Koen Buyens is a Product Security Principal at Salesforce with two decades of application security experience spanning both sides of the secure software development lifecycle. On the constructive side, he researched secure software design for his PhD in KU Leuven’s DistriNet research group and wrote embedded C/C++ at Sony. On the destructive side, he served on Sony’s web penetration testing team, performed threat modeling at Cigital, and worked on the security research team behind Synopsys’s Coverity static analysis engine. He specializes in turning manually discovered security bugs into automated guardrails that run as pull-request checks, so a vulnerability found once is caught everywhere. At Salesforce, he pioneered this approach with Open Policy Agent (OPA) policy-as-code and Semgrep and is the principal author of the company’s Semgrep ruleset. He now works on its internal agentic harnesses end to end, from strategy and implementation to adoption and large-scale scanning.
On the code we scan at depth, the volume of findings is now the constraint: frontier models plus an agentic harness surface more real, exploitable findings than engineering can absorb. We can find…
