CodeSecCon

The gap between a great customer experience and a secure one used to feel like a tradeoff. Not anymore. Dine Brands, the parent company of IHOP and Applebee's, knows the cost of identity complexity. Early loyalty programs stalled due to friction at sign-up. Credential stuffing attacks were eroding guest trust. And, every new digital idea waited months for security review.

Today, the same identity foundation powers 14 million IHOP members and 17 million Applebee's members. An in-restaurant AI personalization pilot is now scaling across 3,500 locations and security reviews are completed in a matter of days.

In this fast-paced Streamcast, Gareth Davies, Chief Product Officer at Auth0, sits down with Joe Frisk, VP and CISO at Dine Brands, for a candid look at what it takes to unblock security bottlenecks and make identity the growth engine of a modern consumer brand.

We’ll dig into:

• Identity as a measurable revenue engine: How removing "front door" friction directly unlocks loyalty adoption and measurable revenue uplift.
• Standardized tech for brand innovation: How to scale a backend "Gold Standard" while empowering individual brands to maintain unique frontend experiences.
• Security as a growth lever: How to turn security bottleneck into an accelerant across brands

As AI transforms software development from hands-on coding to orchestration, traditional security models are falling behind. Human checkpoints are disappearing, while AI-driven workflows introduce and amplify risks at unprecedented speed. This session explores what’s broken in the shift to agentic development and how to secure an AI-accelerated SDLC—so teams can move fast without leaving critical gaps exposed.

WordPress powers a huge part of the web, which makes it attractive not only for website owners, but also for attackers. Automated scans, vulnerable plugins, abandoned themes, weak credentials, exposed admin tools, and careless migrations can quickly turn a normal website into a compromised production system.

This talk presents practical WordPress security best practices based on real-world hardening work performed after repeated security incidents and during a clean migration process. The focus is not on a specific hosting provider, cloud vendor, or managed platform. Instead, the session distills general principles that apply to most self-hosted or VPS-based WordPress environments.

We will discuss why a secure WordPress recovery or migration should usually start with a clean installation instead of blindly copying the entire old installation. We will cover how to migrate only the required content, inspect uploaded files, review database content for suspicious scripts, reset credentials, and avoid carrying hidden backdoors into the new environment.

The talk will also cover operational hardening: isolating websites from each other, using controlled file ownership and permissions, avoiding FTP credentials, preferring key-based server access, minimizing firewall exposure, removing unnecessary web-accessible tools such as phpMyAdmin, reducing the plugin and theme attack surface, enabling automatic updates, and maintaining reliable recovery points through regular backups or snapshots.

As AI applications move from experimentation into production, security teams need more than model-level safeguards. They need a control plane that can enforce policy consistently across prompts, agents, tools, and model endpoints. This session presents the AI gateway as that control plane.

I’ll walk through a practical gateway-based security architecture built around three layers of control for production AI systems:

• Content controls inspect and block risky requests and responses, including prompt injection attempts, unsafe content, and sensitive data exposure.
• Access controls govern which users, apps, agents, and MCP tools can reach model and API endpoints through authentication and authorization policies.
• Operational controls provide the limits, monitoring, and enforcement mechanisms needed to keep AI workloads safe, reliable, and manageable at scale.

Using Azure API Management and Azure Content Safety as the implementation example, this session shows how these controls work together in a real deployment. Let’s discuss how to reduce AI risk, apply stronger enforcement at the gateway layer, and build safer AI applications for production use.

This session dives into the engineering patterns required to isolate and protect autonomous agent runtimes. We will unpack the concrete threat models introduced by indirect prompt injection, memory poisoning, and systemic prompt leakage. Attendees will leave with a practical framework for implementing zero standing privilege for machine identities, sandboxing runtime environments, and designing secure Model Context Protocol (MCP) gateways to prevent malicious tool execution.

Your AI coding agent can run rm -rf, force push to main, install a typosquatted package, and read your .env file, all on its own, at machine speed. Most teams have zero runtime defense for this.

This talk shows how event-driven hooks fix it. Hooks intercept every tool call an AI agent makes, then block, allow, or modify it before execution. The hook runs outside the model as a separate process, so prompt injection cannot bypass it. The session maps hooks to 6 of the OWASP Top 10 for LLM Applications, walks through real blocking scripts (dangerous commands, secret exfiltration, audit logging), and shares performance data on keeping these controls under 100ms per invocation.

Application telemetry is essential for debugging and monitoring modern cloud-native applications, but it often contains far more than performance metrics. Logs, traces, and metrics can inadvertently expose API keys, authentication tokens, personally identifiable information (PII), customer data, and internal service metadata. While encryption protects telemetry in transit and at rest, sensitive information remains vulnerable while it is being collected, processed, and exported.

This session explores how Confidential Computing can secure telemetry pipelines by protecting data during execution. Using familiar cloud-native technologies such as OpenTelemetry, Fluent Bit, and Loki, we'll demonstrate how observability components can run inside Trusted Execution Environments (TEEs), ensuring that telemetry is processed only by verified, hardware-attested workloads.

Through a practical demonstration, attendees will learn how to build observability pipelines that reduce the risk of sensitive data exposure without changing application code. We'll cover runtime attestation, secure telemetry processing, and practical design patterns that help development and security teams strengthen observability while meeting enterprise security and compliance requirements.

AI-assisted development is accelerating software delivery, but it is also introducing new security risks, including insecure code generation, sensitive data exposure, prompt injection, dependency vulnerabilities, and inconsistent compliance with enterprise security standards. Many organizations deploy coding assistants as isolated productivity tools without integrating them into secure development processes or providing them with governed organizational context.

This session introduces a three-body collaboration model that connects business stakeholders, software engineers, and enterprise-tuned Large Language Models within a secure software development ecosystem. In this model, business teams define requirements through natural-language interfaces, context-aware LLMs translate those requirements using approved architectural and security standards, and engineers validate the generated output while retaining responsibility for design, risk assessment, and final implementation.

The presentation will demonstrate how organizations can embed secure coding policies, threat models, design systems, compliance requirements, and approved development patterns into AI-assisted workflows. It will also examine controls for protecting proprietary code and sensitive data, validating AI-generated components, managing third-party dependencies, preventing prompt-based attacks, and maintaining traceability across the software development lifecycle.

As organizations scale their multi-cloud deployments, traditional security boundaries crumble, creating complex blind spots that bad actors eagerly exploit. This webinar introduces a new generation of cloud-native security tools engineered to protect distributed environments from sophisticated modern threats.

Designed for technology leaders managing complex migrations and architectures, this session focuses entirely on emerging technologies that simplify compliance and threat detection. We will evaluate automated solutions for cloud security posture management, identity governance, and real-time anomaly detection across hybrid frameworks. You will learn how next-generation platforms can help your team continuously monitor cloud assets, remediate misconfigurations instantly, and enforce zero-trust principles without slowing down development cycles.

Join us to discover advanced software tools that unify visibility, reduce administrative overhead, and ensure your organizational data remains locked tight across every public and private cloud interface.