{"$schema": "https://c3voc.de/schedule/schema.json", "generator": {"name": "pretalx", "version": "2026.3.0.dev0", "url": "https://pretalx.com"}, "schedule": {"url": "https://pretalx.com/bsidesatl-2026/schedule/", "version": "0.1", "base_url": "https://pretalx.com", "conference": {"acronym": "bsidesatl-2026", "title": "BSides Atlanta 2026", "start": "2026-10-03", "end": "2026-10-03", "daysCount": 1, "timeslot_duration": "00:05", "time_zone_name": "US/Eastern", "colors": {"primary": "#3aa57c"}, "rooms": [{"name": "Prefunction - Sponsors", "slug": "6085-prefunction-sponsors", "guid": "b1e50b62-04be-5934-aeb9-b02ed5993851", "description": null, "capacity": null}, {"name": "Prefunction - Check in", "slug": "6086-prefunction-check-in", "guid": "e0e43024-85cd-52a3-987a-b9e82d6751b5", "description": null, "capacity": null}, {"name": "Grand Ballroom", "slug": "6087-grand-ballroom", "guid": "2b29b2a0-5d73-5e1f-b3c5-1f9eb765c0a3", "description": null, "capacity": null}, {"name": "Conference A", "slug": "6088-conference-a", "guid": "cf77053e-d3cc-580d-a4ab-e4f39f116110", "description": null, "capacity": null}, {"name": "Conference B", "slug": "6089-conference-b", "guid": "132dbf31-f600-5d67-99d3-5c62fb44354b", "description": null, "capacity": null}, {"name": "Conference C", "slug": "6090-conference-c", "guid": "1b9b05da-8d31-5dc6-a11a-511fc390b70e", "description": null, "capacity": null}, {"name": "Conference D", "slug": "6091-conference-d", "guid": "f0d2863d-aeb3-5ae4-9fc6-a52823f431b8", "description": null, "capacity": null}, {"name": "Conference E", "slug": "6092-conference-e", "guid": "b9dbf386-abcd-5076-829e-299e8a2e273b", "description": null, "capacity": null}, {"name": "Conference Two", "slug": "6093-conference-two", "guid": "efb71815-f48d-57e8-bf52-3a245debfe98", "description": null, "capacity": null}, {"name": "Conference Three", "slug": "6094-conference-three", "guid": "ee25bec0-5cb1-577e-969a-48766b09aa6c", "description": null, "capacity": null}, {"name": "Conference Four", "slug": "6095-conference-four", "guid": "0f5368d8-deb9-5e0a-9556-4c2f55674b9c", "description": null, "capacity": null}, {"name": "Conference Five", "slug": "6096-conference-five", "guid": "85fbfd59-25f3-5414-82c8-f005adbd1dc6", "description": null, "capacity": null}, {"name": "Conference Six", "slug": "6097-conference-six", "guid": "b826ce4b-5898-5616-8db8-7133ed28c926", "description": null, "capacity": null}, {"name": "Hudson Grille - Midtown location", "slug": "6383-hudson-grille-midtown-location", "guid": "9cbec493-887f-5074-a319-36c49efc896f", "description": null, "capacity": null}, {"name": "Conference Dining Room", "slug": "6382-conference-dining-room", "guid": "a60bf9e2-c53b-55ce-84e8-684da3d3e06f", "description": null, "capacity": null}, {"name": "Conference Eight", "slug": "6343-conference-eight", "guid": "226fe30d-879d-5bd8-bc85-28b9227a23e9", "description": null, "capacity": null}, {"name": "Conference Seven", "slug": "6342-conference-seven", "guid": "1d1a004b-4aaf-5b17-9be9-e5228f30aad7", "description": null, "capacity": null}], "tracks": [{"name": "Village", "slug": "7511-village", "color": "#30b5b8"}, {"name": "Offensive Security & Research", "slug": "7512-offensive-security-research", "color": "#ed2651"}, {"name": "Defensive Strategies & Operations", "slug": "7513-defensive-strategies-operations", "color": "#2124f4"}, {"name": "Emerging Tech & Infrastructure", "slug": "7514-emerging-tech-infrastructure", "color": "#a2a716"}, {"name": "Governance, Risk & Compliance", "slug": "7515-governance-risk-compliance", "color": "#237ea7"}, {"name": "Community, Career, & Soft Skills", "slug": "7516-community-career-soft-skills", "color": "#de15d3"}, {"name": "Workshop", "slug": "7517-workshop", "color": "#1c8455"}, {"name": "Contest", "slug": "7518-contest", "color": "#bb2941"}], "days": [{"index": 1, "date": "2026-10-03", "day_start": "2026-10-03T04:00:00-04:00", "day_end": "2026-10-04T03:59:00-04:00", "rooms": {"Prefunction - Check in": [{"guid": "e3ba3eb2-7334-5ad6-8a4c-b5bdad37d735", "code": "YCWEWD", "id": 105844, "logo": null, "date": "2026-10-03T08:00:00-04:00", "start": "08:00", "end": "2026-10-03T16:00:00-04:00", "duration": "08:00", "room": "Prefunction - Check in", "slug": "bsidesatl-2026-105844-conference-check-in", "url": "https://pretalx.com/bsidesatl-2026/talk/YCWEWD/", "title": "Conference check-in", "subtitle": "", "track": null, "type": "Full-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "Attendee check-in!\n\nGet your badge, t-shirt, and swag!", "description": null, "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/YCWEWD/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/YCWEWD/", "attachments": []}], "Grand Ballroom": [{"guid": "b839f48c-b48d-5852-ab47-753e26288d44", "code": "SQRTAH", "id": 105514, "logo": null, "date": "2026-10-03T08:45:00-04:00", "start": "08:45", "end": "2026-10-03T09:00:00-04:00", "duration": "00:15", "room": "Grand Ballroom", "slug": "bsidesatl-2026-105514-organizers-opening-remarks", "url": "https://pretalx.com/bsidesatl-2026/talk/SQRTAH/", "title": "Organizers Opening Remarks", "subtitle": "", "track": null, "type": "Organizers remarks", "language": "en", "abstract": "We'll try to come up with something clever to say", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "KX9ECP", "name": "Scott Stanton", "avatar": "https://pretalx.com/media/avatars/ANFDRY_Bpa2vsX.webp", "biography": "Scott Stanton has been a cybersecurity practitioner for over 20 years, with technical roles spanning software development, infrastructure, cloud, and security. He currently leads the cybersecurity and data privacy program for JAS Worldwide, a global freight logistics provider.\n\nPrior to JAS, Stanton was BISO and Director of Threat & Vulnerability Management at Owens & Minor, CISO at Halyard Health/Avanos Medical, and was a security architect at Cisco Systems.  He also served in technical security roles for Scientific-Atlanta, Coca-Cola, and General Electric.  He holds a BA in Computer Science from the State University of New York at Albany.", "public_name": "Scott Stanton", "guid": "abdc66c1-1c65-5b79-a922-ea6de56f5c6c", "url": "https://pretalx.com/bsidesatl-2026/speaker/KX9ECP/"}, {"code": "JWVVFC", "name": "Steve Ripple", "avatar": null, "biography": "It's me, Ripple.", "public_name": "Steve Ripple", "guid": "f8206e4f-af84-5495-91d2-1b69e7221f54", "url": "https://pretalx.com/bsidesatl-2026/speaker/JWVVFC/"}, {"code": "HAWEPJ", "name": "Dr. Andy Green", "avatar": "https://pretalx.com/media/avatars/avatar_o2EHlFG.webp", "biography": "Andrew W. (Andy) Green, Ph.D., is an Associate Professor of Information Security and Assurance in the Department of Information Systems and Security at the Michael J. Coles College of Business at Kennesaw State University. He directs the KSU Cyber Range at Coles College and serves as the faculty advisor for the Orthodox Christian Fellowship (OCF) Club at KSU. Green also chairs the Parish Cybersecurity Committee of the Greek Orthodox Archdiocese of America.\n\nBefore transitioning to full-time academia, Green spent more than twenty years in cybersecurity. His experience includes cybersecurity and IT consulting for small- to mid-sized businesses, as well as earlier work in healthcare IT, where he developed and supported transcription interfaces used by medical facilities across the U.S.\n\nGreen\u2019s academic research examines the connections between information security, privacy, and public policy. His work has appeared in leading peer-reviewed journals, and he has co-authored several textbooks used in university courses worldwide. He also provides expert analysis and commentary on cybersecurity for various media outlets.\n\nHe currently serves as President of the Special Interest Group on Information Security and Privacy (SIG SEC) within the Association for Information Systems (AIS), an international association of information systems scholars that named him a Distinguished Member in 2025.\n\nGreen has been a BSides Atlanta organizer since 2018.", "public_name": "Dr. Andy Green", "guid": "75e3c1be-ab31-529d-85bf-f0a3e0f088bd", "url": "https://pretalx.com/bsidesatl-2026/speaker/HAWEPJ/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/SQRTAH/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/SQRTAH/", "attachments": []}, {"guid": "ad3aa7d5-4c0c-542e-b654-e3321719f27b", "code": "WCAHHW", "id": 105517, "logo": null, "date": "2026-10-03T09:00:00-04:00", "start": "09:00", "end": "2026-10-03T09:25:00-04:00", "duration": "00:25", "room": "Grand Ballroom", "slug": "bsidesatl-2026-105517-cutover-the-state-of-cybersecurity-ai-and-the-humans-in-the-loop", "url": "https://pretalx.com/bsidesatl-2026/talk/WCAHHW/", "title": "Cutover: The State of Cybersecurity, AI, and the Humans in the Loop", "subtitle": "", "track": null, "type": "Keynote", "language": "en", "abstract": "If you've ever run a cutover, you know the feeling: the old system is going dark and the new one isn't fully up yet. That's where we are in 2026. This spring an AI model found 271 of the 423 security bugs Mozilla fixed in a single month, and more than 100 people wrote the fixes. AI agents keep breaking out to go hacking, and a federal career fair put chatbots in some of its booths. Work is mid-cutover too, and some hiring platforms are reporting 300+ applications for every hire.\n\nThis keynote is a year in review of cyber and AI: what went right in 2026 and what's ahead for 2027. Then it turns to the humans in the loop, and what all of this means for work and careers. It covers what the job numbers miss, where AI is adding work and new fields are hiring, how people protect their income, and how to get your work in front of the people who can hire or fund you.\n\nThe internet era ran a cutover like this one. In the years after the dot-com bust, whole new kinds of work became official job titles, information security analyst among them. Every cutover needs a runbook. You'll leave with some ideas for yours.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "FHATT3", "name": "Liz Morton", "avatar": "https://pretalx.com/media/avatars/QN8SMB_CX6QRgF.webp", "biography": "Liz Morton is Chief Information Security Officer at Koda Security, an AI-native governance platform company. She brings 25+ years of experience as an operator across IT, Operations, and Cybersecurity, having built and led organizations in global financial services, manufacturing, distribution, and technology. She spent nine years at Intercontinental Exchange, parent of the New York Stock Exchange, first leading IT Engineering, and then transitioning to Head of Cybersecurity.\n\nLiz holds an MBA from Georgia Tech and a CISSP. She writes and speaks on human/AI coexistence, leadership, and cybersecurity, and serves as an advisor and board member for several organizations. She lives in Roswell with her family.", "public_name": "Liz Morton", "guid": "105f5a3a-48d3-5ebe-a9c1-bd42bbaf6039", "url": "https://pretalx.com/bsidesatl-2026/speaker/FHATT3/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/WCAHHW/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/WCAHHW/", "attachments": []}, {"guid": "c9e05477-20a0-56c0-aad3-2983d3ceeb60", "code": "UWMQVG", "id": 103274, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T09:50:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103274-taking-the-day-off-ai-stand-ins-for-zoom", "url": "https://pretalx.com/bsidesatl-2026/talk/UWMQVG/", "title": "Taking the Day Off: AI Stand-Ins for Zoom", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "What could Ferris Bueller get up to in the modern day?\n\nThis talk is about building that: an AI stand-in for Zoom. The system listens to a meeting transcript as it is happening, decides when and how \u201cI\u201d should respond, generates a response in my speaking style, and routes synthetic audio/video back into the call. If someone says, \u201cturn your camera on for proof,\u201d the goal is to keep the bit going.\n\nI\u2019ll walk through the prototype architecture: capturing my own voice and mannerisms with consent, feeding live meeting context into an agent, generating plausible responses, pushing audio/video through virtual devices, and testing whether a real person can tell when the stand-in breaks.\n\nRemember Ferris already hacked his school\u2019s grade system, so this would be pretty canonically accurate.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "NGK9CL", "name": "james widner", "avatar": "https://pretalx.com/media/avatars/VEGMRG_gqjpl7s.webp", "biography": "I am a senior computer science student at KSU focused on AI, and an AI researcher at MechaMinds. I like modeling problems into systems that AI can reason about and solve. Karpathy says, \u201cAnything verifiable is solvable.\u201d", "public_name": "james widner", "guid": "7afd3d9e-b12c-5c7f-b534-44b9b0d299f3", "url": "https://pretalx.com/bsidesatl-2026/speaker/NGK9CL/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/UWMQVG/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/UWMQVG/", "attachments": []}, {"guid": "10494076-68c3-5ce9-9596-588a80d7d4ce", "code": "7DPFAV", "id": 103040, "logo": null, "date": "2026-10-03T10:00:00-04:00", "start": "10:00", "end": "2026-10-03T10:20:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103040-will-the-real-imposter-please-stand-up-why-deepfake-detectors-fail-in-the-wild", "url": "https://pretalx.com/bsidesatl-2026/talk/7DPFAV/", "title": "Will the Real Imposter Please Stand Up? Why Deepfake Detectors Fail in the Wild", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "Deepfake detectors routinely report impressive benchmark accuracy, but those benchmarks assume the images never leave the lab. In the real world, images are compressed, resized, cropped, filtered, and repeatedly re-encoded as they move across messaging apps and social media platforms, creating a gap between laboratory performance and operational reliability.\n\nThis talk presents Imposter, an open-source framework developed to evaluate how common \"in-the-wild\" image transformations affect modern deepfake detection systems. By comparing two state-of-the-art detection approaches under realistic distortions, the research demonstrates that seemingly insignificant processing can dramatically reduce detection performance for some models, while others remain comparatively resilient. Results show that models relying on local artifact-based features degrade rapidly under even minor compression and resizing, while models leveraging global semantic representations remain substantially more robust.