Semgrep at BSidesSF / RSAC 2026

Join tl;dr sec for a laid-back community evening hosted by Clint Gibler, featuring a fireside chat with industry leaders. Connect with the people shaping modern AppSec in a relaxed, welcoming setting.

Semgrep is heading to BSides SF to connect with builders and security leaders shaping the future of AppSec. Stop by to see how we help developers ship secure code faster without slowing down.

AI huh? What is good for? Absolutely Nothin'!
It's killing the planet, rotting your brain, and every product has slapped the AI label onto their product to get investors. AI is here whether we want it to or not. This bird of a feather discussion invites AI skeptics, realists and fearmongers to moan, complain and criticise AI and the new AI era.
Speaker: Dr. Katie Paxton-Fear

The great SAST dissonance: how to please every audience, at scale.
SAST tools hit a sour note with modern apps with a dissonant coverage that leaves stretches of code unheard: dangerous sense of security. An AI conductor can fine-tune the orchestration for each application, let human experts focus and produce the right mix of coverage and findings.
Speaker: Claudio Merloni

One Thousand and One AI-Prevented CVEs: Vibe Coding a Whole New Supply Chain Defense
Supply chain attacks are everywhere. with over 20,000 CVEs filed in Q2 2025. We wrote a non-agentic internal tool which combines deterministic callgraph-based methods with selective LLM reasoning to “vibe code” Semgrep rules, colossally decreasing the time security researchers spend processing CVEs.
Presenter: Brandon Wu

Meet some of the Semgrep team at the ArmorCode Purple Book Club CISO networking event.

Register here.

Kick off RSA and learn how Semgrep’s low-noise results and AI guidance across SAST, SCA, and Secrets can help you fix vulnerabilities early, speed up releases, and reduce risk

Step into our lounge, where builders work with zero friction, zero frustration, and zero F’s for unnecessary complexity.
Enjoy espresso from Hedge Coffee Roasters, customize a survival kit or candy mix, recharge your devices, and relax in a space designed to keep you focused, fueled, and building.

Miss BSidesSF? Join us for a lightning round session with BSidesSF speakers who will do tl;dr recap and get right to the point of their presentations from BSidesSF. Once more, with feeling.

Responding to Emergent Supply Chain Threats Workshop

A practical walkthrough for responding to fast-moving supply chain issues with Semgrep, from detection through remediation. You will see Malicious Dependency Detection (now GA) in action and leave with a repeatable playbook for the next high-profile dependency incident.

Step into our lounge, where builders work with zero friction, zero frustration, and zero F’s for unnecessary complexity.
Enjoy espresso from Hedge Coffee Roasters, customize a survival kit or candy mix, recharge your devices, and relax in a space designed to keep you focused, fueled, and building.

We’re bringing together Forrester analyst Janet Worthington and industry leaders for a panel discussion, paired with premium breakfast and espresso by Hedge Coffee Roasters.

Kick off RSA and learn how Semgrep’s low-noise results and AI guidance across SAST, SCA, and Secrets can help you fix vulnerabilities early, speed up releases, and reduce risk

Hands-on Interactive Workshop: Securing AI-Generated Code with Cortex Cloud & Semgrep

See how Cortex Cloud by Palo Alto Networks integrates with Semgrep to help teams identify risks from AI-generated code, prioritize the most business-critical vulnerabilities using cloud and runtime context, and automate workflows from detection to developer remediation.

The WOMEN IN SECURITY documentary takes a powerful look at the women reshaping the security industry sharing real stories, lived experiences, and what it takes to lead in a space that hasn’t always made room for them.

Register here

Kick off RSA and learn how Semgrep’s low-noise results and AI guidance across SAST, SCA, and Secrets can help you fix vulnerabilities early, speed up releases, and reduce risk

Step into our lounge, where builders work with zero friction, zero frustration, and zero F’s for unnecessary complexity.
Enjoy espresso from Hedge Coffee Roasters, customize a survival kit or candy mix, recharge your devices, and relax in a space designed to keep you focused, fueled, and building.

Join Semgrep to see how it integrates with ArmorCode to transform developer-trusted code findings into risk-normalized, prioritized remediation workflows.

Join us for a live, interactive demo of the Semgrep & StackHawk integration, showing a unified workflow from code scanning to runtime validation, with correlated findings that connect what you see in SAST to what’s discoverable and exploitable in a running application.

In this lunch and learn session, we’ll share how Semgrep Workflows enables security teams to orchestrate LLM agents, static analysis, and custom tools as executable security logic.

In this technical workshop, you’ll see how Semgrep’s AI-powered detection combines static analysis with LLM reasoning to uncover business logic vulnerabilities without custom rule writing.

The WOMEN IN SECURITY documentary takes a powerful look at the women reshaping the security industry sharing real stories, lived experiences, and what it takes to lead in a space that hasn’t always made room for them.

Register here.

Wrap up RSA for custom live demos and to learn how Semgrep’s low-noise results and AI guidance across SAST, SCA, and Secrets can help you fix vulnerabilities early, speed up releases, and reduce risk

Step into our lounge, where builders work with zero friction, zero frustration, and zero F’s for unnecessary complexity.
Enjoy espresso from Hedge Coffee Roasters, customize a survival kit or candy mix, recharge your devices, and relax in a space designed to keep you focused, fueled, and building.

What Top Security Teams Do Differently: Trends in SAST

We provided a sample of data to OWASP for prioritizing the Top 10, but there was more to learn from our data across 88k repositories, 2500+ organizations, and 127 Million findings. Come listen as we share the data analysis and discuss other data-driven decisions behind AI detection and the future of code security.

Vibe Coding and AI Security Primer: From MCP to Mad Skills

A hands-on workshop for all skill levels to build an AI-assisted workflow in Cursor with security hooks. Get practical experience with agentic workflows and MCP skills, with security and AI experts available for help along the way.