AppSec & Mobile Security Insights: Shopify's Approach, Industry News, ESW Episode 470

Post Views: 10

The latest episode of Enterprise Security Weekly features a discussion on evolving application security practices, mobile device challenges in enterprise environments, and recent developments in the cybersecurity landscape.

Application Security and AI Integration

Andrew Dunbar, who has led security initiatives at Shopify for 13 years, outlines how artificial intelligence has reshaped application security workflows. He emphasizes the integration of bug bounty programs within a framework that addresses post-Mythos and post-AI harness environments. Dunbar highlights the development of an agentic security system designed to adapt beyond model-specific limitations, referencing his team’s research on this approach. His perspective underscores the need for dynamic, risk-based strategies in securing digital commerce platforms.

Andrew Dunbar’s Insights on AI in Application Security

Dunbar emphasizes the integration of bug bounty programs within a framework that addresses post-Mythos and post-AI harness environments. He highlights the development of an agentic security system designed to adapt beyond model-specific limitations.

Mobile Security Challenges in Enterprise Environments

Kern Smith discusses the complexities of mobile security, particularly in enterprise settings. He traces the evolution of mobile devices in corporate environments and addresses the difficulties of securing mobile applications amid the rise of “vibe-coding” practices. Smith notes that AI-driven attacks are increasingly targeting mobile systems, citing Zimperium’s research on this trend. He stresses the importance of continuous monitoring and adaptive security measures to counter threats such as phishing, malware, and device compromise.

Evolution of Mobile Devices in Corporate Environments

Smith traces the evolution of mobile devices in corporate environments and addresses the difficulties of securing mobile applications amid the rise of “vibe-coding” practices.

AI-Driven Threats to Mobile Systems

Smith notes that AI-driven attacks are increasingly targeting mobile systems, citing Zimperium’s research on this trend. He stresses the importance of continuous monitoring and adaptive security measures to counter threats such as phishing, malware, and device compromise.

Enterprise Security News and Developments

The episode also covers recent enterprise security news, including the emergence of four new cybersecurity unicorns following Black Hat funding surges. Notable developments include Cyera’s $1 billion acquisition of Oasis Security, a platform specializing in agentic access governance. Other acquisitions highlighted include Palo Alto Networks’ purchase of Embrace, a user and data observability provider. Funding activity remains robust, with companies like Spur securing $200 million in venture capital and ThreatLocker raising $190 million for zero-trust solutions. Startups such as Cathedral, Glow, and Neo Security also reported significant rounds, reflecting investor confidence in AI-driven security technologies.

Future of AI in Cybersecurity

The segment also addressed the Hugging Face breach, attributed to a competitor’s AI agent, and the subsequent calls for stricter oversight of AI research. OpenAI’s delayed response to the incident and its implications for AI governance were analyzed. Privacy concerns were raised following reports of a U.S. citizen facing legal action for using a “duress” password to wipe a device during a border search. This case has sparked debates about the intersection of privacy features and law enforcement practices. Additional coverage includes a report from Veracode indicating that AI-generated code security remains stagnant, with a 56% pass rate for vulnerabilities. The VulnCheck State of Exploitation 2026 report highlights accelerating ransomware activity, though the role of AI in this trend remains debated. The episode concludes with discussions on the future of AI in cybersecurity, including the potential of open-source models to reduce reliance on cloud-based solutions. Analysts also critique the growing number of “pause AI” campaigns and corporate partnerships aimed at mitigating risks.