Keynote Speakers
Prof. Don Syme
GitHub
Title
The Agentic Repository Automation Revolution
Abstract
Agentic repository automation revolutionizes how we build software: adding Continuous AI (CAI) to CI/CD. The future of development is individuals and teams equipped with automated agentic workflows (repository-bound agents) scouting ahead, cleaning up behind, proactively improving and relentlessly validating code. AI slop is solved by automated AI code improvement, repository maintenance is solved by automated AI repository assistants, and difficult, neglected software engineering such as performance engineering and formal verification becomes more tractable.
This talk will cover repository automation, demonstrated with GitHub Agentic Workflows, and its incredible applications to
* Automated Code Improvement
* Automated Performance Improvement
* Automated Repository Maintenance
* Automated Formal Verification
Bio
Don Syme is a Principal Researcher at GitHub Next and Visting Professor at Kings College London, specializing in AI assisted software development and AI automation. He works with GitHub to make better developer technologies, and, through that, make people more productive and happier. In previous work he’s been the designer of the F# language and the co-originator of async/await, and has contributed to both the C# design and GitHub Copilot.
Prof. Paolo Tonella
Università della Svizzera italiana (USI)
Title
AI Testing: What have we learned? Where are we heading?
Abstract
In the last 10 years, the field of AI testing has grown exponentially in the software engineering community. The general idea has been to transfer software testing principles, approaches, and techniques to AI systems and deep learning models. Remarkable examples include test adequacy criteria, test generation, selection and prioritization, fault localization and repair, mutation testing. While such transfer has been generally successful, it has also exposed a number of foundational issues related to AI testing for which we still miss a convincing solution. In this talk, I will discuss such issues, starting from the relationship between model level and system level AI testing, to then consider the problem of adequacy assessment, i.e., the problem of deciding if a test set is strong enough to exercise the AI system under test. Then, I’ll consider the nature of faults and failures affecting AI models, as well as the ways in which they can be repaired, pointing at the main discrepancies with faults, failures and repair of traditional software systems. I will conclude with an outlook on the future of software development, in which LLMs are expected to be increasingly used as code generators. I will discuss quality assessment for code produced by LLMs and the way quality assessment is likely to be impacted by novel software development paradigms, such as vibe and agentic coding.
Bio
Paolo Tonella is Professor of Software Engineering and Director of the Software Institute at the Faculty of Informatics, Università della Svizzera italiana (USI), in Lugano, Switzerland. He has been Honorary Professor at University College London, UK, and Head of Software Engineering at Fondazione Bruno Kessler, Trento, Italy. Paolo Tonella held an ERC Advanced grant as Principal Investigator of the project PRECRIME (Self-assessment Oracles for Anticipatory Testing). Paolo Tonella has written over 200 peer reviewed conference papers and over 100 journal papers. His H-index (according to Google scholar) is 73; the number of citations 17k. In 2011 he was awarded the ICSE 2001 MIP (Most Influential Paper) award, for his paper: “Analysis and Testing of Web Applications”. He is/was in the editorial board of TOSEM, TSE and EMSE. He was Program Co-Chair of ISSTA 2025/ESEC-FSE 2023. His current research interests are in software testing, in particular approaches to ensure the dependability of machine learning based systems, automated testing of cyber physical systems, and security testing.
Prof. Laurie Williams
North Carolina State University (NCSU)
Title
Dependable Software, Untrusted Parts: Security Research for the Software Supply Chain
Abstract
Since 2020, software supply chain attacks have expanded from isolated incidents to a persistent global threat. Adversaries increasingly target package ecosystems, build infrastructure, CI/CD pipelines, developer workstations, and project maintainers—exploiting the systems and relationships involved in producing software rather than the software itself. For the software engineering community, these attacks expose an uncomfortable reality: the dependability of modern software now relies as much on the integrity of its dependencies, build processes, and development environments as on the correctness of the code developers write. Organizations must continuously adapt simply to keep pace.
This talk argues that the path to transformative software supply chain research runs directly through practice. Without that grounding, researchers risk solving elegant versions of the wrong problems. Drawing on research and sustained engagement with more than 150 practitioners from over 50 companies through the NSF-funded Secure Software Supply Chain Center (S3C2), I will discuss lessons learned from the field and highlight high-impact research opportunities hidden within operational pain points, including software provenance, measurement, vulnerability intelligence, and developer environment security. Many of these challenges call for the empirical methods, repository mining, measurement, and process research that the ISSRE community has long championed in pursuit of more reliable, dependable, and trustworthy software systems.
Just as the research community has begun to understand one software supply chain, another is emerging. AI-assisted development is transforming software production by introducing new dependencies, new trust assumptions, and new attack surfaces. Foundation models, training data, AI-generated code, hallucinated package references, and autonomous agents operating with credentials of their own are rapidly becoming part of the software ecosystem. These developments raise a familiar question: what critical components of software production are we overlooking today?
The central lesson of the past five years is that trust cannot be assumed, threat models must evolve alongside development practices, and impactful research must remain grounded in operational reality. As software production becomes increasingly automated, interconnected, and AI-assisted, the challenge before us is not simply securing software artifacts—it is engineering trustworthy software production systems. The dependability of the next generation of software will depend on how well we meet that challenge
Bio
Laurie Williams is the Goodnight Distinguished University Professor of Security Sciences in the Computer Science Department of the College of Engineering at North Carolina State University (NCSU). Laurie is the director of the National Science Foundation-sponsored Secure Software Supply Chain Center (S3C2), and co-director of the NSA-sponsored North Carolina Partnership for Cybersecurity Excellence (NC-PaCE) and the NCSU Secure Computing Institute. Laurie is an IEEE Fellow and an ACM Fellow. Laurie’s research focuses on software security, software processes, and empirical software engineering.