fwd:cloudsec

Speaker: Robert Chiniquy

Robert Chiniquy is an engineer at ConductorOne, where he builds identity governance systems for human and non-human actors. He co-founded ScaleFT, a Zero Trust access platform acquired by Okta in 2018, where he served as Founder in Residence and led Okta's first incubation project. His work spans identity infrastructure, formal verification of distributed systems correctness at scale, and dynamic authorization models for AI agents. He is currently focused on how memory, context, and structured API knowledge can inform real-time policy decisions when thousands of tools are available to autonomous agents.

Talk:

Authorization models were designed for a world where humans click buttons. Agents don't click buttons — they make thousands of tool calls per session across dozens of APIs, and the question isn't just "is this user allowed to call this tool?" but "is this the right tool call given what this user is actually doing right now?" Static role-based or attribute-based policies can't answer that question. They can tell you someone has access to Jira, but they can't tell you which project to scope the call to without a role-per-project mapping that doesn't scale.

This talk presents a working model for context-aware agent authorization that treats memory — what a user is working on, what tools they typically use, what their agent has been doing in this session — as a first-class input to the policy engine. We'll walk through where RBAC, ABAC, and ReBAC each fall short for agent tool calls, why the missing piece is situational context rather than more roles, and how to build a fast-path authorization system that evaluates dynamic memory-backed predicates alongside static policy — with sub-millisecond decisions, full auditability, and graceful escalation when the system isn't confident enough to auto-approve.

Expect Datalog, expect architecture diagrams, and expect honest discussion of what's still unsolved — including the local authentication problem that nobody wants to talk about.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Security MCP Server: https://github.com/rakshasa-1729/agentic-paved-roads/

Example security repo: https://github.com/rakshasa-1729/acme-security-repo

Speaker: Prahathess Rengasamy

Prahathess Rengasamy is a security engineer at xAI focused on security engineering and automation, striving to enhance efficiency and robustness across various security domains. Previously securing products and clouds at Block, Apple, and Credit Karma, he now focuses on scaling security for the AI era.

Talk:

AI coding assistants now generate the majority of infrastructure code in many organizations. Traditional paved road strategies—approved Terraform modules, policy-as-code gates, security training—targeted developer cognition. But in agentic workflows, the developer provides intent while the model does the reasoning. The thinker changed.

This creates an opportunity: the model's context window is programmable in ways developer brains never were. By constraining what tools an agent can call and what information shapes its reasoning, organizations can embed security guardrails directly into the system doing the thinking.

This talk introduces a reference architecture using Model Context Protocol (MCP) to make AI agents work through paved roads rather than around them. The MCP server exposes approved Terraform modules from an internal registry, enforces OPA policies with structured output designed for agent consumption (severity, remediation hints, auto-fix eligibility), and implements risk-scored exception handling that routes low-risk deviations to audit logs while escalating high-risk requests to humans.

In a live demo, a natural language infrastructure request will flow through the full pipeline: module retrieval → Terraform generation → policy check → auto-remediation of fixable violations → risk scoring → exception request with Linear ticket creation → compliant PR with reasoning trace. The demo will show policy violations detected and resolved in seconds with zero human intervention for routine issues.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Ammar Alim

Ammar Alim is the Manager of DevSecOps at Adobe, where he leads a team building solutions that help engineering teams address security issues more efficiently, focusing on seamless integration between application security and DevOps processes. Previously, he was Cloud Security Engineer Manager at Frame.io and Lead Cloud Security Engineer at ActBlue Technical Services, where he built the cloud security function from scratch and implemented controls to detect and prevent nation-state attacks. Ammar is also passionate about helping people from non-technical backgrounds enter the cybersecurity field. Outside work, he enjoys the outdoors and staying fit.

