-world examples from the ToxicSkills campaign and Leaky Skills research; and learn how to use tools like mcp-scan and AI-BOM to detect tool poisoning, uncover Shadow AI, and enforce security policies for autonomous agents. - **15:35 - 16:05** Snyk Workshop on AIBOM: Addressing Shadow AI (workshop) - Speakers: Micah Silverman (Director, AI Acceleration, Snyk); Javier Garza (Staff Developer Advocate, Snyk) - The AI Security Engineer is rapidly becoming one of the most critical roles in the modern DevSecOps landscape. But as developers move at light speed to deploy AI-native applications, a dangerous gap is widening: the disconnect between the tools used to build AI and the visibility security teams need to protect it. How do you secure what you can't see? Step into the shoes of an AI Security Engineer to navigate what surfaces when you look under the hood of your AI posture. You'll learn the tools required to uncover Shadow AI, how security conversations are now changing within organizations, and how to provide intelligence and policy enforcement for autonomous AI without slowing down innovation. - **16:10 - 16:30** Workshop Debrief & Closing Notes - Speakers: Micah Silverman (Director, AI Acceleration, Snyk); Javier Garza (Staff Developer Advocate, Snyk); Brian Vermeer (Staff Developer Advocate, Snyk) - **16:30 – 18:30** Happy Hour (networking) ## Speakers - **Ariel Dan (CEO, Rogue Security)**: A passionate entrepreneur with over 20 years of leadership, sales and marketing management expertise, I led two companies to M&A and have extensive experience with building a sustainable cloud & SaaS operation in international markets. - **Brian Vermeer (Staff Developer Advocate, Snyk)**: Staff Developer Advocate at Snyk, focused on Java, JVM languages, and secure development practices. Speaks at developer and security conferences worldwide on building secure software in the AI era. - **Manoj Nair (CTO & Chief Innovation Officer, Snyk)**: Manoj Nair is Chief Technology Officer and Chief Innovation Officer at Snyk, leading R&D, the company's AI engineering transformation, and strategic partnerships with frontier AI labs including Google, Anthropic, and OpenAI. He recently led the creation and launch of Evo by Snyk (a purpose-built product line for... - **Paul Price (Founder and CEO, CodeWall)**: CISSP, CISM. 15+ years in cybersecurity. Former vCISO to UHNW individuals and global enterprises (Schillings). Deputy Global Head of Security at Olayan Group ($50B+ AUM). Creator of shhgit, an open-source secret scanner adopted by IBM, Netflix, and Salesforce. Published in the Financial Times, Forbes, The Register,... - **Shlomie Liberow (Founder and CEO, Aisy)**: Shlomie Liberow is the founder of aisy, the AI-native context layer for vulnerability management designed to prevent repeating mistakes by having coding agents learn from past errors. He previously led Hacker R&D at HackerOne, running programs and leading delivery for hacking competitions for the UK Ministry of... - **Bar Kaduri (Head of Research, Capsule Security)**: Bar Kaduri is a cybersecurity researcher, leader, and international speaker with over 14 years of experience in cloud security, software supply-chain risk, and emerging AI threats. With hands-on expertise in evaluating and stress-testing AI systems, Bar focuses on building practical, resilient defenses that anticipate... - **Guy Podjarny (Founder and CEO, Tessl)**: Guy Podjarny is the founder of Tessl, and previously founded Snyk. Tessl is reimagining software development for the AI era, helping shape AI Native Development. Snyk created and leads the Developer Security category, and is now a multi-billion dollar company with over 1,000 employees. - **Javier Garza (Staff Developer Advocate, Snyk)**: Javier Garza is a technology evangelist who has written extensively on HTTP/2, security, and web performance, and is the co-author of the O'Reilly book "Learning HTTP/2." Javier has spoken at more than 30 events around the world including well-known security and developer conferences. - **Joe Bollen (Staff Forward Deployed Engineer, AI Incubation, Snyk)**: Breaker and builder of agentic systems at Snyk's AI Incubation team. - **Kevin Keller (Field CTO Lead EMEA (AI Agents & Hybrid Cloud Architecture & Observability), Snowflake)** - **Massimo Angelino (Principal Specialist Solution Architect GTM AI/ML EMEA, AWS)** - **Micah Silverman (Director, AI Acceleration, Snyk)**: Micah is Snyk's Director of AI Acceleration. With 30 years of Java experience and as a security professional, Micah has authored numerous articles, co-authored a Java EE book, and spoken at many conferences. He's a maker who's built full-size MAME arcade cabinets in his spare time. - **Oliver Neuberger (Cybersecurity Lead, Accenture)** - **Simon Roses Femerling (Founder & CEO, VULNEX)**: Founder and CEO of VULNEX. Former Microsoft, PricewaterhouseCoopers, and @Stake. Speaker at Black Hat (Europe and Asia), RSA, OWASP, SOURCE, and DeepSec. Holds a DARPA Cyber Fast Track grant for software security research. Creator of VASO, the open-source AI agent security scanner. ## Venue: South Place Hotel 3 South Place, London EC2M 2AF A boutique five-star hotel in the Square Mile, a short walk from Liverpool Street. Private event spaces with dark, design-forward interiors, built for smaller rooms and real conversations, not conference-centre crowds. The kind of venue where the hallway chats are as good as the sessions. [Directions](https://maps.google.com/?q=South+Place+Hotel+London) ## Venue: CodeNode London 10 South Place, London EC2M 7EB CodeNode sits in the Square Mile, a short walk from Liverpool Street. 23,000 sq ft of tech-only space with a main stage, breakout rooms, whiteboards everywhere, and a bar. No hotel conference carpet. No awkward AV setups. Just a venue that was built for this kind of thing. [Directions](https://maps.google.com/?q=CodeNode+London)