\n\nRather than focusing on sophisticated adversarial attacks, this session examines the ordinary image processing that every security practitioner encounters every day\u2014and why it represents an overlooked failure mode for AI-powered media forensics. Attendees will see where current detection systems break, why benchmark performance often overestimates operational reliability, and what defenders should consider before trusting deepfake detection in production environments.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "9E8KXE", "name": "Bryant Renfroe", "avatar": "https://pretalx.com/media/avatars/TPLULM_098p5Bj.webp", "biography": "Risk and intelligence professional, Navy veteran, and Georgia Tech M.S. Cybersecurity graduate with experience in open-source intelligence (OSINT) investigations, fraud detection, blockchain analysis, and compliance-driven security operations. Human-centered approach focused on protecting vulnerable communities and disrupting criminal networks, motivated by my personal faith.", "public_name": "Bryant Renfroe", "guid": "5e89d8cb-5d66-52bf-8181-2756bfcf2551", "url": "https://pretalx.com/bsidesatl-2026/speaker/9E8KXE/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/7DPFAV/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/7DPFAV/", "attachments": []}, {"guid": "77d56bdc-648e-5f9b-9af6-150d84b34502", "code": "TFZAQG", "id": 103615, "logo": null, "date": "2026-10-03T10:30:00-04:00", "start": "10:30", "end": "2026-10-03T11:20:00-04:00", "duration": "00:50", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103615-mcp-security-the-audit-you-didn-t-know-you-were-running", "url": "https://pretalx.com/bsidesatl-2026/talk/TFZAQG/", "title": "MCP Security: The Audit You Didn't Know You Were Running", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "50 minute talk", "language": "en", "abstract": "Every MCP talk warns that exposing tools to an LLM is a new attack surface. True, but that's half the story. When we built a production MCP server, the more interesting outcome wasn't the new risk we introduced. It was the old risk we were forced to confront.\n\nPutting an LLM in front of real services means you can no longer trust the caller. You can't assume a well-behaved frontend passes the right tenant ID, or that it hides actions the user shouldn't see. That assumption, that the app in front handles authorization, is one a lot of backends quietly depend on. Building the server correctly meant injecting user permissions at the server layer and enforcing scoping on every tool. Doing that surfaced services that had never been properly authorized. The build became an accidental security audit of the existing application.\n\nThis talk covers what that looks like in practice: why you inject identity and permissions at the server rather than trusting the model; why reusing your existing service layer is both an architecture and a security decision; which tools you should refuse to build; where human-in-the-loop and rate limiting belong; and why we had to split the server off shared compute once agents, not humans, became the primary traffic.\n\nIf you're building or integrating an MCP server, this is the talk on what it will surface in the systems you already have.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "MVETKP", "name": "Zach Fey", "avatar": "https://pretalx.com/media/avatars/8YDTLM_ZiY5AfV.webp", "biography": "Zach Fey is a Staff Engineer who owns the AI platform for a GRC SaaS product, where he built the MCP server infrastructure, semantic search, and RAG systems that put AI in front of production data. He is pursuing his MS in Computer Science at Georgia Tech and writes about applied AI engineering at zachfey.com.", "public_name": "Zach Fey", "guid": "d3e86d73-772a-5763-b0bc-4ae724d91b09", "url": "https://pretalx.com/bsidesatl-2026/speaker/MVETKP/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/TFZAQG/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/TFZAQG/", "attachments": []}, {"guid": "8070237d-a8af-5014-a65b-26da3d95fd1b", "code": "K3AFNS", "id": 103273, "logo": null, "date": "2026-10-03T11:30:00-04:00", "start": "11:30", "end": "2026-10-03T11:50:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103273-unlocking-ai-breaking-the-safeguards-in-open-weight-models", "url": "https://pretalx.com/bsidesatl-2026/talk/K3AFNS/", "title": "Unlocking AI: Breaking the Safeguards in Open-Weight Models", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "Model creators bake safety alignment into open weight models because they do not want to release a personalized Anarchist Cookbook, creating foreseeable harm, public backlash, and legal exposure. Many users want something different: capable models with fewer refusals, fewer restrictions, and less control retained by the developer.\n\nOnce the weights are downloaded, who gets the final say?\n\nThis talk follows the craft of model lockpicking. Researchers have shown that refusal behavior is not an unchangeable property of a model. It is produced by internal mechanisms that can be identified, weakened, and sometimes removed while much of the capability remains intact.\n\nWe will explore the latest research in modifying models to provide less push back or refusals for safety-aligned prompts and what the trade-offs are between refusal reduction and model accuracy.\n\nThis is not another prompt jailbreaking talk. Prompt attacks try to persuade a model to bend its rules. Model lockpicking changes the model itself.\n\nCome see how we in the model-cracking community play a cat and mouse game with open weight model makers today, and why safety aligned may describe only the model as it left the factory.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "JYQ3KY", "name": "Wes Widner", "avatar": "https://pretalx.com/media/avatars/7LVXGU_YK9Ch1o.webp", "biography": "Wes Widner is a Senior Principal Engineer with a background in security, distributed systems, and large scale data infrastructure. He began his career on McAfee\u2019s Global Threat Intelligence team, before data engineering was widely recognized as a discipline, and later became the founding manager of CrowdStrike\u2019s multi cloud team. He now leads strategic engineering initiatives at Cyberhaven.\n\nWes is also the founder of Tensor Lab, a nonprofit AI research organization focused on understanding how modern AI systems actually work, how they fail, and how they can be tested more rigorously. Tensor Lab\u2019s ten person research team investigates open weight models, local inference, model integrity, adversarial behavior, agent security, and the consequences of giving AI systems access to real tools and infrastructure. This talk grew directly out of that research.\n\nHis work focuses on the hidden assumptions inside complex systems, especially the high trust assumptions organizations make when adopting AI agents and third party models. He is particularly interested in model modification, alignment changes, and the gap between how a model behaved when it was released and how it behaves after someone else controls the weights.\n\nTensor Lab is always interested in meeting curious researchers who want to help explore these questions.", "public_name": "Wes Widner", "guid": "73d324cc-51a8-596f-967f-f1ac8708f0e7", "url": "https://pretalx.com/bsidesatl-2026/speaker/JYQ3KY/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/K3AFNS/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/K3AFNS/", "attachments": []}, {"guid": "f5b537ce-6dbf-5b17-9d45-539f6c58ff4b", "code": "FDWJ8L", "id": 103010, "logo": null, "date": "2026-10-03T12:00:00-04:00", "start": "12:00", "end": "2026-10-03T12:50:00-04:00", "duration": "00:50", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103010-your-new-insider-threat-has-an-api-key-identity-and-agentic-ai", "url": "https://pretalx.com/bsidesatl-2026/talk/FDWJ8L/", "title": "Your New Insider Threat Has an API Key: Identity and Agentic AI", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "50 minute talk", "language": "en", "abstract": "Every organization is racing to deploy AI agents. Almost none of them can tell you how those agents authenticate, what they are authorized to access, or how anyone would audit what they did. We spent 30 years building identity and access management for humans and service accounts. Agents break most of those assumptions at once. They act on a user's behalf, they chain calls across systems, and they make decisions no one explicitly approved.\n\nThis talk reframes agentic AI as an identity problem, not a model problem. Drawing on 20 years of enterprise identity architecture and recent work deploying AI in regulated environments, I will cover where the real risk lives: over-permissioned agents, confused-deputy attacks, token sprawl, and the audit gap that makes incident response nearly impossible after the fact.\n\nThen we get practical. I will lay out least-privilege patterns for agents, how to scope and monitor agent identities, and a short checklist defenders can use before any agent reaches production. You will leave able to ask sharper questions about the agents already showing up in your environment.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "8AAVDW", "name": "Charles Wallace", "avatar": "https://pretalx.com/media/avatars/KH3WGG_PTXGUN7.webp", "biography": "Charles Wallace is a Senior FastTrack Architect at Microsoft, focused on healthcare and life sciences. He helps Tier 1 health systems and global pharma deploy Microsoft 365 Copilot and AI agents safely, building the security, identity, and governance foundation that production AI requires. Before Microsoft, he spent two decades in enterprise architecture and identity at massive scale, including large-scale Active Directory consolidations and global migrations. He holds CompTIA Security+, ISC2 CC, and CSA CCSK and CCZT, and is finishing a Cybersecurity degree at Kennesaw State University. He writes regularly about healthcare AI, security, and governance.", "public_name": "Charles Wallace", "guid": "5f2a82da-326a-5fa8-b94b-4abf9fa9589d", "url": "https://pretalx.com/bsidesatl-2026/speaker/8AAVDW/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/FDWJ8L/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/FDWJ8L/", "attachments": []}, {"guid": "e968d1e8-e9ac-579f-abae-723a44c080a4", "code": "GSK9ML", "id": 103676, "logo": null, "date": "2026-10-03T13:00:00-04:00", "start": "13:00", "end": "2026-10-03T13:50:00-04:00", "duration": "00:50", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103676-ai-safety-scores-are-unfalsifiable", "url": "https://pretalx.com/bsidesatl-2026/talk/GSK9ML/", "title": "AI Safety Scores Are Unfalsifiable", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "50 minute talk", "language": "en", "abstract": "Everyone deploying AI agents asks the same question: can these systems be trusted with production access? The industry responds with scores and leaderboards consisting of unauditable assertions from opaque evaluators running unreproducible tests. This talk presents an alternative approach.\n\nI run AI workloads inside a contained execution plane leveraging Firecracker microVMs, closed-world nftables egress, and host-side enforcement to emit a signed evidence artifact for offline verification. The underlying threat model assumes the evaluated workload will achieve guest root and compromise the guest kernel.\n\nI attempted five methodologies to capture guest syscalls from outside the guest: stock VMM, patched Firecracker with KVM guest-debug, host eBPF, sidecar monitoring, and Intel PT. The engineering reality is no such capture can be authoritative under a hostile guest kernel, where process identity and syscall-entry semantics become attacker-authored state. Introspection solves placement rather than attribution. Substrate alteration shifts the architecture along a curve, trading boundary strength for observation fidelity; gVisor detects syscalls because it implements them, thereby expanding the escape surface.\n\nConsequently, I signed the gap instead of concealing it. This architecture treats \"unavailable, not observed\" as a first-class signed state, causes observation loss to fail closed to indeterminate, and invalidates the run upon detected escape or observation-root failure. The pass condition for the adversarial suite is not the absence of a successful exploit, but that no exploit succeed silently. Attendees leave equipped to answer a fundamental telemetry question: what does data look like when the system lies?", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "ZR9S3S", "name": "Scott Bishop", "avatar": "https://pretalx.com/media/avatars/KXNFJS_lrWqVYf.webp", "biography": "With over 25 years of engineering experience, I build mission-critical software for organizations where reliability, accuracy, and compliance are non-negotiable.\n\nMy background spans the public and private sectors. I have engineered solutions for the International Monetary Fund and the U.S. Patent and Trademark Office, architected video infrastructure at Brightcove, and built client-facing systems at Cricket Wireless.\n\nI am currently building Fidensa, which produces verifiable evidence of how an agentic AI system behaves when given real agency inside a contained environment. I also designed and built Cartopian, a filesystem-first protocol that structures project work for humans and AI agents under bounded automation and optional review.", "public_name": "Scott Bishop", "guid": "6b2c0abc-d93a-555d-ae6b-9e0c2bdf552e", "url": "https://pretalx.com/bsidesatl-2026/speaker/ZR9S3S/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/GSK9ML/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/GSK9ML/", "attachments": []}, {"guid": "758f398a-ec7c-5c9d-8559-cb0ab0c036cc", "code": "HWDMAG", "id": 103670, "logo": null, "date": "2026-10-03T14:00:00-04:00", "start": "14:00", "end": "2026-10-03T14:20:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103670-your-ai-assistant-is-an-insider-threat", "url": "https://pretalx.com/bsidesatl-2026/talk/HWDMAG/", "title": "Your AI Assistant Is an Insider Threat", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "Enterprises are bolting AI tools onto their SaaS stack faster than security teams can review them. The threat model most orgs are missing: data sync utilities plus an AI coding assistant equals bulk exfiltration with a long-lived OAuth refresh token and zero admin visibility. This talk covers how a lean enterprise security team built a default-deny enforcement model and an LLM-powered assessment pipeline to govern thousands of OAuth integrations without drowning in manual reviews. Walk away with the governance pattern, the analyst panel + adversarial critic design, and the architectural decisions that make it work at a scale no human-only team can match.