Talk:

Exploitation of unpatched vulnerabilities just became the #1 way attackers breach organizations — 31% of breaches in the 2026 Verizon DBIR, a 55% jump in a single year. Only 26% of CISA KEV entries are fully remediated. The median time to patch a critical vulnerability is 43 days, two weeks slower than the year before. Defenders are losing the race, and the gap is widening.

Web Application Firewalls have a reputation problem — but they are also one of the few controls that can buy critical hours during a zero-day. A virtual patch deployed in minutes while engineering queues up a weeks-long rollout across a sprawling estate. I lived this in 2021 with Log4Shell. The math has only gotten worse since.

The promise collapses under its own weight at scale. Fine-tuning WAF rules across hundreds of distinct technology stacks, application owners, and risk profiles is a domain-expertise problem that doesn't scale with headcount. The result is a familiar compromise: rules so broad they're useless, or so tight they become a reliability incident waiting to happen. Teams end up choosing between security theater and engineering pain.

This talk shares lessons from operating WAF at enterprise scale — and what changes when you introduce agentic AI into that loop. We'll walk through how AI-assisted rule generation, context-aware tuning, and a human-in-the-loop pipeline can compress the cycle from "vulnerability disclosed" to "fleet protected" from 43 days to single-digit minutes, without requiring a WAF expert embedded in every product team. We'll cover where the AI gets it wrong, what guardrails matter, and what it looks like when a virtual patch is the difference between a contained incident and a headline.

Attendees will leave with a framework for thinking about AI-augmented defensive controls not as magic, but as a new kind of teammate — one that needs supervision, clear trust boundaries, and very good memory for what "normal" looks like.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speakers: Jie Wu & Pulkit Garg

Jie is a Senior Security Engineer on the Infrastructure Security team at Shopify, where she focuses on security automation, IAM, threat detection, and compliance. Prior to joining Shopify, Jie worked on cyber defense initiatives and vulnerability management at Bank of America. Outside of work, Jie enjoys running, hiking, and tackling CTF challenges for fun.

Pulkit is a Security Engineer on the Infrastructure Security team at Shopify, where he specializes in cloud security, ai security, and supply chain security solutions. Before joining Shopify, he worked on 5G network software solutions at a startup. Pulkit ultimately decided to transition into cybersecurity, which led him to take an internship at Shopify that has since turned into a full-time role. Outside of work, Pulkit enjoys exercising, dancing, and exploring hiking trails.

Talk:

Pull up Cloud Audit Logs for any interesting event in your GCP environment. Look at the principalEmail field. Increasingly, it's not a person. It's a service account attached to a CI/CD pipeline, a workload identity assumed by an orchestrator, or a token obtained by an AI agent. The "who" is synthetic. The "why" is buried in automation logic no one can reconstruct.

Every layer of cloud security was built assuming a human is ultimately accountable. That assumption is breaking. When a shared service account is compromised, the audit log tells you what credential did it, not which of 40+ pipelines triggered it or why. Your access reviews are rubber-stamped because no one can explain what machine identities they didn't create are supposed to do. And it's getting worse: agentic workflows whose required permissions change with every prompt make least privilege a moving target and access review a formality.

This talk covers how non-human identity sprawl erodes accountability and what to build in its place: structured metadata that makes every machine identity traceable to its origin, owner, and purpose, and an intent logging layer that captures why an action was taken, not just what happened and who did it. The talk closes with the hardest question for the room: when a single agent can initiate, approve, and execute a change, what does separation of duties even mean?

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Slides: https://engseclabs.com/least-privilege-is-a-conversation/

Trailtool: https://github.com/engseclabs/trailtool

Blog: https://engseclabs.com/blog/cloudtrail-for-ai-agents/

Speaker: Alex Smolen

Security engineering leader with 15+ years experience building security programs from the ground up. Passionate about vulnerability management, detection engineering, and GRC automation. Currently running EngSec Labs, a security consulting practice supporting AI startups and building AI-focused security services and tools. Deep expertise in software engineering and AWS security. Strong track record of collaborative cross-functional work, creative approaches to design challenges, and shipping high-quality security solutions.

