​OVERVIEW

​AISec-Tor is Toronto’s practitioner-led AI security community. We cover both directions: securing AI products, agents, and the model supply chain, and using AI inside security teams without creating new attack surface. We meet every 6–8 weeks.

​Event #1 brought 50 practitioners to the room. For #2, the theme is AI within AppSec.

​SPONSOR

​Thanks to Socket for sponsoring our 2nd event.

​AGENDA (5:30–8:30 PM)

• ​5:30 — Doors, food, drinks

• ​6:00 — Secure SDLC Beyond Traditional Scanners with AI-Native Security, David Dowe (Jane App)

• ​6:30 — Beyond CVEs: Shrinking the Attack Surface Through Agentic Analysis, Arvind Balaji (Salesforce)

• ​7:00 — Networking

• ​8:30 — Hard stop

​TALKS

​Secure SDLC Beyond Traditional Scanners with AI-Native Security, David Dowe

​Scanners find plenty, but triage is the bottleneck. David shows how Jane built Vector, an agentic AppSec platform that triages findings, verifies fixes, and reviews PRs with a human signing off on every verdict. It cut a backlog of 2,000+ tickets by over 80%.

​Beyond CVEs: Shrinking the Attack Surface Through Agentic Analysis, Arvind Balaji

​A package with no known CVEs isn't necessarily safe. Traditional vulnerability management misses critical signals in the evolving supply chain space today. This topic explores how to look beyond CVEs to assess open source packages, turn those signals into actionable decisions by reducing the overall attack surface through a combination of deterministic and agentic analysis

​SPEAKERS

​David Dowe is Senior Manager of Security Engineering at Jane App, one of Canada’s largest healthcare SaaS platforms. He has built security programs from scratch mutiple times, at Jane, GS1 Canada, and ICES, after nearly a decade leading privacy and security at Trillium Health Partners. He holds CISM, CRISC, and CIPP/C.

​Arvind Balaji is a Lead Infrastructure Security Engineer at Salesforce in Toronto, focused on enterprise-wide software supply chain security strategy and tooling. Previously, he worked on securing code-to-cloud infrastructure at Salesforce. Prior to that, he held security consulting roles at Cigital and Synopsys, helping Fortune 500 companies design and scale DevSecOps and secure SDLC practices.

​HOUSE RULES

• ​Practitioners only on stage. No vendor pitches or product demos.

• ​The discussion block runs under Chatham House Rule and is never recorded.

• ​Talks are recorded only with speaker consent.

• ​Not a recruiting event. 1:1 conversations are fine; list-building isn’t.

• ​Berlin Code of Conduct applies.

​WHO SHOULD COME

​Security engineers, AI security practitioners, engineering leaders and security leaders (Heads of Security, CISOs) working on AI in either direction.

​Space is capped to keep the room conversational. In-person attendees get an invite to our private Slack, where members bring real problems and compare notes between events.

​Organized by Ali Firooz and Harish Ramadoss

​GET INVOLVED

​Follow AISec-Tor on LinkedIn for upcoming events and recaps.

​Want to give a talk or host a future event? Message us on the LinkedIn page. We’re always looking for practitioners with real work to share and teams with space to host

​See you there 👋