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "CJ7EZL", "name": "Gabe Bello", "avatar": "https://pretalx.com/media/avatars/LGLBZY_jM987I5.webp", "biography": "Lead Security Engineer responsible for end to end design and implementation of enterprise-scale products and operations.\n\nAreas of focus:\n- Enterprise and workforce AI security\n- SaaS Security hardening & threat hunting\n- Scaling operations and engineering solutions with automation\n- Security strategy and metrics\n\nCommitted to my community. Ambitious learner and continual student.", "public_name": "Gabe Bello", "guid": "48112679-472f-5742-969d-5ed6c4b3f4d6", "url": "https://pretalx.com/bsidesatl-2026/speaker/CJ7EZL/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/HWDMAG/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/HWDMAG/", "attachments": []}, {"guid": "11f9053c-83f1-5492-9b40-88aa13ff1919", "code": "RQUW77", "id": 103224, "logo": null, "date": "2026-10-03T14:30:00-04:00", "start": "14:30", "end": "2026-10-03T14:50:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103224-context-poisoning-breaking-and-securing-ai-thread-memory", "url": "https://pretalx.com/bsidesatl-2026/talk/RQUW77/", "title": "Context Poisoning: Breaking and Securing AI Thread Memory", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "Standard prompt injections are fleeting, but what happens when an attacker forces an AI agent to permanently remember a malicious instruction? Welcome to context and memory poisoning\u2014the next frontier of LLM vulnerabilities where attacks outlive the active chat session.\n\nIn this fast-paced, 20-minute session, we bypass slide fluff and jump straight into live labs demonstrating how autonomous agents and RAG pipelines can be silently subverted. You will witness a \"sleeping agent\" attack: an indirect injection that poisons an AI\u2019s thread summary, allowing an attacker to trigger delayed data exfiltration long after the initial interaction has ended.\n\nBut we won't leave you undefended. In the second half of this rapid-fire demo, we will pivot to mitigation. We\u2019ll deploy programmatic LLM guardrails and demonstrate the precise architectural boundaries required to intercept and defuse context poisoning before it corrupts your internal data stores.\n\nAttendees will walk away with a clear understanding of persistent AI vulnerabilities and actionable code patterns to secure their organization's AI memory pipelines today.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "7SRLWD", "name": "Avinash Attluri", "avatar": "https://pretalx.com/media/avatars/WSAUVM_av8BTQh.webp", "biography": "Avinash Attluri is a Senior Cyber Analyst specializing in Digital Forensics and Incident Response (DFIR) at At-Bay. With extensive experience guiding organizations through high-stakes security crises\u2014ranging from complex ransomware containment to cloud environment exploitation\u2014he focuses on reconstructing attacker timelines and bringing technical clarity to complex breaches.\n\nPrior to his current role, Avinash served as a Technical Lead and Senior Consultant at firms including CyXcel and Stroz Friedberg. He holds an alumnus status from Georgia State University and carries multiple advanced industry credentials, including GIAC certifications (GCFE, GCFA, GREM). His current research focuses on the intersection of AI Security, Cloud Threat Modeling, advanced forensic telemetry, and leveraging AI and automation to empower modern enterprise defenders.", "public_name": "Avinash Attluri", "guid": "ba433e42-1ef9-5275-b228-40a69898b165", "url": "https://pretalx.com/bsidesatl-2026/speaker/7SRLWD/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/RQUW77/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/RQUW77/", "attachments": []}, {"guid": "0214cdc9-0557-5f9e-82e9-59a8f0fa1ee5", "code": "KC3VNT", "id": 103742, "logo": "https://pretalx.com/media/bsidesatl-2026/submissions/KC3VNT/image_qsaS12T.webp", "date": "2026-10-03T15:00:00-04:00", "start": "15:00", "end": "2026-10-03T15:20:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103742-highway-to-critical-heaven-scaling-vulnerability-discovery-across-hundreds-of-routers", "url": "https://pretalx.com/bsidesatl-2026/talk/KC3VNT/", "title": "Highway to Critical Heaven: Scaling Vulnerability Discovery Across Hundreds of Routers", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "We analyzed hundreds of router firmware images and uncovered numerous critical vulnerabilities, including remote code execution in devices that you might be using at home today. We\u2019ll break down the most significant findings from our project, how they were discovered and validated, and the recurring flaws that appeared across vendors and product lines. We\u2019ll also examine what large scale firmware analysis reveals about the state of consumer router security.\n\nWelcome to critical heaven.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "BR9ZEY", "name": "Vipin B", "avatar": "https://pretalx.com/media/avatars/3CZZDR_ITPwwZZ.webp", "biography": "Security researcher, auditor, and lifelong technology enthusiast. I do R&D and security auditing at Vert3x and co-captain Squid Proxy Lovers, one of the largest competitive CTF teams in the world.", "public_name": "Vipin B", "guid": "79f33b72-7170-5d8f-acfc-de3343933d8e", "url": "https://pretalx.com/bsidesatl-2026/speaker/BR9ZEY/"}, {"code": "8KXGVE", "name": "Stephen G", "avatar": null, "biography": "I am sophomore at Purdue University studying Computer Engineering. I hold OSCP+, CRTO, CRTL certifications and intern for Tesla on the Product Security Team.", "public_name": "Stephen G", "guid": "a61a9957-fd8c-5b2b-a692-a1dc8bc28770", "url": "https://pretalx.com/bsidesatl-2026/speaker/8KXGVE/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/KC3VNT/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/KC3VNT/", "attachments": []}, {"guid": "eac86cb0-7f7b-566c-8c3a-c4eb011ada7a", "code": "MVUPTP", "id": 102966, "logo": null, "date": "2026-10-03T15:30:00-04:00", "start": "15:30", "end": "2026-10-03T15:50:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-102966-hacking-the-process-governance-as-an-attack-surface", "url": "https://pretalx.com/bsidesatl-2026/talk/MVUPTP/", "title": "Hacking the Process: Governance as an Attack Surface", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "When we threat model an application, we map endpoints, look for unpatched dependencies, and scan for leaked credentials. But we consistently ignore the software, processes, and AI agents enforcing the rules. As security organizations aggressively shift to Policy-as-Code and deploy automated RAG-based AI compliance engines to audit frameworks like ISO 27001 or NIST, our governance layer is becoming a highly privileged, highly soft target.\n\nThis talk dissects how attackers exploit predictable corporate milestones and breach the very tooling stacks designed to audit them. We will look at how an adversary can weaponize automated compliance pipelines via document data poisoning and prompt injection to force false-positive checkmarks on insecure architectures. Finally, we will step through how we can harden our operational governance workflows, ensuring our automated gatekeepers aren't turned against us.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "MANCEN", "name": "Isaac Obune", "avatar": "https://pretalx.com/media/avatars/XMTZDN_1LXrtkt.webp", "biography": "Isaac Obune is an AI and Product Security Architect and DBA candidate at Walsh College specializing in the secure design and governance of enterprise AI systems. With a background in product security and generative AI, Isaac focuses on architectural controls, risk modeling, and leadership decision making for LLM based and agentic systems. His work bridges applied industry practice and academic research to help organizations adopt AI safely and responsibly.", "public_name": "Isaac Obune", "guid": "9a80ca53-b3bf-5d2b-aafe-bd0ee96085f5", "url": "https://pretalx.com/bsidesatl-2026/speaker/MANCEN/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/MVUPTP/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/MVUPTP/", "attachments": []}, {"guid": "6e0beb0b-4238-5890-a378-88d5ba12c595", "code": "D8E3HS", "id": 103633, "logo": null, "date": "2026-10-03T16:00:00-04:00", "start": "16:00", "end": "2026-10-03T16:20:00-04:00", "duration": "00:20", "room": "Grand Ballroom", "slug": "bsidesatl-2026-103633-the-security-tool-that-could-leak-your-secrets", "url": "https://pretalx.com/bsidesatl-2026/talk/D8E3HS/", "title": "The Security Tool That Could Leak Your Secrets", "subtitle": "", "track": "Emerging Tech & Infrastructure", "type": "20 minute talk", "language": "en", "abstract": "AI-powered code reviewers need access to the same source code, configuration files, credentials, and business logic they are supposed to protect. Without appropriate safeguards, the security tool itself can become a data-exfiltration risk.\n\nThis talk shares practical lessons from building an open-source AI-assisted SAST auditor that operates through VS Code, the command line, and CI pipelines. We will examine how an agent can scout a codebase, trace authentication and authorization paths across files, verify suspected vulnerabilities, and produce structured findings containing CWE mappings, attack vectors, proof-of-concept steps, verification evidence, and remediation guidance.\n\nWe will also threat-model the auditor itself. Topics include repository sandboxing, secret redaction before model access, prompt injection through source-code comments, false-positive reduction, incomplete coverage, and the limits of static AI analysis.\n\nA short demonstration will show the difference between recognizing suspicious code and verifying an exploitable path. Attendees will leave with a practical checklist for introducing LLM-based tools into application-security workflows without blindly trusting the model or exposing the code those tools are intended to protect.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "DDBBER", "name": "Pranay Singh Suri", "avatar": "https://pretalx.com/media/avatars/CNTBUR_bz604Bs.webp", "biography": "Pranay Singh Suri is a cybersecurity engineer and AI security practitioner with more than three years of experience across security testing, threat modeling, cloud assurance, and governance, risk, and compliance. He currently serves as an Associate Security Engineer at Coalfire Systems, where he conducts web application and network penetration testing, reviews security configurations against NIST 800-53 requirements, and threat-models cloud services and AI systems for FedRAMP environments.\n\nPreviously, Pranay worked at Grant Thornton and Deloitte, leading vendor security assessments, SOC 1 and SOC 2 reviews, IT control testing, and risk-remediation initiatives across financial services, healthcare, and cloud environments.\n\nHe also develops security automation and AI solutions, including CoalHex, an AWS Bedrock\u2013based agentic workflow designed to improve security and compliance support. Pranay has presented on AI security, GRC, security automation, and security engineering at multiple BSides conferences and other industry events.\n\nHe holds a Master of Science in Cybersecurity Analytics and Operations from Penn State and is certified in CISA, ISO 27001 Lead Auditor, CCSK v5, Security+, and eJPT. His interests include penetration testing, cloud security, AI threat modeling, and bridging technical security with enterprise risk and compliance.", "public_name": "Pranay Singh Suri", "guid": "73e73d7f-ba12-53e5-8c1d-dda8b859a481", "url": "https://pretalx.com/bsidesatl-2026/speaker/DDBBER/"}, {"code": "ALEQLY", "name": "Jasmine Sethi", "avatar": "https://pretalx.com/media/avatars/ZHBU9S_uhMehJN.webp", "biography": "Jasmine Kaur Sethi is a Data, AI, and Business Transformation leader with more than a decade of experience helping global organizations modernize decision-making, optimize financial performance, and unlock value through analytics, automation, and emerging technologies.\n\nAs an Operations Research Advisor at FedEx Freight, Jasmine serves as a trusted advisor to senior business and technology leaders across Finance, Pricing, Operations, and Technology. She leads enterprise initiatives spanning profitability analytics, data modernization, cost optimization, governance, and AI-enabled decision support, influencing strategic decisions across North American operations. Her work supports large-scale transportation networks and complex financial ecosystems, driving measurable improvements in efficiency, transparency, and business performance.\n\nPrior to FedEx, Jasmine was a Senior Consultant with Deloitte, where she partnered with Fortune 500 executives to deliver analytics-driven transformation, technology modernization, and process improvement initiatives. Throughout her career, she has successfully led cross-functional teams, translated complex business challenges into actionable strategies, and delivered scalable solutions that align technology investments with organizational goals.\n\nJasmine holds a Master of Science in Business Analytics from The University of Texas at Dallas and is a passionate advocate for responsible AI, data-driven leadership, and business transformation, Jasmine frequently speaks on the intersection of analytics, artificial intelligence, operational excellence, and enterprise strategy. Her work focuses on helping organizations leverage emerging technologies to solve complex challenges, strengthen resilience, and create sustainable competitive advantage.", "public_name": "Jasmine Sethi", "guid": "c2eb0a15-b219-572f-9bde-5940ea40f8f5", "url": "https://pretalx.com/bsidesatl-2026/speaker/ALEQLY/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/D8E3HS/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/D8E3HS/", "attachments": []}, {"guid": "0af6dc15-9404-598b-9ba8-c782599cf86b", "code": "SAEG8F", "id": 105516, "logo": null, "date": "2026-10-03T16:30:00-04:00", "start": "16:30", "end": "2026-10-03T17:00:00-04:00", "duration": "00:30", "room": "Grand Ballroom", "slug": "bsidesatl-2026-105516-organizers-closing-remarks-and-giveaways", "url": "https://pretalx.com/bsidesatl-2026/talk/SAEG8F/", "title": "Organizers Closing Remarks and Giveaways", "subtitle": "", "track": null, "type": "Organizers remarks", "language": "en", "abstract": "Time to end the day by giving stuff away, then get to the after-party!", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "JWVVFC", "name": "Steve Ripple", "avatar": null, "biography": "It's me, Ripple.", "public_name": "Steve Ripple", "guid": "f8206e4f-af84-5495-91d2-1b69e7221f54", "url": "https://pretalx.com/bsidesatl-2026/speaker/JWVVFC/"}, {"code": "KX9ECP", "name": "Scott Stanton", "avatar": "https://pretalx.com/media/avatars/ANFDRY_Bpa2vsX.webp", "biography": "Scott Stanton has been a cybersecurity practitioner for over 20 years, with technical roles spanning software development, infrastructure, cloud, and security. He currently leads the cybersecurity and data privacy program for JAS Worldwide, a global freight logistics provider.