AI-assisted SAST and vulnerability verification
Join IOActive’s Robert Lee on November 19 to explore AI-assisted vulnerability discovery, exploit verification, and real-world security testing.
AI can help your teams write code, find bugs, and review fixes. It can also make “it’s secure” sound remarkably confident.
Robert E. Lee, IOActive’s Director of AI Strategy, draws on IOActive’s ongoing vulnerability research and exploit-development work to examine how AI can strengthen code and application assessments. He’ll explore how AI-assisted investigation, program analysis, and measurements from controlled targets can support the development and verification of working exploits.
Starting with a suspected defect or an AI-generated finding, the session follows the questions an assessment has to answer: what can source analysis establish, what conditions would an attacker need, and what happens when the claim is tested against running software? A plausible explanation, a working exploit, and a demonstrated attack path through your environment each establish something different.
Robert will also discuss the design and progress of the methods behind that investigation: why discovery and exploit proof need different evidence, how IOActive designs its workflows to preserve that distinction, and where expert judgment connects the results to business risk.
For security leaders commissioning assessments, the focus is what AI should contribute to the work, and what evidence should support the findings you are asked to act on.
WHEN: November 19, 2026 – 11:00am PT
What You’ll Learn
- Where AI can contribute to code investigation, vulnerability analysis, and exploit development.
- How source analysis and controlled testing help verify AI-generated findings.
- What separates a reported defect, exploit proof, a viable attack chain, and a remediation priority.
- What to ask an assessment provider, including IOActive, about coverage, evidence, and unresolved questions
About the Presenter
Robert Lee is a security leader who has built, broken into, and defended global-scale systems — protecting Amazon, ByteDance, Twitter, Intuit, and Snapchat from evolving threat actors. In his current hands-on strategy role, he blends red-team methodology with security architecture to explore how AI is reshaping both attack surfaces and defenses.
Robert leads IOActive’s AI strategy across the firm’s cybersecurity services. His work includes building tooling for AI-augmented red teaming / pen testing, LLM security assessments, vulnerability discovery and exploit development.