Thriving through the VulnPocalypse

Overview

AI has shifted the balance of attack and defense in the software supply chain. AI-assisted security audits have increased the rate of vulnerability discovery to the point where maintainer resources are being strained by the volume of reporting and review, sometimes called the ‘VulnPocalypse’. At the same time, these models can make preemptive security work an easier chore to manage. Developing maintainer skills and experience to meet the challenge of the ‘Vulnpocalypse’ is the need of the moment.

We invite the community to join us for the 2026 Software Supply Chain Community Day where industry, government, and academia can network and discuss challenges, practical solutions, and the latest software supply chain security research.

Our theme this year is ‘Thriving through the VulnPocalypse’, with a focus on what we are learning about how to apply AI to manage the AI-based increase in vulnerability discovery and reporting.

Date: Thursday, November 19
Time: 9:30AM - 4:30 PM
Place:
SAS Institute Global Education Center (GEC) Building A 107 SAS Campus Dr. Cary, NC 27513

RSVP here

Agenda

Time	Session
9:30 AM	Welcome
9:40 AM	S3C2 Education: Curriculum Updates for AI-Native Middle School StudentsMichel Cukier, S3C2 and UMD
10:00 AM	Student Ignite presentations Evaluating Reproducible Builds Effectiveness for Detecting npm and PyPI Package Malware — Greg Tystahl Mapping the Attack Paths through the Supply Chain of the GitHub Actions Ecosystem — Elizabeth Lin Autonomy and Control in Agentic AI Security — Alex Cooper AI Expands the Attack Surface: A Baseline of Software Supply Chain Control Adoption Amongst AI Integration — Jill Marley VeriPort: Automated and Validated Vulnerability Backporting at Scale — Jonah Ghebremichael Beyond Alerts: Evidence-Based Detection of Risky Patterns in MCP Servers and Agent Skills — Mahzabin Tamanna Leave the Jewels Out: Eliciting and Containing Malicious Agent Skills — Md Atiqur Rahman Developers' Perceptions of Software Supply Chain Threats — Jess Moorefield Automating the Creation of the Annual Top 10 Controls from CTI reports — Md Nazmul Haque ChainLift: Downstream Proof-of-Concept Vulnerability Generation for the npm Ecosystem — Imranur Rahman AI Agents are Risky, How to Help Users Understand Risks and Take Actions? — Yining Hong Can we automatically prevent compromises? — Sivana Hamer
11:00 AM	Break and research poster session
11:30 AM	How AI is Transforming How Cybersecurity Teams WorkChuck Kessler, Pendo Chuck is the Chief Information Security Officer at Pendo, where he built the security program from the ground up for a tech unicorn that helps thousands of companies worldwide improve their software products.
12:00 PM	The BOM Explosion: The proliferation of BOMs, their technical maturity, ecosystem adoption, and real-world use cases. Dr. Allan Friedman Allan Friedman is a Senior Technical Advisor at the Institute for Security and Technology (IST) and a leading expert on software and technology supply chain transparency. During more than a decade in federal service at the U.S. Department of Commerce and CISA, he helped lead the global Software Bill of Materials (SBOM) movement and other cybersecurity initiatives.
12:30 PM	Networking lunch (provided)
1:30 PM	Industry Panel: Agentic AI and the Software Supply ChainJosh Ament, Sonatype Alex Kapravelos, NCSU, Socket Brenna Leath, Navy Federal Credit Union Aditya Verma, Cisco Andrew McNamara - RedHat Moderator: Larry Maccherone, Lumenize
2:30 PM	Break
2:45 PM	Fight Fire with Fire: Protect the Electric SheepBrett Smith, SAS Institute Distinguished Software Architect currently engineering AI solutions to Secure the Supply Chain with Event Driven CI/CD gitOps Pipeline Architectures that leverage Open Weight Models, Kafka, Go, Rust, and Python running in Containers on Kubernetes and SBOMs.
3:15 PM	Stories from the Front LineBob Callaway, Google Open Source Security. Bob leads open source security efforts at Google, leading an engineering organization focused on helping upstream maintainers and ecosystems durably improve their security posture while also helping to keep Google and its users safe.
3:45 PM	Thriving After the VulnPocalypse: Building a Race-to-Fix Program for AI-Scale Vulnerability DiscoveryDr. Lisa Bradley, Dell Dr. Lisa Bradley is Senior Director of Product & Application Security at Dell Technologies, where her key focus is product security, including vulnerability response, AI-powered security innovation, and software supply chain security.
4:15 PM	Continued networking and adjourn