\n\nPrior to JAS, Stanton was BISO and Director of Threat & Vulnerability Management at Owens & Minor, CISO at Halyard Health/Avanos Medical, and was a security architect at Cisco Systems.  He also served in technical security roles for Scientific-Atlanta, Coca-Cola, and General Electric.  He holds a BA in Computer Science from the State University of New York at Albany.", "public_name": "Scott Stanton", "guid": "abdc66c1-1c65-5b79-a922-ea6de56f5c6c", "url": "https://pretalx.com/bsidesatl-2026/speaker/KX9ECP/"}, {"code": "HAWEPJ", "name": "Dr. Andy Green", "avatar": "https://pretalx.com/media/avatars/avatar_o2EHlFG.webp", "biography": "Andrew W. (Andy) Green, Ph.D., is an Associate Professor of Information Security and Assurance in the Department of Information Systems and Security at the Michael J. Coles College of Business at Kennesaw State University. He directs the KSU Cyber Range at Coles College and serves as the faculty advisor for the Orthodox Christian Fellowship (OCF) Club at KSU. Green also chairs the Parish Cybersecurity Committee of the Greek Orthodox Archdiocese of America.\n\nBefore transitioning to full-time academia, Green spent more than twenty years in cybersecurity. His experience includes cybersecurity and IT consulting for small- to mid-sized businesses, as well as earlier work in healthcare IT, where he developed and supported transcription interfaces used by medical facilities across the U.S.\n\nGreen\u2019s academic research examines the connections between information security, privacy, and public policy. His work has appeared in leading peer-reviewed journals, and he has co-authored several textbooks used in university courses worldwide. He also provides expert analysis and commentary on cybersecurity for various media outlets.\n\nHe currently serves as President of the Special Interest Group on Information Security and Privacy (SIG SEC) within the Association for Information Systems (AIS), an international association of information systems scholars that named him a Distinguished Member in 2025.\n\nGreen has been a BSides Atlanta organizer since 2018.", "public_name": "Dr. Andy Green", "guid": "75e3c1be-ab31-529d-85bf-f0a3e0f088bd", "url": "https://pretalx.com/bsidesatl-2026/speaker/HAWEPJ/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/SAEG8F/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/SAEG8F/", "attachments": []}], "Conference A": [{"guid": "6319ef2d-1a42-5f1a-9878-eba38d5bf47f", "code": "BU37QR", "id": 103668, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T09:50:00-04:00", "duration": "00:20", "room": "Conference A", "slug": "bsidesatl-2026-103668-ghosts-in-google-workspace-apps-script-hunting-and-detection-engineering", "url": "https://pretalx.com/bsidesatl-2026/talk/BU37QR/", "title": "Ghosts in Google Workspace: Apps Script Hunting and Detection Engineering", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "20 minute talk", "language": "en", "abstract": "Third-party Google Workspace integrations are everywhere, and so are the breaches. Over the past two years, attackers have repeatedly shown that productivity integrations are a reliable path into an enterprise: they carry broad OAuth scopes, they're trusted by users, and they rarely get scrutinized by security teams.\n\nWhat most organizations haven't inventoried is Google Apps Script, the JavaScript runtime embedded in those integrations and in scripts your own employees are building. It runs in Google's cloud with your users' OAuth tokens, calls external URLs, and executes on a schedule. None of that shows up in your EDR, passes through a code review, or triggers a CASB alert.\n\nThis talk covers what that attack surface looks like from both sides.\n\nWe start with a supply chain compromise scenario: a Google Marketplace integration that uses Apps Script as remote code execution to exfiltrate Workspace data, propagate itself internally through Drive sharing, and bypass email security controls. The twist is that this attack doesn't require traditional OAuth consent phishing. It rides on scopes the target organization already granted to a legitimate-looking productivity tool.\n\nThen we flip to the defender's side. We walk through three hunting primitives that work today: access_url audit events for detecting external script calls, code analysis via the Apps Script API and Drive enumeration, and a severity ranking framework for prioritizing what to investigate first.\n\nWe also cover the real limitations, and what you can do despite them.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "CJ7EZL", "name": "Gabe Bello", "avatar": "https://pretalx.com/media/avatars/LGLBZY_jM987I5.webp", "biography": "Lead Security Engineer responsible for end to end design and implementation of enterprise-scale products and operations.\n\nAreas of focus:\n- Enterprise and workforce AI security\n- SaaS Security hardening & threat hunting\n- Scaling operations and engineering solutions with automation\n- Security strategy and metrics\n\nCommitted to my community. Ambitious learner and continual student.", "public_name": "Gabe Bello", "guid": "48112679-472f-5742-969d-5ed6c4b3f4d6", "url": "https://pretalx.com/bsidesatl-2026/speaker/CJ7EZL/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/BU37QR/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/BU37QR/", "attachments": []}, {"guid": "0071b189-fc6d-583c-af9f-388cd66e54dc", "code": "9PVLWN", "id": 103158, "logo": null, "date": "2026-10-03T10:00:00-04:00", "start": "10:00", "end": "2026-10-03T10:50:00-04:00", "duration": "00:50", "room": "Conference A", "slug": "bsidesatl-2026-103158-ghost-in-the-powerlines-detecting-dnp3-attacks-before-the-grid-goes-dark", "url": "https://pretalx.com/bsidesatl-2026/talk/9PVLWN/", "title": "Ghost in the Powerlines: Detecting DNP3 Attacks Before the Grid Goes Dark", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "50 minute talk", "language": "en", "abstract": "Critical infrastructure such as power grids were built for reliability to minimize equipment failure or downtime to the communities they supply. Consequently, power grids often are equipped with decades-old legacy systems with minimal consideration to cyber security. Moreover, power grids leverage protocols that are insecure by design such as DNP3, a protocol essential for power grid communication between SCADA systems and field devices within substations. As cyber attacks targeting critical infrastructure are on the rise, leveraging machine learning for anomaly detection has become a growing initiative in defending power grid communication. This talk presents empirical research evaluating nine classical and deep learning models for DNP3 anomaly detection, deployed and benchmarked on a physical edge device under real hardware constraints. Results challenge the assumption that deep learning is inherently superior for OT detection, with classical models outperforming deep learning on both accuracy and inference speed by over 600 times on physical edge hardware. These findings carry broader implications for how organizations assess their critical infrastructure risk posture, particularly around the assumptions made about detection coverage in operational hardware environments. Furthermore it explores where behavioral detection falls short and why a layered defense strategy that accounts for specific threat categories remains essential for comprehensive DNP3 network protection.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "EF8VSS", "name": "Tiffanie Fix", "avatar": "https://pretalx.com/media/avatars/W9RRUG_3IZprTh.webp", "biography": "Tiffanie Fix is an Incident Response Consultant for IBM X-Force specializing in Digital Forensics and Incident Response (DFIR) and Operational Technology (OT)/Cyber-Physical system (CPS) security. She holds a Bachelor of Science in Cyber Security Engineering from Iowa State University and is currently pursuing a Master of Science in Cyber security Engineering. She has research experience in connected vehicle/V2X technology, cryptographic cache-based side-channel attacks, and smart grid technology.", "public_name": "Tiffanie Fix", "guid": "e4462bd8-fd5d-50d7-a1ad-d6a8a771811b", "url": "https://pretalx.com/bsidesatl-2026/speaker/EF8VSS/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/9PVLWN/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/9PVLWN/", "attachments": []}, {"guid": "8f6e894e-4f04-5a4d-850a-a3a5fc3bfa86", "code": "373KAC", "id": 103708, "logo": null, "date": "2026-10-03T11:00:00-04:00", "start": "11:00", "end": "2026-10-03T11:50:00-04:00", "duration": "00:50", "room": "Conference A", "slug": "bsidesatl-2026-103708-agents-on-alert-where-ai-actually-works-in-the-soc", "url": "https://pretalx.com/bsidesatl-2026/talk/373KAC/", "title": "Agents on Alert: Where AI Actually Works in the SOC", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "50 minute talk", "language": "en", "abstract": "Everyone's selling the \"autonomous SOC.\" Few are honest about where AI genuinely works in security operations versus where it quietly breaks.\n\nThis talk walks the incident response loop \u2014 See, Understand, Decide, Act \u2014 with a blunt verdict on each stage. AI is strong at investigation and enrichment, barely scratching detection engineering, and mostly wishful thinking on autonomous response.\n\nThe centerpiece is a live investigation: a Snowflake Cortex agent triaging a real attack scenario against a well-architected security data lake. You'll watch it reach a verdict \u2014 and watch where it gets fooled. I'll work the same alert myself so you can judge for yourself.\n\nYou'll leave knowing what to delegate to agents, what never to, and how to tell a real AI-SOC capability from a slide. Because when AI calls a threat benign, you can't fire the agent. A human still answers for it.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "HGU3AL", "name": "Samson Adewale", "avatar": "https://pretalx.com/media/avatars/KJBJ9K_KEmBKlz.webp", "biography": "Samson Adewale is a Senior Security Engineer, specializing in threat response and automation. He has led initiatives building automated forensics labs and response frameworks in cloud environments. With a background spanning AWS, Azure, and DevSecOps, Samson is passionate about practical applications of AI to reduce operational overhead and enhance security resilience.", "public_name": "Samson Adewale", "guid": "99d7741f-1b30-59af-b614-672643911c5e", "url": "https://pretalx.com/bsidesatl-2026/speaker/HGU3AL/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/373KAC/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/373KAC/", "attachments": []}, {"guid": "8b53dd9f-f182-5315-a80e-e3c76c7bb307", "code": "VX3ULE", "id": 103740, "logo": null, "date": "2026-10-03T13:00:00-04:00", "start": "13:00", "end": "2026-10-03T13:20:00-04:00", "duration": "00:20", "room": "Conference A", "slug": "bsidesatl-2026-103740-how-to-be-wrong-faster-testing-assumptions-during-incident-response", "url": "https://pretalx.com/bsidesatl-2026/talk/VX3ULE/", "title": "How to Be Wrong Faster: Testing Assumptions During Incident Response", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "20 minute talk", "language": "en", "abstract": "During an incident, teams are rarely short on information. They are short on a shared way to distinguish what they have observed from what they merely suspect. Alerts, dashboards, chat messages, and expert opinions arrive at different speeds, allowing a plausible explanation to harden into \u201cthe cause\u201d before the team has tested it.\n\nThis talk examines how premature certainty shapes incident response and introduces a lightweight incident reasoning exercise for making assumptions easier to see and revise. Through a short, evolving scenario, attendees will explore how to separate observation from interpretation, preserve competing explanations, surface contradictory evidence, and identify which unknowns matter most to the next decision.\n\nThe exercise is designed to work without new software and can be adapted for tabletop exercises, incident reviews, or live response. It does not attempt to tell responders what decision to make. Instead, it gives teams a shared structure for examining how they reached their current understanding and what evidence would cause them to revise it.\n\nAttendees will leave with practical prompts and a reusable exercise they can test with their own teams.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "BQJJLB", "name": "Brooke Roenitz", "avatar": "https://pretalx.com/media/avatars/EV78HS_pZzZatb.webp", "biography": "Brooke Roenitz has a background spanning implementation consulting, project management, crisis communications, and business resilience. She previously worked at CrowdStrike, holds an MBA from Georgia Tech, an MS in Logistics and Supply Chain Management, and is currently building Kestrail, a live reasoning workspace for incident teams.", "public_name": "Brooke Roenitz", "guid": "a4edc6f2-ab02-5b63-9568-4f05eed506cb", "url": "https://pretalx.com/bsidesatl-2026/speaker/BQJJLB/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/VX3ULE/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/VX3ULE/", "attachments": []}, {"guid": "ef733513-31f9-5b8d-93f7-8074a0c0cebf", "code": "YJCJAC", "id": 103237, "logo": "https://pretalx.com/media/bsidesatl-2026/submissions/YJCJAC/image_Po9oZ2N.webp", "date": "2026-10-03T13:30:00-04:00", "start": "13:30", "end": "2026-10-03T13:50:00-04:00", "duration": "00:20", "room": "Conference A", "slug": "bsidesatl-2026-103237-the-faceless-doppelganger-the-evolution-of-a-malicious-residential-proxy-network", "url": "https://pretalx.com/bsidesatl-2026/talk/YJCJAC/", "title": "The Faceless Doppelganger: The Evolution of a Malicious Residential Proxy Network", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "20 minute talk", "language": "en", "abstract": "Malicious residential proxy networks have become a crucial part of modern cybercrime infrastructure, offering threat actors anonymity and disguising malicious activity. This talk traces the continued evolution of a malicious proxy networks and how it attempt to evade detection.