Course Details

Number of Days: 2

Attendance: In-Person Only

Details below last updated: August 18/2026

***The Date of September 28-29 at this time is a PLACEHOLDER and NOT CONFIRMED

Course Description

LLMs and classic SAST both find real bugs in your code. They also both produce noise, and they miss different things. This training is about building a pipeline that gets more out of each.

We start with why simple prompting underdelivers, then take SAST apart (sources, sinks, taint propagation) so you know where it misses and why. From there: using LLMs to improve SAST output, using context to improve LLM-driven scanning, and combining the two.

Then the hard part: cutting false positives with existing test frameworks, fuzzing harnesses, live test systems, and skeptical triage against source alone. We finish with remediation.

By the end of the training, you'll leave with a working pipeline design you can adapt to your own codebase and toolchain, not just a mental model of the ideas.

Teaching

The training balances short lecture segments with hands-on exercises. Each concept is introduced, then immediately applied: you'll run classic SAST tools against sample codebases, wire LLM passes around their output, and iterate on prompts and context to see how each change shifts the false positive/false negative balance.

Participants work with provided sample projects and toolchains throughout; those who want to try the pipeline against their own code are welcome to bring representative (non-sensitive) source.

Learning Objectives

• Explain why naive "find security problems" prompting underperforms, and what the probabilistic nature of LLM output means for scanning pipelines

• Describe how classic SAST works, including sources, sinks, and taint propagation, and identify the structural causes of its false positives and false negatives

• Use LLMs to post-process and improve SAST findings

• Use codebase and runtime context to improve raw LLM-driven scanning

• Design a pipeline that combines AI-driven SAST enrichment with LLM-driven scanning rather than treating them as separate tools

• Cut false positives using existing test frameworks, fuzzing harnesses, and live test systems

• Apply skeptical triage techniques when only source is available and no test infrastructure exists

• Take a scanning pipeline through to remediation, not just detection

Course Outline

• Introduction and Context
  

• Problems with Simple Approaches

  • Why "find security problems" prompts yield meager results

  • The probabilistic nature of LLM output, and what it means for scan reliability and reproducibility
    

• Limitations of Classic SAST Tooling

  • How SAST works under the hood

  • The bits and pieces of SAST: sources, sinks, taint propagation, rule sets

  • What causes false positives and false negatives
    

• Improving SAST Output Using LLMs

  • Using LLMs to triage, explain, and re-rank SAST findings

  • Where LLM post-processing helps most, and where it introduces new risk
    

• Improving LLM-Driven Scanning with Context

  • What context actually moves the needle: call graphs, data flow, framework/library semantics, prior findings

  • Feeding context into scanning without drowning the model or your budget
    

• Combining AI-Driven SAST with LLM-Driven Scanning

  • Designing a pipeline where each technique compensates for the other's blind spots

  • Sequencing and feedback loops between the two
    

• Reducing False Positives

  • Using existing testing frame, fuzzing or runtime setups to verify behavior

  • Source-control-only triage: skeptical triage

• Remediation

  • Turning validated findings into fixes

  • Feeding remediation outcomes back into the pipeline

Requirements and Recommendations

Intended Audience

This training is intended for application security engineers, security-minded developers, DevSecOps and platform engineers, and consultants who want to build or improve automated vulnerability scanning for their own or their clients' codebases.

Prerequisites

Participants should be comfortable reading code in at least one mainstream language and have basic familiarity with the idea of static analysis (SAST). Prior hands-on experience with a specific SAST tool or with LLM/agent tooling is helpful but not required.

Software Requirements

Participants should bring a laptop capable of running local tooling and containers (Docker). Course material, sample codebases, and tooling will be provided; access to an LLM (via local models or the participant's own API key/subscription) is required for the hands-on exercises.

About the Instructor: Erlend Oftedal

Erlend Oftedal's long-standing professional focus is secure coding, application security, and software supply chain security, with hands-on depth in application security tooling, AI-assisted coding and security, and many years of traditional secure software development. He is a frequent speaker at developer and security conferences such as OWASP AppSec, SecAppDev and NDC conferences.