Thriving through the VulnPocalypse

Overview

AI has shifted the balance of attack and defense in the software supply chain. AI-assisted security audits have increased the rate of vulnerability discovery to the point where maintainer resources are being strained by the volume of reporting and review, sometimes called the ‘VulnPocalypse’. At the same time, these models can make preemptive security work an easier chore to manage. Developing maintainer skills and experience to meet the challenge of the ‘Vulnpocalypse’ is the need of the moment.

We invite the community to join us for the 2026 Software Supply Chain Community Day where industry, government, and academia can network and discuss challenges, practical solutions, and the latest software supply chain security research.

Our theme this year is ‘Thriving through the VulnPocalypse’, with a focus on what we are learning about how to apply AI to manage the AI-based increase in vulnerability discovery and reporting.

Date: Thursday, November 19
Time: 9:30AM - 4:30 PM
Place:
SAS Institute Global Education Center (GEC) Building A 107 SAS Campus Dr. Cary, NC 27513

RSVP here

Agenda

Time	Session
9:30 AM	Welcome
9:40 AM	Software Supply Chain EducationMichel Cukier, S3C2 and UMD
10:00 AM	Student Ignite presentations Evaluating Reproducible Builds Effectiveness for Detecting npm and PyPI Package Malware — Greg Tystahl Mapping the Attack Paths through the Supply Chain of the GitHub Actions Ecosystem — Elizabeth Lin Autonomy and Control in Agentic AI Security — Alex Cooper AI Expands the Attack Surface: A Baseline of Software Supply Chain Control Adoption Amongst AI Integration — Jill Marley VeriPort: Automated and Validated Vulnerability Backporting at Scale — Jonah Ghebremichael Beyond Alerts: Evidence-Based Detection of Risky Patterns in MCP Servers and Agent Skills — Mahzabin Tamanna Developers' Perceptions of Software Supply Chain Threats — Jess Moorefield Automating the Creation of the Annual Top 10 Controls from CTI reports — Md Nazmul Haque AI Agents are Risky, How to Help Users Understand Risks and Take Actions? — Yining Hong Can we automatically prevent compromises? — Sivana Hamer
11:00 AM	Break and research poster session
11:30 AM	How AI is Transforming How Cybersecurity Teams WorkChuck Kessler, Pendo Chuck is the Chief Information Security Officer at Pendo, where he built the security program from the ground up for a tech unicorn that helps thousands of companies worldwide improve their software products.
12:00 PM	Keynote #2 Dr. Allan Friedman Internationally recognized for leading the global Software Bill of Materials (SBOM) movement, Friedman is a trusted expert on supply chain security and cybersecurity policy. He remains a cheerful instigator of progress.
12:30 PM	Networking lunch (provided)
1:30 PM	Industry Panel: Agentic AI and the Software Supply ChainJosh Ament, Sonatype Alex Kapravelos, NCSU, Socket Brenna Leath, Navy Federal Credit Union
2:30 PM	Break
2:45 PM	Fight Fire with Fire: Protect the Electric SheepBrett Smith, SAS Institute Distinguished Software Architect currently engineering AI solutions to Secure the Supply Chain with Event Driven CI/CD gitOps Pipeline Architectures that leverage Open Weight Models, Kafka, Go, Rust, and Python running in Containers on Kubernetes and SBOMs.
3:15 PM	Stories from the Front LineBob Callaway, Google Open Source Security. Bob leads open source security efforts at Google, leading an engineering organization focused on helping upstream maintainers and ecosystems durably improve their security posture while also helping to keep Google and its users safe.
3:45 PM	Thriving After the VulnPocalypse: Building a Race-to-Fix Program for AI-Scale Vulnerability DiscoveryDr. Lisa Bradley, Dell Dr. Lisa Bradley is Senior Director of Product & Application Security at Dell Technologies, where her key focus is product security, including vulnerability response, AI-powered security innovation, and software supply chain security.
4:15 PM	Continued networking and adjourn