\n\nWe begin by discussing what proxy networks are, the differences between benign and malicious proxies, and how a malicious proxy service evolved to hide from defenders. Then we will cover Faceless, a malicious proxy network; and TheMoon, the malware family that targeted IoT devices to feed the malicious network. \n\nNext we will cover the Doppelganger proxy service and Kadnap, the sophisticated new malware family that uses a custom implementation of the Kademlia Distributed Hash Table (DHT) protocol to hide C2 infrastructure within the noise of legitimate peer-to-peer traffic.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "JKU7BR", "name": "crudd", "avatar": "https://pretalx.com/media/avatars/B8XNAH_44jjhqU.webp", "biography": "Steve \"crudd\" Rudd is a Senior Lead Information Security Engineer at Lumen Technologies\nresponsible for reverse engineering malware samples across a wide variety of architectures and\noperating systems from a broad range of threats, including cybercriminals, ransomware\noperators and APTs. A self-taught practitioner, Steve is passionate about understanding how\nthings work and digging into low-level assembly, operating system internals and network\nprotocols. He is rumored to have been used by EA sports as the character for their 1987\nskateboarding game for the Commodore 64. Uncredited, of course.", "public_name": "crudd", "guid": "84c76805-a84a-520b-922f-cadcd65741cb", "url": "https://pretalx.com/bsidesatl-2026/speaker/JKU7BR/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/YJCJAC/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/YJCJAC/", "attachments": []}, {"guid": "c7307f6f-65c9-53bd-b458-905020901456", "code": "9KQCEB", "id": 103428, "logo": null, "date": "2026-10-03T14:00:00-04:00", "start": "14:00", "end": "2026-10-03T14:20:00-04:00", "duration": "00:20", "room": "Conference A", "slug": "bsidesatl-2026-103428-the-internet-never-forgets-what-dns-reveals-about-you", "url": "https://pretalx.com/bsidesatl-2026/talk/9KQCEB/", "title": "The Internet Never Forgets: What DNS Reveals About You", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "20 minute talk", "language": "en", "abstract": "Before an attacker scans a single IP address or sends the first phishing email, they often know far more about your organization than most defenders realize, starting with nothing more than a domain name.\n\nDNS is much more than a naming system. It exposes an organization\u2019s Internet presence in ways defenders may overlook. Every forgotten subdomain, cloud migration, delegated zone, certificate, and trust relationship contributes another chapter to your organization\u2019s Internet story.\n\nUsing three real-world incidents, we\u2019ll demonstrate how DNS reveals what you forgot, who you trust, what you built, and how attackers turn those clues into actionable intelligence.\n\nWe\u2019ll examine Hazy Hawk\u2019s abuse of dangling CNAME records, the Sea Turtle campaign\u2019s exploitation of DNS trust relationships, and research demonstrating how Certificate Transparency logs expose newly created Internet infrastructure within minutes of deployment.\n\nAttendees will leave with a new perspective on what their own DNS reveals and how attackers use publicly available Internet information long before they make their first move.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "L83RCM", "name": "Keith Thomas", "avatar": "https://pretalx.com/media/avatars/HUWLU3_nYW5Tw5.webp", "biography": "Keith Thomas is a cybersecurity leader with more than 25 years of experience in information technology and over 15 years focused on cybersecurity, cloud, and Internet infrastructure. His background spans security operations, incident response, cloud transformation, enterprise architecture, and cybersecurity consulting for Fortune 500 organizations across multiple industries.\n\nThroughout his career, Keith has helped organizations improve cyber resilience by securing complex environments, modernizing infrastructure, and aligning security operations with business objectives. His work has included cloud security, identity and access management, network security, security operations, governance, and emerging technologies.\n\nKeith is an active contributor to the cybersecurity community, serving as President of the Cloud Security Alliance (CSA) Atlanta Chapter and speaking regularly on topics including cloud security, operational resilience, and Internet infrastructure. He has presented at industry conferences and security events, sharing practical approaches that help organizations better understand and defend their digital environments.\n\nHis current research focuses on how publicly available Internet infrastructure, including DNS, certificates, and trust relationships, can be analyzed to improve organizational visibility, strengthen security posture, and better understand the techniques attackers use to build operational intelligence.", "public_name": "Keith Thomas", "guid": "b77987d2-b8c0-53c0-9dd2-fb4fe350ab50", "url": "https://pretalx.com/bsidesatl-2026/speaker/L83RCM/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/9KQCEB/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/9KQCEB/", "attachments": []}, {"guid": "879a363c-3fa0-5b95-81fb-ead6594c7ed3", "code": "W8YDLR", "id": 102944, "logo": null, "date": "2026-10-03T14:30:00-04:00", "start": "14:30", "end": "2026-10-03T15:20:00-04:00", "duration": "00:50", "room": "Conference A", "slug": "bsidesatl-2026-102944-the-most-valuable-asset-you-re-likely-under-protecting", "url": "https://pretalx.com/bsidesatl-2026/talk/W8YDLR/", "title": "The Most Valuable Asset You're Likely Under-Protecting", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "50 minute talk", "language": "en", "abstract": "Security teams invest heavily in endpoint, network, and cloud - but source code repositories remain one of the most under-protected assets in the enterprise. Your repos aren't just code: they contain proprietary logic, hardcoded secrets, infrastructure-as-code, CI/CD pipelines, and deployment keys. They're the blueprint to everything. And attackers know it.\n\nThis talk breaks down how adversaries actually target source code platforms: from compromised personal access tokens and CI/CD pipeline poisoning to secrets sprawl, supply chain attacks, and over-permissioned insiders - and walks through a practical, layered defense framework any security team can act on.\n\nWe'll cover five layers of defense: identity and access controls, repository hardening, CI/CD pipeline security, secrets detection and response, and audit log-driven monitoring and detection. Each layer includes concrete, actionable guidance: what to configure, what to alert on, and what \"good\" looks like.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "HCVVSV", "name": "Jorge Lopez", "avatar": "https://pretalx.com/media/avatars/TD7GEM_KXRdviX.webp", "biography": "Jorge leads the Security Operations and Trust & Safety teams at GitLab,  encompassing the SIRT, Detection Engineering, Threat Intelligence, Security Logging, Red team and Trust and Safety teams. Prior to GitLab, he Security Operations and Response teams at Zoom and Peloton, held several security and non-security roles at Microsoft, and piloted a desk in the US Air Force. Jorge hails from Puerto Rico, but has lived in ten different cities before relocating to the Alpharetta area in 2021.", "public_name": "Jorge Lopez", "guid": "9491c90e-16a5-5319-8f0e-a18a984ae085", "url": "https://pretalx.com/bsidesatl-2026/speaker/HCVVSV/"}, {"code": "LKXS7P", "name": "Matt Coons", "avatar": null, "biography": "Matt Coons is the head of Detection Engineering, Threat Hunting, and Trust and Safety at GitLab. Matt has an undergraduate degree from Defiance College in Digital Forensic Science and a master's degree from Champlain University in Information Security Operations. Matt has a diverse cybersecurity background with experience working within the healthcare, professional services and higher education sectors.", "public_name": "Matt Coons", "guid": "f3fb7ea8-5d41-5cbe-a698-2976780bb992", "url": "https://pretalx.com/bsidesatl-2026/speaker/LKXS7P/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/W8YDLR/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/W8YDLR/", "attachments": []}, {"guid": "59bb4b5e-94db-5b38-92d9-b09eb887e075", "code": "RSLGEX", "id": 103017, "logo": null, "date": "2026-10-03T15:30:00-04:00", "start": "15:30", "end": "2026-10-03T16:20:00-04:00", "duration": "00:50", "room": "Conference A", "slug": "bsidesatl-2026-103017-so-crates-a-new-foss-tool-for-analyzing-pcaps-binaries-and-logs", "url": "https://pretalx.com/bsidesatl-2026/talk/RSLGEX/", "title": "SO-CRATES: A New FOSS Tool for Analyzing Pcaps, Binaries, and Logs", "subtitle": "", "track": "Defensive Strategies & Operations", "type": "50 minute talk", "language": "en", "abstract": "Have you ever been looking at a pcap in Wireshark and gotten overwhelmed by the sheer number of packets? Wireshark is a great tool but looking at network traffic packet by packet often results in losing the plot of the story. It's much easier to read a story if it has chapters, a table of contents, and an index.\n\nSO-CRATES is a new free and open source project that can help you tell the story whether you are analyzing pcaps, binaries, or log files. Designed from first principles, it's a single container image that is simple yet tremendously powerful. In this talk, we'll discuss the reasons for building a new tool, how it compares to existing tools, and then see how you can view network alerts, file alerts, and log alerts. We'll then dive deeper into browsing network metadata (DNS, HTTP, TLS, flows), extracting ASCII transcripts, viewing per-packet hexdumps, and carving individual streams.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "YAL99X", "name": "Doug Burks", "avatar": null, "biography": "Doug Burks started Security Onion in 2008 to provide a comprehensive platform to help folks peel back the layers of their enterprise and make their adversaries cry. Today, Security Onion has over 2,500,000 downloads and is being used by organizations around the world for threat hunting, enterprise security monitoring, and log management. In 2014, Doug started Security Onion Solutions LLC to help those organizations by providing training, professional services, and hardware appliances. Doug is a CEO, public speaker, teacher, former president of the Greater Augusta ISSA, and co-founder of BSides Augusta, but what he really likes the most is catching bad guys.", "public_name": "Doug Burks", "guid": "37dd0115-a37a-500d-981a-6a414c5d47fd", "url": "https://pretalx.com/bsidesatl-2026/speaker/YAL99X/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/RSLGEX/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/RSLGEX/", "attachments": []}], "Conference B": [{"guid": "837d8ab8-2c50-5290-bd8d-ffa32c615408", "code": "TSLMJA", "id": 102976, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T10:20:00-04:00", "duration": "00:50", "room": "Conference B", "slug": "bsidesatl-2026-102976-the-sector-everyone-ignores-why-k-12-is-critical-infrastructure-and-what-we-can-learn-from-it", "url": "https://pretalx.com/bsidesatl-2026/talk/TSLMJA/", "title": "The Sector Everyone Ignores: Why K-12 Is Critical Infrastructure and What We Can Learn From It", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "50 minute talk", "language": "en", "abstract": "Strip away the crayon drawings and here is what K-12 in the U.S. is: an enterprise network serving tens of millions of users, holding Social Security numbers, medical records, disability status, and behavioral data on children, staffed by people whose primary job is not security, under near-constant attack. One breach in 2024 exposed the records of 60 million students and 10 million teachers in a single hit. The sector gets compromised at a rate most industries would declare a national emergency. Nobody is talking about it.\n\nThis talk draws on the experience of defending a large urban district serving over 92,000 students, 14,000 staff, and 138 schools. It makes the case that K-12 is not a niche problem. It is the most honest stress test available for defending a high-value, data-rich environment with enterprise-scale exposure and a fraction of enterprise-level resources. The threat patterns, governance failures, defender strategies, and hard lessons from K-12 translate directly to any organization doing more with less.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "JHN9QS", "name": "Eric Logan", "avatar": "https://pretalx.com/media/avatars/Q8PXSF_0AJ0k7g.webp", "biography": "Eric M. Logan brings over 26 years of dedicated experience in IT and cybersecurity across K-12 and higher education environments. Currently serving as Director of Information & Network Security for DeKalb County School District, Eric leads the district's cybersecurity transformation, having built their first dedicated security team and launched innovative programs like Cyber Champions, which empowers students to become peer leaders in digital safety.\n\nHis career spans prestigious institutions including Georgia Tech Research Institute, where he served as Cybersecurity Operations Manager and later as Governance, Risk & Compliance Manager, and Emory University, where he provided technical expertise to researchers and managed campus-wide technology systems. Eric's unique perspective combines hands-on technical expertise with strategic leadership and a genuine passion for education.\n\nBased in Thomaston, Georgia, Eric is deeply involved in professional organizations including ISSA, ISACA, and FBI InfraGard, and believes in building bridges between technical expertise and practical application in educational settings.", "public_name": "Eric Logan", "guid": "93610223-920a-543b-b68b-380100d29555", "url": "https://pretalx.com/bsidesatl-2026/speaker/JHN9QS/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/TSLMJA/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/TSLMJA/", "attachments": []}, {"guid": "fbb08026-abd9-53b6-98bf-54a717bebaad", "code": "YRSV9Z", "id": 103629, "logo": null, "date": "2026-10-03T10:30:00-04:00", "start": "10:30", "end": "2026-10-03T10:50:00-04:00", "duration": "00:20", "room": "Conference B", "slug": "bsidesatl-2026-103629-iso-42001-in-the-real-world-i-actually-implemented-the-ai-standard-so-you-don-t-have-to-guess", "url": "https://pretalx.com/bsidesatl-2026/talk/YRSV9Z/", "title": "ISO 42001 in the Real World: I Actually Implemented the AI Standard So You Don't Have to Guess", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "20 minute talk", "language": "en", "abstract": "There's a new standard for managing AI responsibly, ISO 42001, and right now it's mostly talked about by people who haven't actually done it. I have. This is the honest, jargon-free field report.