Don't Make This Mistake: Painful Learnings of Applying AI in Security

This conference talk explores the challenges and limitations of applying AI in application security, particularly for auto remediation of code vulnerabilities. Dive into research findings where OpenAI was used to address security vulnerabilities, revealing underwhelming results that serve as a cautionary tale against overreliance on AI as a standalone security solution. Through real-world examples and a live demonstration, examine the specific limitations of Generative AI in handling complex code vulnerabilities. The second part introduces a more effective approach using the Retrieval-Augmented Generation (RAG) Framework, which enhances generative models by incorporating a retrieval component that dynamically accesses external knowledge during the generation process. Gain practical insights on how to responsibly implement AI in security programs and properly evaluate AI tools, avoiding common pitfalls while leveraging AI's strengths appropriately.