Slavik Pashanin

The rapid evolution of software engineering has transformed Application Security (AppSec) into a constantly shifting battlefield. Traditional security approaches are no longer enough—modern pipelines demand a strategic, multi-layered defense. In this talk, we'll explore how AppSec practitioners must adapt to stay ahead of emerging threats. I'll introduce the three essential disciplines of AppSec: Security In the Pipeline (SIP): Protecting the code, dependencies, and infrastructure as they move through the development lifecycle. Security Of the Pipeline (SOP): Securing the CI/CD tooling, environments, and processes to prevent supply chain compromises. Security Around the Pipeline (SAP): Addressing external threats, insider risks, and adversarial attacks targeting the entire ecosystem. Drawing from real-world adversarial security research, I'll highlight the biggest challenges in each domain and present practical mitigation techniques that security, DevOps, and engineering teams can apply immediately. Attendees will gain insights into common attack vectors, best practices for securing CI/CD workflows, and emerging trends shaping the future of AppSec. By the end of this session, you'll walk away with a holistic security framework that ensures your pipelines remain secure, resilient, and future-proof. Whether you're an AppSec engineer, security beginner, or interested in DevSecOps practitioner, this talk will provide actionable strategies to help you navigate the ever-evolving AppSec landscape. Don't just secure your code—secure your entire pipeline!