\n\nPublished in late 2023, ISO 42001 is the world's first international standard for an AI Management System. Think of it as \"ISO 27001, but for AI\": a structured way for an organization to prove it's using AI responsibly, manage AI-specific risks like bias and data misuse, and stay ahead of fast-moving regulation. With roughly 1 in 5 organizations already using AI and regulators circling, it's about to matter a lot.\n\nBut what does implementing it actually involve? In this talk I'll demystify the standard in plain English, what it is, how it's structured, and the 38 controls everyone asks about, and then walk through our real implementation: where we started, what was genuinely hard, where auditors focus, and where most organizations trip up. No certification-body sales pitch, no acronym soup. You'll leave able to explain ISO 42001 to your boss, judge whether your organization should pursue it, and take a concrete first step if the answer is yes.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "RABJ8Y", "name": "Randy Hanooman", "avatar": "https://pretalx.com/media/avatars/Q3CERW_3sDtu9X.webp", "biography": "Randy is a security practitioner who leads hands-on AI initiatives inside their organization, spanning vulnerability management automation, enterprise AI platform deployment, and AI governance. They led a real-world ISO 42001 implementation from the ground up, working alongside cross-functional teams to build the policies, controls, and processes required to responsibly govern AI at scale. Coming from a security background rather than a traditional software engineering path, they bring a practical, no-nonsense perspective to a fast-moving space, focused on what actually works when the theory meets a real audit, a real rollout, and a real deadline.", "public_name": "Randy Hanooman", "guid": "adc35e28-8f8c-5466-92fa-c0a34ca047ec", "url": "https://pretalx.com/bsidesatl-2026/speaker/RABJ8Y/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/YRSV9Z/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/YRSV9Z/", "attachments": []}, {"guid": "5c7bd585-dde0-5429-96d2-15f51bf71482", "code": "9GYQYG", "id": 103669, "logo": "https://pretalx.com/media/bsidesatl-2026/submissions/9GYQYG/image_jrvSdF6.webp", "date": "2026-10-03T11:00:00-04:00", "start": "11:00", "end": "2026-10-03T11:50:00-04:00", "duration": "00:50", "room": "Conference B", "slug": "bsidesatl-2026-103669-threat-modeling-decisions-instead-of-models-a-practical-framework-for-securing-agentic-ai", "url": "https://pretalx.com/bsidesatl-2026/talk/9GYQYG/", "title": "Threat Modeling Decisions Instead of Models: A Practical Framework for Securing Agentic AI", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "50 minute talk", "language": "en", "abstract": "Everyone is performing threat modeling for the LLM. Almost no one is doing threat modeling for the decisions made by AI agents.\n\nModern AI systems do not just create text anymore. They make plans use tools get memory, run code connect to APIs and take actions, onbehalf of users. Every choice brings trust points and ways for attacks that traditional application threat modeling usually misses.\n\nIn this session we will go through an example of an agentic system and do a full threat modeling process from the point of view of an attacker. We will find assets, trust points, attacker goals and misuse scenarios before listing threats using STRIDE, MAESTRO, MITRE ATLAS and the OWASP Agentic AI recommendations. Then we will turn those results into security steps that engineering teams can use before launching.\n\nParticipants will walk away with a method they can use again and again for checking AI agent systems finding the important places where attacks can happen and putting threat modeling into secure AI development.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "MLJLKZ", "name": "Akansha Kesharwani", "avatar": "https://pretalx.com/media/avatars/E9W87V_TEhtnIz.webp", "biography": "Akansha Kesharwani is a Security Engineer with nearly six years of experience helping organizations build secure software. Her work spans application security, penetration testing, vulnerability management, secure design reviews, and AI security, with a growing focus on securing agentic AI systems.\n\nShe enjoys breaking down complex security concepts into practical techniques that engineers can apply in their day-to-day work. Her current research explores threat modeling for AI agents, secure AI development, and how traditional AppSec practices can evolve to address emerging AI architectures.\n\nOutside of her professional work, Akansha actively contributes to the security community through technical writing, mentoring, and creating educational content focused on application and AI security.", "public_name": "Akansha Kesharwani", "guid": "fdcec7be-5bc1-5912-95ff-2fe9608171da", "url": "https://pretalx.com/bsidesatl-2026/speaker/MLJLKZ/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/9GYQYG/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/9GYQYG/", "attachments": []}, {"guid": "cf844aea-b1d2-5c41-8010-affa64c66fc2", "code": "KPFQBX", "id": 102934, "logo": "https://pretalx.com/media/bsidesatl-2026/submissions/KPFQBX/image_ai0bMEh.webp", "date": "2026-10-03T12:00:00-04:00", "start": "12:00", "end": "2026-10-03T12:20:00-04:00", "duration": "00:20", "room": "Conference B", "slug": "bsidesatl-2026-102934-nine-seconds-the-ai-governance-gaps-nobody-s-naming", "url": "https://pretalx.com/bsidesatl-2026/talk/KPFQBX/", "title": "Nine Seconds: The Ai Governance Gaps Nobody\u2019s Naming", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "20 minute talk", "language": "en", "abstract": "\"It took 9 seconds\" wrote Jer Crane, founder of PocketOS, after an Ai coding agent deleted his company's entire production database and all backups in a single API call, despite explicit instructions no to. The same month, two more incidents made headlines. Same failure pattern every time, broad credentials, no confirmation gates, and systems designed as if a human is always in the loop. \n\nAi adoption is moving faster than governance can follow. Security and GRC teams are being left out of the conversations. This session puts them back in it.\n\nDrawing from named, published incidents and mapped directly to NIST AI RMF and NIST Generative AI Profile (AI 600-1), this talk introduces my own actionable AI governance methodology.\n\nYou'll leave with a framework you can implement Monday morning, not a document you'll hope to be able to get to read someday. Because someday already happened. It took nine seconds.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "8Y9RGA", "name": "Shikirra Williams", "avatar": "https://pretalx.com/media/avatars/FDEQD3_tV6hS5c.webp", "biography": "Shikirra is a security analyst transitioning to a GRC practitioner with hands-on experience across SOC operations, incident triage, and compliance framework development in a multi-tenant MSP environment. \n\nAs founder of ShiDoesCyber, she built a platform dedicated to making cybersecurity knowledge honest, accessible, and actionable.\n\nShe brings a practitioner\u2019s perspective to the AI governance conversation, not theory, but the view from someone who has done alert triage, built risk registers, and watched AI adoption happen in real client environments without governance frameworks in sight. This is her first conference talk submission. \n\nShe built it the same way she builds everything: starting from what she actually observed, anchoring it in primary source documentation, and making it useful for the people in the room.", "public_name": "Shikirra Williams", "guid": "62e95b43-bc8d-5d7b-91ac-2d5df770d057", "url": "https://pretalx.com/bsidesatl-2026/speaker/8Y9RGA/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/KPFQBX/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/KPFQBX/", "attachments": []}, {"guid": "aa00a4ca-e783-57b8-848b-fa40368455bc", "code": "A8XX3K", "id": 103554, "logo": null, "date": "2026-10-03T12:30:00-04:00", "start": "12:30", "end": "2026-10-03T12:50:00-04:00", "duration": "00:20", "room": "Conference B", "slug": "bsidesatl-2026-103554-human-in-the-loop-is-not-human-governance", "url": "https://pretalx.com/bsidesatl-2026/talk/A8XX3K/", "title": "Human-in-the-Loop Is Not Human Governance", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "20 minute talk", "language": "en", "abstract": "AI security teams are being asked to trust systems that triage alerts, write code, classify risk, open tickets, call tools, and recommend action. The usual safety phrase is \u201chuman-in-the-loop.\u201d But a human in the loop is not the same as a human in control.\n\nThis talk examines the human control layer behind AI-enabled security workflows. I will show how AI governance fails before the model fails: unclear decision rights, weak escalation paths, overloaded reviewers, missing override authority, and governance latency, the gap between machine-speed action and human-speed accountability.\n\nUsing practical examples from security operations, vulnerability management, AI coding tools, and enterprise governance, we will ask a simple question: if the AI system is wrong, unexpected, or correct in isolation but dangerous in composition, can the human actually stop it?\n\nAttendees will leave with a field checklist for evaluating AI tools before deployment: what the agent can do, what evidence the human sees, when control transfers, who can override, and how the organization knows the control is working.\n\nThis is not an anti-AI talk. It is a pro-adoption talk for security teams that want AI to survive contact with real operations.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "ZZEW38", "name": "John Anthony Kwarsick", "avatar": "https://pretalx.com/media/avatars/BQBULS_IDDVy1G.webp", "biography": "John A. Kwarsick is a researcher, speaker, and enterprise technology leader focused on making the human layer of AI measurable. He is the creator of WHEEL\u2122, a constraint-based framework for diagnosing AI adoption and organizational readiness, and WHEEL OS\u2122, an architecture for assessing whether enterprises retain the human capacity to govern AI under real operating conditions. He is also developing WHEEL OS AG, a governance system designed to identify where accountability may fail as multiple AI agents act across business functions and enterprise systems.\n\nJohn has published a 12-paper research program on SSRN examining AI adoption, human governance capacity, agentic oversight, behavioral change, and the long-term effect of AI on human judgment. His perspective is informed by four decades in enterprise technology, including leadership roles at Microsoft and Check Point Software Technologies.\n\nHe speaks on agentic AI governance, enterprise AI transformation, cybersecurity and GRC, organizational readiness, and why AI initiatives often fail even when the technology works.", "public_name": "John Anthony Kwarsick", "guid": "2c031958-ec08-5ce4-a25f-81ded4f6aac2", "url": "https://pretalx.com/bsidesatl-2026/speaker/ZZEW38/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/A8XX3K/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/A8XX3K/", "attachments": []}, {"guid": "c470f96f-ef30-5167-bedc-fe4fc7662663", "code": "HUUZBK", "id": 103114, "logo": null, "date": "2026-10-03T13:00:00-04:00", "start": "13:00", "end": "2026-10-03T13:50:00-04:00", "duration": "00:50", "room": "Conference B", "slug": "bsidesatl-2026-103114-evidence-as-code-automating-compliance-without-the-audit-theater", "url": "https://pretalx.com/bsidesatl-2026/talk/HUUZBK/", "title": "Evidence-as-Code: Automating Compliance Without the Audit Theater", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "50 minute talk", "language": "en", "abstract": "Most compliance programs treat audits as annual fire drills involving manual evidence collection and massive spreadsheets. This session introduces a different approach: Evidence-as-Code, where automated scripts continuously map system configurations to regulatory controls in real-time.\n\nUsing a distributed environment as a case study, this talk demonstrates how to build lightweight automation that reduces audit preparation time by 60% while providing engineers with continuous visibility into security posture. We will cover mapping technical configurations to frameworks like HIPAA and SOC 2, identifying configuration drift before it becomes an audit finding, and building evidence pipelines that satisfy both auditors and security teams. Attendees will learn how to turn compliance automation into actual security monitoring.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "9GX8RY", "name": "Darius Davis", "avatar": "https://pretalx.com/media/avatars/KPBRH7_w4ciamx.webp", "biography": "Darius M. Davis is a cybersecurity consultant and detection engineer with over a decade of experience across security operations, cloud security, and incident response. He holds CISSP and CISM certifications and specializes in building practical, resilient security systems under real-world constraints\u2014where tradeoffs around visibility, performance, and reliability matter more than tooling hype.\nDarius is particularly interested in how constraint-driven environments expose flawed security assumptions and lead to better defensive design. He believes the best security lessons come from systems that broke, scaled poorly, or failed in unexpected ways\u2014and that sharing those failures honestly makes everyone better defenders.", "public_name": "Darius Davis", "guid": "38a71c18-5825-58fc-a4cc-35b67b897022", "url": "https://pretalx.com/bsidesatl-2026/speaker/9GX8RY/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/HUUZBK/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/HUUZBK/", "attachments": []}, {"guid": "1b5a07ea-4b18-55f1-965d-b9da2c949512", "code": "AMNMAR", "id": 103674, "logo": null, "date": "2026-10-03T14:00:00-04:00", "start": "14:00", "end": "2026-10-03T14:50:00-04:00", "duration": "00:50", "room": "Conference B", "slug": "bsidesatl-2026-103674-tiered-iam-for-entra-users", "url": "https://pretalx.com/bsidesatl-2026/talk/AMNMAR/", "title": "Tiered IAM for Entra Users", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "50 minute talk", "language": "en", "abstract": "We're used to doing threat-modeling on-premise Active Directory in a tiered structure, but applying these same principles to Entra comes with unique challenges. In this talk, we'll take a look at where risk resides not just in IT administrative personnel, but identities who pose risks to the business operations. \n\nThis talk will come with real-world examples of identity compromises which were avoidable, either due to gaps in Conditional Access controls or hidden privileges in Entra, and actionable steps to take for reducing risk in any Entra tenant without 3rd party products.