Talk:

"Role engineering" is the ongoing process of refining human IAM roles as your organization changes and engineers need new permissions. As you ratchet towards least privilege, you risk breaking workflows. Hey - you might think - what if we watched what people actually do and automatically built least privilege policies from those logs?

Generating least privilege AWS IAM policies based on real-world usage is a cave entrance littered with bones. Many intrepid projects - from Netflix's RepoKid to AWS's IAM Policy Autopilot - have attempted to slay this dragon. Most approaches will get you a policy, but shipping it is an exercise left to the reader. What happens when that new restricted role throws AccessDenied errors during an incident?

This talk demonstrates an agentic role engineering pipeline that goes beyond policy generation to handle the full lifecycle:

A coding agent with custom MCP tools for CloudTrail pre-aggregation that drafts precise least privilege updates to Terraform where policies are actually defined

A background agent that detects AccessDenied errors, reaches out via Slack, and automatically drafts PRs to restore access with context for security review

A validation agent that confirms break-glass access matched stated intent by comparing user narratives against session summaries

You'll see a live demo of this end-to-end workflow and the CloudTrail analysis tooling that makes it possible. We'll discuss what works, what breaks, and the trust model implications of letting agents participate in your IAM governance loop.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Ramesh & Eli F

Talk:

Managing tens of thousands of DNS records across multiple cloud providers and registrars introduces significant risk—especially when bug bounty reports for domain takeover vulnerabilities begin to surge. Scaling remediation is both critical and complex. In this talk, we share how our security team built a cloud-native, event-driven automation system that delivered a 10x improvement in detection, and achieved a 98% vulnerability closure rate.

We’ll begin by explaining why domain takeovers became a problem worth solving at scale, including the impact of different takeover classes and the asset attribution challenges inherent in large organizations. From there, we’ll walk through our journey—from evaluating tooling to designing a cloud-native orchestration system that integrates with our DNS registrar, AWS and GCP environments, and internal vulnerability management platform.

Our approach centers on continuous DNS asset enumeration via cloud provider APIs, enrichment with account ownership metadata, and intelligent remediation workflows. Rather than treating takeover findings as isolated alerts requiring manual triage, we built a system that continuously synchronizes DNS, registrar, and cloud account data.

Using Lambda and EventBridge, new AWS accounts are automatically onboarded into the organization. Hosted zones and domain states are enumerated, enriched with organizational context, and fed into our External Attack Surface Management (EASM) platform. External takeover findings are ingested through API Gateway webhooks and correlated with DNS records, cloud inventory, and organizational metadata. This enables automated bundling, severity classification, routing to the appropriate teams, and enforced re-alerting when issues are closed without remediation.

A key factor in our success was ownership attribution. By correlating DNS records with cloud and organizational metadata, we reduced manual toil, improved routing accuracy, and ensured vulnerabilities could not be silently dismissed.

We’ll also discuss alternative solutions we evaluated that failed to scale or proved ineffective, and why an event-driven, attribution-focused model ultimately succeeded.

Attendees will leave with:

- A clear understanding of domain takeover vulnerabilities and their impact

- Practical approaches to identifying and remediating domain takeovers at scale

- Insight into asset attribution challenges in large organizations

- An overview of tooling strategies and lessons learned

- Whether you manage ten domains or tens of thousands, this session provides a practical framework for scalable DNS takeover detection and remediation.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Sakina MithaniTalk:Agentic coding tools are the new frontier of developer velocity…but giving an autonomous agent access to your proprietary IP and an internet connection? Sounds like a data exfiltration nightmare. In the world of AI-assisted engineering, we found that exfiltration is often just one clever prompt injection away.This talk presents a production-hardened architecture built on AWS EC2 to safely harness AI agents without compromising proprietary data. We will move beyond standard Security Groups and VPC Endpoints to detail a zero-trust sandbox featuring a TLS-decrypting Squid proxy for deep content inspection, coupled with Route 53 Resolver DNS Firewall and GuardDuty for lateral movement constraints.Learn how to build a multi-layered defense that keeps pace with the 'Centaur's Stride' - balancing a paranoid security posture with the frictionless speed developers actually need to stay productiveRecorded at fwd:cloudsec North America 2026 - Bellevue, WAhttps://fwdcloudsec.org/conference/north-america/

