Eureka DevSecOps
Were you in the room? Grab the slides below, and do yourself a favour: try Eureka free for 30 days. No credit card needed.
Forward Security and Eureka DevSecOps
LASCON 2026 · AUSTIN

Forward Security at LASCON 2026

OWASP SPVS with Farshad Abasi and Cameron Walters. Friday 30 October, 9:00 AM.

Get the slidesWatch the recordings
LASCON 2026

We're speaking Friday 30 October, 9:00 AM

OWASP SPVS · Impart Security Room (Cypress)

Want more from the team?
Catch past episodes of The AppSec Insiders Podcast.

Browse past episodesHear Farshad and Cameron on SPVS
9:00 AM · IMPART SECURITY ROOM (CYPRESS)

Securing Software Delivery Pipelines in the Age of AI: Introducing OWASP SPVS

First look at SPVS 2.0.

It ships Friday, and Farshad and Cameron announce it live in this talk. The slides go up the same day.

Your pipeline has access to your source, your secrets and production, and attackers know it: Cameron counted 75 public pipeline incidents from January to July 2026. SPVS is the OWASP standard for assessing your pipeline across five stages, at three levels, including controls for AI agents.

WHAT YOU'LL TAKE AWAY
  1. 1.

    Why the delivery pipeline is now one of the most attacked parts of the software ecosystem, from source control to runtime, including AI-assisted and agentic tooling.

  2. 2.

    How SPVS assesses a pipeline across Plan, Develop, Integrate, Release and Operate, at three levels.

  3. 3.

    How to use SPVS as a roadmap: start at Level 1, close the gaps that matter, and keep it current.

SPEAKERS
Farshad Abasi
Farshad Abasi

Founder and CEO, Forward Security · Co-founder and Co-CEO, Eureka DevSecOps

More than 20 years in security, software design and system architecture, including a decade on HSBC's IT security team. Leads the OWASP Vancouver chapter and co-leads OWASP SPVS. CISSP.

Connect
Cameron Walters
Cameron Walters

Director, AppSec and Security Engineering · Co-lead, OWASP SPVS

Co-host of Coffee & Chaos and the ProdSec Podcast, and leader of CYBERLUNCH, the Austin security meetup.

Connect
Follow for the recording
SLIDES ONLY · IMAN DIDN'T MAKE IT TO AUSTIN

Turning the dial on SAST: Reducing False Positives with Call Graph–Driven LLM Reasoning

Iman didn't make it to Austin. His slides did.

Travel turned out a lot like AppSec: you plan for everything and something still breaks. No live session, but Avatar Iman still has lessons to share. See you next time!

SAST tools report thousands of findings and only a handful matter. This talk maps each finding onto a call graph of the code and has one model investigate it while a second audits the reasoning. It is research from Forward Security, shown with the full results, including where it still struggles.

WHAT'S IN THE SLIDES
  1. 1.

    Why SAST buries teams in findings, why most of them are not real, and what that costs developers in triage time.

  2. 2.

    How mapping each finding onto a call graph gives a model the context to judge it, using the SARIF your scanners already produce, with a second model auditing the reasoning.

  3. 3.

    What the results looked like: on the test set, 908 of 943 real vulnerabilities and 423 of 580 false positives were identified correctly, and which weakness types it still finds hard, such as command and XPath injection.

SPEAKERS
Iman Sharafaldin
Iman Sharafaldin

Application and Cloud Security Lead, Forward Security

More than 10 years in cybersecurity and research cited over 6,000 times. OSWE and AWS Certified Security – Specialty.

Connect
Follow Forward Security
BREACH card game box

Didn't get a deck? Play it at home.

Everyone who asked a question walked away with a BREACH deck. Missed out? Any pack of cards will do. Build a 4-card attack chain, first to breach the target wins.

How to play at home
FROM THE SPVS TALK

Start with SPVS in five steps

  1. 1

    Map. Every component of your pipeline: repos, build, deploy, IaC, monitoring.

  2. 2

    Target. Pick a level. Start at Level 1.

  3. 3

    Assess. Each control: implemented, partial or not. Evidence and an owner.

  4. 4

    Fix. Close gaps at your target level first, by impact and feasibility.

  5. 5

    Make it live. Policy-as-code and pipeline checks. Reassess after major changes, at least yearly.

Use it as an internal checklist or an external audit baseline.

Step 3 is where most teams stall: checking code, packages and dependencies against the controls.

See how Eureka helps

The team behind the talk

Farshad ran application security at HSBC, working with hundreds of development teams. Findings sat in spreadsheets, and nobody could see what mattered or what was done. So he built an in-house system to bring them into one place. That system was the seed of Eureka DevSecOps. Today Farshad leads Forward Security, where Iman works, and co-leads Eureka with Sasa Djolic.

“Scanner output was never the whole problem. The harder part was helping teams understand what mattered, move the work forward, and keep a clear record of what happened.”
FARSHAD ABASI, CO-FOUNDER & CO-CEO, EUREKA DEVSECOPS
Read the full story →

Forward Security: want experts to do it with you?

Penetration testing, application security assessments and pipeline security reviews, from Farshad Abasi's team. Bring them in to test what you ship, review your pipeline against SPVS, or work through the findings your scanners raise.

Book your free consultation

Free consultation · Talk to a security expert

Eureka DevSecOps: want to check your own code?

Eureka runs SAST, SCA and secrets scans on your repositories, threat-models your code, and chains vulnerabilities into attack scenarios, so your team fixes the ones that matter first. Eureka Radar is free to run in your own pipeline.

Get started for free Get Eureka Radar

30-day free trial · No credit card · No surprise billing

Stay in touch

Join the Forward Security mailing list

The latest news, trends and insights in application and cloud security, from the team behind both talks.

Follow us

Follow
Follow
LASCON is an OWASP event. This page is run by Eureka DevSecOps and is not affiliated with or endorsed by the OWASP Foundation.