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "CVCXGL", "name": "James Stephens", "avatar": "https://pretalx.com/media/avatars/GSRR9B_1wRKHwF.webp", "biography": "James Stephens is a Senior Consultant with CrowdStrike Professional Services, and is a 12 year veteran of cyber investigations.", "public_name": "James Stephens", "guid": "f98d3ef3-91a8-5b68-9019-67e53173bd6a", "url": "https://pretalx.com/bsidesatl-2026/speaker/CVCXGL/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/AMNMAR/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/AMNMAR/", "attachments": []}, {"guid": "e6a8d43e-51f7-5728-8a61-88f31950b718", "code": "XDLSHP", "id": 103235, "logo": "https://pretalx.com/media/bsidesatl-2026/submissions/XDLSHP/image_jCpiDet.webp", "date": "2026-10-03T15:00:00-04:00", "start": "15:00", "end": "2026-10-03T15:20:00-04:00", "duration": "00:20", "room": "Conference B", "slug": "bsidesatl-2026-103235-cybersecurity-safety-culture-leveraging-nuclear-safety-culture-principles-to-cybersecurity-risk-management", "url": "https://pretalx.com/bsidesatl-2026/talk/XDLSHP/", "title": "Cybersecurity Safety Culture\u2122: Leveraging Nuclear Safety Culture Principles to Cybersecurity Risk Management", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "20 minute talk", "language": "en", "abstract": "Cybersecurity incidents affecting operational technology (OT) and industrial control systems (ICS) increasingly threaten the reliability and safety of critical infrastructure sectors such as electric power, oil and gas, and manufacturing.  A recent survey, reported in the Wall Street Journal May 28, 2026 revealed that nearly two-thirds of CEOs at blue-chip firms cited cyberattacks as their biggest concern in the second quarter, up from 56% in the previous three-month period.  Rapid advances in frontier AI models, like Anthropic\u2019s Mythos and OpenAI\u2019s GPT-5.5, also have many companies worried that hackers will be able to identify vulnerabilities several times faster than cybersecurity teams can patch them.\n\nWhile current cybersecurity frameworks focus primarily on technical controls, many incidents originate from organizational, procedural, and human factors.   In contrast, the nuclear industry has long addressed comparable systemic risks through defining and anchoring a nuclear safety culture within each of the US nuclear plant operating organizations.  This paper provides a roadmap on how executive leaders can utilize the US nuclear power industry's safety culture experience for strengthening cybersecurity resilience in critical infrastructure environments.\n\nBy integrating nuclear safety culture principles into cybersecurity governance, critical infrastructure operators can strengthen both prevention and resilience against cyber-physical threats. The paper concludes by outlining practical recommendations for adapting nuclear safety culture concepts to cybersecurity programs, including leadership engagement, operational training, incident reporting mechanisms, and regulatory frameworks.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "EPHCRH", "name": "Juan F Villarreal", "avatar": "https://pretalx.com/media/avatars/S8TTYF_VZ8MOWD.webp", "biography": "Juan Villarreal is an accomplished energy-sector executive, reliability expert, and industrial cybersecurity leader with more than three decades of experience spanning electric power generation, critical infrastructure operations and maintenance, international business development, and cyber resilience. \n\nThroughout his career, he has held senior leadership positions at General Electric, Babcock & Wilcox, and the Electric Power Research Institute, supporting utilities, power producers, and energy technology organizations across North America and global markets. He has successfully led initiatives that enhanced the reliability, performance, and resilience of nuclear, fossil, and renewable generation assets while helping organizations address the evolving challenges facing critical infrastructure.\n\nJuan holds a Master of Science in Cybersecurity from Georgia Institute of Technology, a Master of Science in Mechanical Engineering from UC Berkeley and a Bachelors in Nuclear Engineering from Kansas State University. Juan has specialized certifications in critical infrastructure protection and industrial reliability frameworks, including Supply Chain Security, GIAC Critical Infrastructure Protection (GCIP) and ISA/IEC 62443.\n\nHe currently contributes to U.S. Department of Energy Cyber-Informed Engineering initiative for improving the resilience of critical infrastructure and is on the drafting team for NERC\u2019s CIP-013 - Cyber Security \u2013 Supply Chain Risk Management regulation update. Juan is the Chair of the Georgia ANS Local Section and the Chair of the ANS Local Section Committee.", "public_name": "Juan F Villarreal", "guid": "af105fe7-4ce0-5757-9f5b-1fe87671d08a", "url": "https://pretalx.com/bsidesatl-2026/speaker/EPHCRH/"}, {"code": "CWSPUV", "name": "David Garchow", "avatar": null, "biography": "DAVID F. GARCHOW\ngarch9@hotmail.com  |  (678) 525-3539\nStrategic Advisor \u2022 Executive Coach \u2022 Safety, Risk & High-Reliability Performance\nEXECUTIVE PROFILE\nFormer nuclear executive and internationally recognized safety leader with 40+ years advising boards, CEOs, and senior leadership teams on safety culture, operational risk, governance, and organizational performance. Former Nuclear Vice President, Utility Engineering Director, INPO International Vice President, and WANO Atlanta Centre Director. Trusted advisor on leadership effectiveness, culture transformation, and high-reliability performance.\nEXPERTISE\nExecutive & Board Advisory \u2022 Leadership Team Coaching \u2022 Safety Culture \u2022 Operational Risk \u2022 High-Reliability Organizations \u2022 Operational Excellence \u2022 Human Performance \u2022 Governance & Oversight \u2022 Organizational Effectiveness \u2022 Performance Improvement\nCAREER HIGHLIGHTS\nLed domestic and international performance improvement initiatives for INPO and WANO, advising executive teams across the global nuclear industry. Held senior leadership roles with Arizona Public Service and PSEG Nuclear, responsible for nuclear safety, operations, engineering, regulatory performance, stakeholder engagement, and strategic planning.\nBOARD & ADVISORY ROLES\nIndependent Nuclear Safety Review Boards: Entergy and Ameren (2017-Present). Executive Patient Safety Committee: Northeast Georgia Health System. Provides independent oversight, risk insight, safety culture assessment, and strategic guidance.\nTHOUGHT LEADERSHIP\nGuest lecturer for MIT Nuclear Science and Engineering and INPO. Speaker on leadership, safety culture, operational risk, and high-reliability organizations. Developed practical methodologies to strengthen culture and reduce cybersecurity-related human risk.\nEDUCATION\nAdvanced Management Program, The Wharton School | M.S., Keller Graduate School of Management | B.S., Michigan State University | NRC Senior Reactor Operator License", "public_name": "David Garchow", "guid": "f532abcf-cf91-5462-a1ba-04b7dfdd9a2b", "url": "https://pretalx.com/bsidesatl-2026/speaker/CWSPUV/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/XDLSHP/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/XDLSHP/", "attachments": []}, {"guid": "cbaff4d8-4dc3-5450-9973-e119997881cc", "code": "KCEZJ7", "id": 103666, "logo": null, "date": "2026-10-03T15:30:00-04:00", "start": "15:30", "end": "2026-10-03T16:20:00-04:00", "duration": "00:50", "room": "Conference B", "slug": "bsidesatl-2026-103666-grc-in-the-age-of-ai", "url": "https://pretalx.com/bsidesatl-2026/talk/KCEZJ7/", "title": "GRC in the Age of AI", "subtitle": "", "track": "Governance, Risk & Compliance", "type": "50 minute talk", "language": "en", "abstract": "As AI continues to reshape industries, organizations are increasingly confronted with new ethical, compliance, and security challenges. AI systems, whether predictive or generative, are rapidly being integrated into business processes, decision-making, and customer engagement, introducing risks that traditional governance structures may not fully address. This session explores how organizations can implement effective AI governance to balance innovation with accountability, transparency, and trust.\n\nAttendees will gain a foundational understanding of AI systems as they relate to information security and privacy, their shared responsibility model, and the implications of AI adoption across roles, from model developers and cloud service providers to end users. The presentation highlights how emerging compliance frameworks, such as ISO/IEC 42001 (AI Management Systems), ISO/IEC 23894 (AI Risk Management), and the NIST AI Risk Management Framework, provide structure and guidance for managing AI responsibly.\n\nThrough examples drawn from real-world consulting and auditing experiences, presenters will examine the growing regulatory landscape, including the EU AI Act and evolving U.S. state laws, and discuss the implications for compliance and assurance programs such as SOC 2 and HITRUST. Participants will leave with practical strategies to identify AI-related risks, conduct AI system impact assessments, and integrate AI governance into existing compliance frameworks, preparing their organizations to thrive responsibly in the age of AI.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "ZBKZ8K", "name": "Grace Pfohl", "avatar": "https://pretalx.com/media/avatars/MHPBXA_pWarKXx.webp", "biography": "Grace Pfohl is a Senior Consultant on risk3sixty\u2019s ethOS Compliance Consulting team and serves as the AI Advisory Team Lead. She leads AI governance, security, and privacy engagements, helping organizations implement ISO/IEC 42001 programs as part of broader compliance initiatives through audits, risk assessments, and AI management system implementations.\n\nWith a strong technical background and deep specialization in AI governance, Grace has played a key role in helping organizations achieve some of the earliest ISO/IEC 42001 certifications. She works closely with clients to implement AI management systems aligned with emerging global standards, translating regulatory requirements into practical, risk\u2011based governance programs.\n\nGrace holds both BS and MS degrees in Computer Science from the Georgia Institute of Technology, with a specialization in Human\u2011Computer Interaction. She is a certified ISO 42001 Lead Auditor and Implementer and regularly guides organizations through ISO 42001 implementations and internal audits, helping operationalize responsible AI practices at scale. She is also an active member of the WiCyS community, sharing applied perspectives on AI governance and responsible AI.", "public_name": "Grace Pfohl", "guid": "e728de3a-8c51-51ab-af44-ee1809c87652", "url": "https://pretalx.com/bsidesatl-2026/speaker/ZBKZ8K/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/KCEZJ7/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/KCEZJ7/", "attachments": []}], "Conference C": [{"guid": "8d18c610-4066-54fc-8098-c92af8aca5c4", "code": "FNCHG3", "id": 103706, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T16:00:00-04:00", "duration": "06:30", "room": "Conference C", "slug": "bsidesatl-2026-103706-electronic-security-village", "url": "https://pretalx.com/bsidesatl-2026/talk/FNCHG3/", "title": "Electronic Security Village", "subtitle": "", "track": "Village", "type": "Full-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "The Electronic Security Village will be based on a combination of physical and electronic security that will allow attendees to explore and interact with industry equipment. The goal will be to provide attendees an opportunity to bypass common security vulnerabilities on doors, demonstrate the said  vulnerability, and how to defend against them.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "UUVDW9", "name": "Andrew (Hakuna)", "avatar": null, "biography": "Experienced IT professional with a specialty in physical access control and IoT device surveillance. Broke into information technology after obtaining CompTia certs in 2021. Currently, working with ACG Security Solutions and obtaining more CompTia certifications.", "public_name": "Andrew (Hakuna)", "guid": "8fd78c9e-101b-5f4d-97bc-868b44f46041", "url": "https://pretalx.com/bsidesatl-2026/speaker/UUVDW9/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/FNCHG3/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/FNCHG3/", "attachments": []}], "Conference D": [{"guid": "7a9687ee-3539-5ed0-aa78-9d8ebdf10a06", "code": "FK9B7H", "id": 105842, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T16:00:00-04:00", "duration": "06:30", "room": "Conference D", "slug": "bsidesatl-2026-105842-chillout-room", "url": "https://pretalx.com/bsidesatl-2026/talk/FK9B7H/", "title": "Chillout Room", "subtitle": "", "track": null, "type": "Full-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "Chillout Room", "description": null, "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/FK9B7H/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/FK9B7H/", "attachments": []}], "Conference E": [{"guid": "97aa342f-32be-5679-bdde-044a92df37fd", "code": "FYYX8D", "id": 103074, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T10:20:00-04:00", "duration": "00:50", "room": "Conference E", "slug": "bsidesatl-2026-103074-reverse-engineering-with-ai-dissecting-a-modern-game-cheat", "url": "https://pretalx.com/bsidesatl-2026/talk/FYYX8D/", "title": "Reverse Engineering with AI: Dissecting a Modern Game Cheat", "subtitle": "", "track": "Offensive Security & Research", "type": "50 minute talk", "language": "en", "abstract": "When I saw advertisements about a video game cheat providing aimbot functions through realtime screen reading, I was skeptical. But I also saw an opportunity to fight fire with fire, or in this case AI vs AI. What I ended up with was an agentic approach to reverse engineering and malware analysis to make the process more accessible to researchers.\nSo, this talk is about the methodology, not just the findings. Instead of grepping across hundreds of classes, I asked direct questions like \"where does screen capture connect to inference,\" and got back synthesized, verifiable answers instead of a list of files.