Guest lecture by Jan Brennenstuhl for the cybersecurity course at Hochschule für Technik und Wirtschaft Berlin (HTW), summer term 2026.

Materials #

Reading companion #

Coding agents write a growing share of production code, so security feedback that arrives after the code exists cannot keep up. The lecture argues that AppSec teams get the most leverage from the harness the agent runs in: the rules, tools, sandboxes and credentials around the model, not the model itself. Three practices follow: deliver security findings while the task is still in the agent’s context, run agent tasks in disposable sandboxes with short-lived task-scoped credentials, and measure risk per change instead of per release.

This is a short reading companion, not a transcript. The supporting essay is the condensed lecture with context and references in accessible HTML.

Cite this

Jan Brennenstuhl. “AppSec in the Age of Agentic Engineering.” Brennenstuhl on Security, 3 July 2026. https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/

APA and BibTeX
APA

Brennenstuhl, J. (2026, July 3). AppSec in the Age of Agentic Engineering. Brennenstuhl on Security. https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/

BibTeX
@online{brennenstuhl2026appsec,
  author = {Brennenstuhl, Jan},
  title = {AppSec in the Age of Agentic Engineering},
  date = {2026-07-03},
  organization = {Brennenstuhl on Security},
  url = {https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/}
}

Markdown version ID jb-talks-htw-berlin-agentic-appsec CC BY 4.0 Send a correction