Daniela da Cruz

In 2018, the median time to exploit a disclosed vulnerability was 840 days. Today it is 1.6, and frontier AI is pushing that toward minutes. At the same time, AI is writing a growing share of production code, adding new vulnerabilities on top of unresolved backlogs. European regulators have taken notice: from DORA and the EU AI Act to the ECB’s requirement that significant banks submit a cyber-resilience action plan by 31 October 2026, “should have” has become “must have”.

This session looks at what that shift means for security and engineering leaders, in banking and beyond. We will examine why AI-only security (fast, but probabilistic) and traditional AppSec (reliable, but slow and noisy) each fall short, and how a hybrid model, combining deterministic detection with multi-model AI reasoning, can surface vulnerabilities that rules alone miss while cutting false-positive noise. We’ll then follow findings through to action: triage prioritised by attackability rather than severity, automated remediation, and the governance needed to keep humans in control.

Attendees will leave with a practical Capture, Eliminate, Govern framework and a checklist for turning a regulatory action plan into day-to-day engineering practice.