Webinar Description
Key Takeaways
- Webinar examining practical applications of artificial intelligence in application security workflows
- Discussion led by Arnica CEO Nir Valtman and OWASP AGHAST project leader Josh Grossman
- Focus on hybrid SAST/SCA strategies for effective vulnerability management
- Exploration of LLM cost management challenges at enterprise scale
- Coverage of open-source initiatives including OpenGrep and Aghast for AI-enhanced AST scanning
Evaluating AI’s Role in Application Security
A forthcoming webinar scheduled for 27 July 2026 will address one of the most pressing questions facing application security teams: where does artificial intelligence genuinely improve security outcomes, and where do traditional approaches remain superior? The session brings together Nir Valtman, CEO and co-founder of Arnica, alongside Josh Grossman, an application security specialist who leads the OWASP AGHAST project. Their discussion targets security practitioners navigating an increasingly crowded market where AI capabilities are being added to tools regardless of whether they deliver meaningful improvements.
The timing reflects a broader industry reckoning. After several years of rapid AI integration across the security toolchain, organisations are beginning to scrutinise whether these additions translate into better risk reduction or simply higher costs and complexity. This webinar aims to provide a framework for making those distinctions.
About This Event
The online session will run on Monday, 27 July 2026, beginning at 11:00 AM Eastern Time. It is structured as a technical discussion rather than a product demonstration, drawing on the speakers’ combined experience in both commercial security tooling and open-source community leadership. The format allows for examination of real-world implementation challenges that security teams encounter when deploying AI-augmented scanning tools.
Balancing AI Capabilities with Deterministic Analysis
A central theme of the webinar concerns the relationship between AI-powered analysis and traditional deterministic static analysis. While large language models have demonstrated impressive capabilities in understanding code context and identifying complex vulnerability patterns, they introduce characteristics that differ fundamentally from rule-based scanning approaches.
Deterministic static application security testing produces consistent, reproducible results. Given the same codebase and ruleset, the output remains identical across runs. This predictability matters enormously for compliance requirements, audit trails, and developer trust. When a static analysis tool flags a finding, teams can trace exactly why that determination was made and adjust rules accordingly.
AI-based analysis, by contrast, can identify patterns that would be difficult or impossible to express as static rules. It excels at understanding semantic meaning, recognising variants of known vulnerability patterns, and reducing false positives through contextual understanding. However, this flexibility comes with trade-offs in reproducibility and explainability that security teams must weigh carefully.
The speakers plan to explore hybrid strategies that combine both approaches, using static analysis for well-understood vulnerability classes where deterministic rules perform reliably, while reserving AI capabilities for scenarios where contextual understanding provides genuine advantages.
Managing LLM Costs at Enterprise Scale
Token consumption represents a significant operational consideration for organisations deploying AI-enhanced security scanning across large codebases. Unlike traditional static analysis tools with predictable resource requirements, LLM-based analysis incurs costs that scale with the volume of code processed and the depth of analysis requested.
For enterprises managing millions of lines of code across hundreds of repositories, these costs can accumulate rapidly without careful governance. The webinar will address strategies for controlling expenditure while maintaining security coverage, including approaches for prioritising which code paths warrant AI-enhanced analysis and which can be adequately covered by conventional methods.
Open-Source Collaboration: OpenGrep and Aghast
The discussion will highlight ongoing open-source efforts that aim to make AI-enhanced application security testing more accessible and transparent. OpenGrep and Aghast represent community-driven initiatives addressing different aspects of the modern AppSec toolchain.
Aghast, led by Grossman under the OWASP umbrella, focuses specifically on AI-enhanced abstract syntax tree scanning. By operating at the AST level, the tool can understand code structure in ways that pattern-matching approaches cannot, enabling more sophisticated analysis of data flows and control paths. The open-source model allows security researchers and practitioners to examine exactly how AI capabilities are being applied, contributing improvements and identifying limitations.
This transparency addresses a common concern with commercial AI security tools: the difficulty of understanding why particular findings are generated and whether the underlying models are appropriate for specific technology stacks or threat models.
Who Should Attend
The webinar is designed for application security engineers, DevSecOps practitioners, and security architects responsible for selecting and implementing scanning tools within their organisations. It will also be relevant for engineering leaders evaluating the cost-benefit profile of AI-enhanced security tooling and for practitioners interested in contributing to open-source security projects.
Attendees will benefit most if they have existing familiarity with static application security testing and software composition analysis concepts, though the speakers are expected to provide sufficient context for those newer to these technologies.