Session

Unlike traditional AppSec, product security must address embedded systems, long hardware lifecycles, and multi-layered firmware and software dependencies—where decisions made during early design can have long-term consequences.

‍

This session explores:

• How product security fundamentally differs from application security

• Organizational models (centralized vs. matrixed) used to manage risk across hardware, firmware, and software

• Why assessing risk during the design phase is critical before code is committed or chips are selected

• The real-world trade-offs between security and delivery in industries where patching can take months or years

• How GenAI and agentic AI are being used to enhance testing, validation, and coverage