STARWEST 2026 - Security Testing
Thursday, September 24
Testing for the Untestable: Validating App Resilience Against AiTM and Session Hijacking
As QA and DevOps teams, you rigorously test your login flows, MFA integrations, and session timeouts. But how do you test for an attack that doesn't break the code and mirrors the entire environment? Enter Adversary-in-the-Middle (AiTM) attacks—a sophisticated phishing method using reverse-proxy toolkits (like Evilginx) that bypass Multi-Factor Authentication (MFA) by stealing live session tokens. In this session, Yaamini will move beyond standard functional testing to look at the technical reality of modern session-based threats. She will demonstrate how these "zero-hour" attacks operate...
Modeling for Threats in Multi-Step AI Workflows
Modern AI isn't just a model, but rather a mostly a messy, multi-step pipeline. When you chain together ingestion, tool calls, and long-term memory, you aren't just building an agent—you’re building a new class of vulnerabilities. Traditional security looks at the model; but you need to also be looking at the spaces between the steps. In this session, Vinay will move beyond basic prompt injection to explore how risks cascade through an entire workflow. He’ll break down: cascading injections, privilege escalation via tooling (when your AI’s "helpful" integration becomes a back door), and...
Testing with the Coding Agent
Software testing is moving inside AI coding agents. These agents can generate code, tests, environments, data, reviews, and fixes in the same continuous loop, but that creates a dangerous question: should the system that wrote the bug also decide whether the software is ready to ship? Jason Arbon explores how testing changes when software is generated dynamically, requirements evolve through prompts, and agents work autonomously for hours or days. You will learn how to separate generation from independent validation, capture evidence from agent trajectories, test changing prompts and...