Conference Description
Key Takeaways
- OWASP Global AppSec USA 2026 marks the 25th anniversary of the OWASP Foundation’s flagship conference, bringing together over 800 application security professionals in San Francisco.
- The five-day event combines three days of hands-on training (November 2 to 4) with a two-day conference (November 5 to 6) featuring keynotes, curated tracks, and interactive sessions.
- Core topics include application security, threat modeling, AI security, privacy, security program management, and secure software development lifecycle practices.
- Designed for security engineers, developers, CISOs, DevSecOps practitioners, and security architects working in technology, finance, healthcare, and government sectors.
About the Event
OWASP Global AppSec USA 2026 takes place November 2 to 6 at the Hyatt Regency San Francisco. The conference structure separates technical training from the main conference program, allowing attendees to pursue intensive workshops before engaging with broader sessions. Capture the Flag competitions and OWASP project demonstrations provide practical learning opportunities alongside the exhibitor hall. Attendees can earn CPE credits for professional development.
Technical Focus Areas
The program addresses application security across the software development lifecycle, from planning and design through implementation, testing, deployment, and maintenance. AI security receives particular attention, reflecting growing concerns about securing machine learning systems and applications that incorporate AI capabilities. Sessions also cover threat modeling methodologies, privacy considerations, and building security programs that integrate with development workflows. OWASP project showcases highlight community-driven tools and frameworks.
Who Should Attend
The conference targets application security professionals responsible for securing software applications and embedding security into development processes. This includes security engineers, security architects, DevSecOps practitioners, CTOs, CISOs, compliance officers, and developers working in organizations that prioritize secure software development. Both technical practitioners and security leadership will find relevant content addressing emerging threats, compliance requirements, and security program effectiveness.
Sponsors
Sponsors and exhibitors include Arnica, Clover Security, depthfirst, Semgrep, Aikido Security, Black Duck, Cycode, Open Text, Port Swigger, Veracode, Wiz, ArmorCode, Contrast Security, Secure Code Warrior, and YesWeHack.