Uploaded December 2025 | Updated September 2026, 3 weeks ago
Presentation slides: static.sched.com/hosted_files/owaspglobalappsecusa2025/5c/OWASP%20VXDF.pptx
Every security professional and developer is buried under an avalanche of alerts from security scanners. The constant question is: "Is this finding a real, exploitable threat, or just another false positive?" This alert fatigue leads to wasted time, strained team relationships, and the increased risk that critical vulnerabilities are ignored. While the market is flooded with SAST, DAST, SCA tools, they only tell us what scanners found, they don't provide the definitive, evidence-backed proof needed to take immediate action.
This talk introduces Validated Exploitable Data Flow (VXDF), a new open-source standard designed to bridge the gap between a potential finding and a confirmed, actionable security bug. We will demonstrate how VXDF provides a structured, evidence-first narrative for each vulnerability, moving beyond scanner output to concrete proof. The core of this talk is a deep dive into VXDF's flagship evidence ingestion system, which supports over 30 distinct evidence types, focusing on OWASP Top 10 and other web vulnerabilities
Attendees will learn how to leverage the VXDF format and its reference engine to automate the correlation of scanner results with real-world proof, effectively eliminating false positives and providing developers with high-fidelity, trusted bug reports they can act on instantly.
Mihir Shah
Google
Security Engineer, Technical Lead
San Francisco Bay Area
https://mihirshah.tech
linkedin.com/in/mihir-shah99
Mihir Shah is a contributor in cloud-native and application and cloud security space. He is the author of the Cloud Native Software Security Handbook. As the leader of OWASP's VXDF Project, Mihir champions open-source solutions for automated threat modeling and vulnerability assessment. He spearheads initiatives in cloud and application security engineering. Mihir regularly shares insights at Stanford University, global forums - OWASP conferences, community meetups, and Black Hat Dubai.
Managed by the OWASP® Foundation
owasp.org
Presentation slides: static.sched.com/hosted_files/owaspglobalappsecusa2025/5c/OWASP%20VXDF.pptx
Every security professional and developer is buried under an avalanche of alerts from security scanners. The constant question is: "Is this finding a real, exploitable threat, or just another false positive?" This alert fatigue leads to wasted time, strained team relationships, and the increased risk that critical vulnerabilities are ignored. While the market is flooded with SAST, DAST, SCA tools, they only tell us what scanners found, they don't provide the definitive, evidence-backed proof needed to take immediate action.
This talk introduces Validated Exploitable Data Flow (VXDF), a new open-source standard designed to bridge the gap between a potential finding and a confirmed, actionable security bug. We will demonstrate how VXDF provides a structured, evidence-first narrative for each vulnerability, moving beyond scanner output to concrete proof. The core of this talk is a deep dive into VXDF's flagship evidence ingestion system, which supports over 30 distinct evidence types, focusing on OWASP Top 10 and other web vulnerabilities
Attendees will learn how to leverage the VXDF format and its reference engine to automate the correlation of scanner results with real-world proof, effectively eliminating false positives and providing developers with high-fidelity, trusted bug reports they can act on instantly.
Mihir Shah
Security Engineer, Technical Lead
San Francisco Bay Area
https://mihirshah.tech
linkedin.com/in/mihir-shah99
Mihir Shah is a contributor in cloud-native and application and cloud security space. He is the author of the Cloud Native Software Security Handbook. As the leader of OWASP's VXDF Project, Mihir champions open-source solutions for automated threat modeling and vulnerability assessment. He spearheads initiatives in cloud and application security engineering. Mihir regularly shares insights at Stanford University, global forums - OWASP conferences, community meetups, and Black Hat Dubai.
Managed by the OWASP® Foundation
owasp.org