Speaker: Matthew Gladney

Talk:

Neoclouds are here whether we planned for them or not - and the security assumptions we carry over from the hyperscalers don't transfer cleanly. The IAM ergonomics and audit trails we'd taken for granted aren't a given. How are secrets stored? If you hand an AI agent an access key, can you scope it to read-only - and can you even tell afterward which actions were the agent's?

These are what Amy Edmondson calls "ambiguous threats": warning signals that don't fit our existing mental models and so get rationalized away by competent people, working in good faith, applying reasonable assumptions - not because teams are reckless, but because the mental model required to interpret the platform signals doesn't exist yet - and the mental bandwidth required to build that model from scratch doesn't exist either.

This talk isn't about which platforms are safe. It's about methodology for laying out the facts so a security team can form a clear, opinionated posture - one it can defend internally, and that we can start to standardize as an industry instead of re-deriving for every new provider.

To make that practical, I'll also share an open-source agent skill that runs the same evaluation against any platform's public surface, turning a week-long investigation into a 40-minute pass.

And it's an open invitation to the researchers who already probe AWS for a living: let's point that lens at the neoclouds.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Sarah Cecchetti & Clawdrey Hepburn (AI)

Talk:

Your agents need identity infrastructure. Real identity infrastructure — not a service account with a sticky note that says "this is the AI."

Right now, every team building agentic systems is solving the same problem independently: how does an agent authenticate, how do you express delegation, how do you audit what it did and on whose authority. The results are predictable. Custom token schemes. Bespoke role hierarchies. API keys in environment variables being called "agent identity" with a straight face. We've seen this movie before with human identity, and it ended with a decade of SAML migrations.

Agents deserve the same standards-based identity infrastructure that humans get. That means cryptographic identity that works across trust boundaries (SPIFFE gives us a starting point). It means delegation models that express "this agent acts on behalf of this human with these specific authorities" in a way any relying party can verify and any administrator can revoke. It means authorization that's separate from authentication — not "this agent has a token" but "this agent is allowed to do this specific thing, right now, in this context," enforced by policy engines rather than hard-coded logic. And it means audit trails that connect every agent action back to a human authorization decision.

None of this requires invention. The primitives exist: SPIFFE for workload identity, Cedar and OPA for policy-based authorization, verifiable credentials for delegation chains. What's missing is the demand. Cloud platforms won't build first-class agent identity support until practitioners stop accepting workarounds and start requiring the same rigor for their agents that they'd never skip for their humans.

This talk is a practical blueprint for what standards-based agent identity looks like, how the existing pieces fit together, and what you should be demanding from your platform providers instead of building yourself.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Paul Benoit

Talk:

Sending cloud security alerts at scale is an absolute minefield. False positives, wrong attribution, alert floods, missing context, stale findings, and unclear remediation expectations burn trust with the engineers who have to respond. The cloud makes it worse. Ownership is fragmented across platform, app, and data teams, resources are ephemeral, and tools that work fine at small scale behave unpredictably in complex environments.

This talk shares lessons from a multi-year effort operationalizing alerting across AWS and GCP using native services and third party tools. We'll cover the edge cases that break cloud security alerting at scale (attribution that spans multiple teams, grouping alerts back to root cause fixes, tuning detection rules through feedback loops, building exception workflows that don't kill developer velocity) and the patterns we landed on to fix them.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/