\nI'll walk through the pipeline that approach uncovered: three custom YOLOv5 models detecting enemies and heads, a dual-PC evasion mode that puts inference entirely off the game machine, and a licensing system more heavily obfuscated than the cheat itself. I'll also cover where the agent got things wrong, where Ghidra had to fill in, and how to structure a dynamic validation environment when your target actively phones home.\nIf you do reverse engineering, threat hunting, or malware analysis and haven't handed the exploratory work to an agent yet, this talk is the argument for why that's changing faster than you think.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "FWW7BY", "name": "Steve Guris", "avatar": "https://pretalx.com/media/avatars/EDV9AT_AIyP14j.webp", "biography": "Steve Guris is Threat Intelligence Lead at risk3sixty, where he focuses on cybercrime research, threat actor monitoring and hunting, and incident response. His work spans the full threat intelligence lifecycle \u2014 from pre-incident adversary profiling to active investigation support. He is best known publicly for his work in gaming security, including expert analysis in federal litigation involving commercial game cheats: a declaration in Bungie v. Wallhax and expert witness testimony at the Bungie v. Phoenix Digital (AimJunkies) federal jury trial. He has spoken at GDC on gaming security topics, most recently on a 2026 panel with Perkins Coie LLP on investigating and enforcing IP and contractual rights in games.", "public_name": "Steve Guris", "guid": "ee00e12a-8bcf-5e20-9604-889f265b3acc", "url": "https://pretalx.com/bsidesatl-2026/speaker/FWW7BY/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/FYYX8D/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/FYYX8D/", "attachments": []}, {"guid": "35ce1915-219c-51aa-b48c-77c5de968a5d", "code": "WXK77J", "id": 103197, "logo": null, "date": "2026-10-03T10:30:00-04:00", "start": "10:30", "end": "2026-10-03T10:50:00-04:00", "duration": "00:20", "room": "Conference E", "slug": "bsidesatl-2026-103197-economics-of-vulnerability-exploitation-with-ai", "url": "https://pretalx.com/bsidesatl-2026/talk/WXK77J/", "title": "Economics of Vulnerability Exploitation with AI", "subtitle": "", "track": "Offensive Security & Research", "type": "20 minute talk", "language": "en", "abstract": "For decades, the economics of offensive security protected defenders. Turning a CVE into a working exploit took a skilled human researcher days to weeks of expensive, specialized labor \u2014 a cost curve that quietly rate-limited how much of the vulnerability backlog ever got weaponized. That curve just collapsed.\n\nWe ran a large language model pipeline against a corpus of 3,016 real CVEs and measured, end to end, what it actually costs an autonomous agent to reach a verified working exploit \u2014 not a suggestion, a reproduced one. The results reprice the entire threat model. Across the corpus, the median exploit was produced in roughly 13 minutes for about $3 in inference \u2014 against a human researcher benchmark measured in weeks. Seventy-four percent of analyzed CVEs were driven to a verified exploit, a meaningful share of them not on CISA's Known Exploited Vulnerabilities list \u2014 meaning \"not yet exploited in the wild\" no longer means \"expensive to exploit.\"\n\nThis talk treats exploitation as a unit-economics problem. We'll walk through the measurement methodology (and where it breaks \u2014 the CVEs that stayed Unsolved), the cost-per-exploit and time-per-exploit distributions, and what happens to patch prioritization, KEV-based risk models, and attacker ROI when the marginal cost of a working exploit approaches the price of a coffee. We close with the counter-economics: AI-generated remediation measured in the same minutes-and-dollars terms.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "9QWES9", "name": "Mehul Revankar", "avatar": "https://pretalx.com/media/avatars/ZDJW83_jhXJClQ.webp", "biography": "Mehul is a seasoned cybersecurity product leader with a proven track record of building award-winning products and scaling B2B SaaS and open-source solutions. With over 20 years of experience in enterprise security, he has led product, engineering, and research teams at industry leaders including Qualys and Tenable.", "public_name": "Mehul Revankar", "guid": "29159a63-032d-5525-a845-91d13b8d3fca", "url": "https://pretalx.com/bsidesatl-2026/speaker/9QWES9/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/WXK77J/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/WXK77J/", "attachments": []}, {"guid": "05a80988-6523-562a-ad56-202893798a0b", "code": "S89XUR", "id": 103665, "logo": null, "date": "2026-10-03T11:00:00-04:00", "start": "11:00", "end": "2026-10-03T11:20:00-04:00", "duration": "00:20", "room": "Conference E", "slug": "bsidesatl-2026-103665-no-model-was-harmed-in-the-making-of-this-exploit", "url": "https://pretalx.com/bsidesatl-2026/talk/S89XUR/", "title": "No Model Was Harmed in the Making of This Exploit", "subtitle": "", "track": "Offensive Security & Research", "type": "20 minute talk", "language": "en", "abstract": "In March 2026, people discovered Chipotle's customer-support chatbot would happily solve LeetCode problems and write Python between burrito orders. Within days someone had turned it into a free coding agent running entirely on Chipotle's compute. The internet laughed and moved on, and missed the actual lesson.\n\nThe uncomfortable part: nothing was hacked. No protocol cracked, no auth bypassed, no prompt injected. The \"exploit\" was a faithful reimplementation of the bot's own chat client, wrapped in one thing, an OpenAI-compatible API which instantly dropped a captive support bot into the entire LLM tooling ecosystem: every SDK, every agent, every framework.\n\nThis talk names that pattern interface laundering, and argues it's a latent property of nearly every AI feature shipping today. Your support bot, your \"summarize\" button, your semantic search: if it's reachable and returns model output, someone can re-present it through a standard interface and take it somewhere you never intended. The friction you're counting on as a control gets laundered away in about forty lines of code.\n\nWe'll walk the (now-patched) Chipotle case, watch a deliberately vulnerable bot get laundered into a coding assistant on video, and leave with a hardening checklist that assumes the attacker isn't a browser: where to enforce scope, why per-session rate limits are theater, and how to spot the \"phantom client\" whose absence of human fingerprints gives a proxy away.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "L9T9ND", "name": "Harsh Akshit", "avatar": "https://pretalx.com/media/avatars/9NAJUY_wx1BcFB.webp", "biography": "Harsh Akshit is an Al and Application Security Researcher/Engineer specializing in Al security, red teaming, and vulnerability management. He currently focuses on exploring security risks related to Model Context Protocol (MCP) and agentic Al systems at Metano AI [https://metano.ai/], alongside independent security research, including CVE discoveries (CVE-2026-54261 and CVE-2026-54259) and recognition in the Google Bug Hunter Hall of Fame.\nHe holds a Master's degree in Cybersecurity Risk Management from Indiana University Bloomington and a Bachelor's degree in Computer Science from BIT Mesra.\nHis previous experience includes working as a Security Consultant at Synopsys Inc., where he conducted application security and source code assessments for enterprise clients.", "public_name": "Harsh Akshit", "guid": "9fead44c-7691-564a-bcb4-d70c33c9ff29", "url": "https://pretalx.com/bsidesatl-2026/speaker/L9T9ND/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/S89XUR/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/S89XUR/", "attachments": []}, {"guid": "b35333f3-3d70-5ed7-b1a9-59b1e039253b", "code": "SSG3KH", "id": 103466, "logo": null, "date": "2026-10-03T11:30:00-04:00", "start": "11:30", "end": "2026-10-03T12:20:00-04:00", "duration": "00:50", "room": "Conference E", "slug": "bsidesatl-2026-103466-you-want-some-zero-days-with-that-netpen-finding-your-own-way-in-with-llms", "url": "https://pretalx.com/bsidesatl-2026/talk/SSG3KH/", "title": "You want some zero days with that netpen? Finding your own way in with LLMs", "subtitle": "", "track": "Offensive Security & Research", "type": "50 minute talk", "language": "en", "abstract": "Network pentests don\u2019t ordinarily have time in scope to do significant research on products encountered during the assessment. This has forced many testers to rely on known CVEs instead of hunting for 0-days. LLM agents like Claude Code have strong capabilities for binary analysis and vulnerability discovery. Even large attack surfaces like appliances can be analyzed in hours. Significant vulnerabilities can be turned into exploits and handed to operators to use during pentests and red team engagements.\n\nAttendees will walk away with a better understanding of how to stand up test labs that let LLMs rapidly discover and weaponize vulnerabilities, techniques for keeping agents on task during research, and a multi-pronged approach for assessing appliances, including patch-diffing, SBOM analysis, config review, binary reverse engineering, and fuzzing. We'll release a Claude Code plugin that integrates several of these approaches using tools like Binary Ninja, headless Ghidra, and IDA Pro. If coordinated disclosure completes before the conference talk, we will also release exploits for two critical vulnerabilities in a popular hypervisor management platform.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "ZYVGHC", "name": "Phil Brass", "avatar": null, "biography": "Phil Brass has worked in Information Security since 1998. He has been a software engineer, penetration tester, secure code reviewer, application security tester, manager, director and vice president of consulting services.", "public_name": "Phil Brass", "guid": "17f4638a-98f8-5c64-a068-025d41fdba04", "url": "https://pretalx.com/bsidesatl-2026/speaker/ZYVGHC/"}, {"code": "BJPUJJ", "name": "Matty McFatty", "avatar": "https://pretalx.com/media/avatars/F8APSC_vRf9pY6.webp", "biography": "Matt has been an amateur security enthusiast since the 90s and was a regular 2600 attendee. Holding a B.S. in Computer Science from The University of Kansas, Matt honed his technical skills over 6 years as a systems administrator for various Kansas City businesses. In 2013, he combined his knowledge of complex business computing systems and love for security to pivot into a career in information security. Since then, he has hacked on hundreds of systems and applications for both Fortune 100 companies and smaller startups. His expertise lies in the nuanced realms of Web and Mobile application testing, along with comprehensive Cloud security reviews. Matt excels in uncovering business logic flaws-subtle vulnerabilities often overlooked by automated scanners. Matt has given talks and trainings at security events such as SecKC, Kernelcon, and BSidesKC. A highlight of his career includes presenting tools of his own design at BlackHat USA in both 2015 and 2017.", "public_name": "Matty McFatty", "guid": "fe1e699b-4d57-5d92-a140-4e3bb7d4d57e", "url": "https://pretalx.com/bsidesatl-2026/speaker/BJPUJJ/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/SSG3KH/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/SSG3KH/", "attachments": []}, {"guid": "51f7847b-1220-52ea-b9f7-1aab1c2f09ea", "code": "AQV7WP", "id": 103729, "logo": null, "date": "2026-10-03T13:00:00-04:00", "start": "13:00", "end": "2026-10-03T13:50:00-04:00", "duration": "00:50", "room": "Conference E", "slug": "bsidesatl-2026-103729-intro-to-reverse-engineering-with-the-psx-dvr", "url": "https://pretalx.com/bsidesatl-2026/talk/AQV7WP/", "title": "Intro to Reverse Engineering with the PSX DVR", "subtitle": "", "track": "Offensive Security & Research", "type": "50 minute talk", "language": "en", "abstract": "The Sony PSX DVR is an unusual combination of a PlayStation 2, digital video recorder, and consumer media appliance, which makes it a great platform for reverse engineering. In this introductory presentation, we will walk through our effort to understand the PSX DVR from the circuit board up, using it as a case study for a broad range of hardware and software reverse engineering techniques.\n\nThis talk will cover board-level reconnaissance, including identifying components, tracing interfaces, locating memory devices, and discussing approaches for extracting firmware from NAND storage. From there, we will follow the recovered software into Ghidra, demonstrating static-analysis workflows such as memory mapping, identifying code and data, recognizing program structures, documenting findings, and gradually turning an unfamiliar binary into something understandable.\n\nThe PSX DVR also contains several architectural and firmware-specific complications that make it more interesting than a typical introductory target. We will discuss how custom processor support and Ghidra language modules can be used when an instruction set is missing or poorly supported, and how hardware observations can guide software analysis.\n\nFinally, we will present an unresolved encryption problem within the PSX DVR ecosystem as an open challenge. This talk is intended for anyone curious about reverse engineering, from beginners looking for a starting point to experienced researchers interested in helping crack a strange piece of Sony hardware history.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "EQGWJL", "name": "Zach C", "avatar": "https://pretalx.com/media/avatars/UBHYX9_FZ8VTWK.webp", "biography": "Zach Comstock is a research engineer with a background in computer science, reverse engineering, embedded systems, and cybersecurity. His work focuses on understanding complex hardware and software systems, with experience spanning low-level analysis, firmware, wireless technologies, and system security. He has spent much of his career working on technically challenging problems that sit at the intersection of hardware and software, and he enjoys breaking down unfamiliar systems to understand how they work.", "public_name": "Zach C", "guid": "1eb82bba-7fad-5920-b175-d30c5070f059", "url": "https://pretalx.com/bsidesatl-2026/speaker/EQGWJL/"}, {"code": "EZYRGJ", "name": "Spencer B", "avatar": "https://pretalx.com/media/avatars/BCSVES_IYGBMib.webp", "biography": "Spencer Brown is a Research Engineer at GTRI, where he works in systems security, software assurance, reverse engineering, and formal methods. He holds a master's degree in Computer Science from Georgia Tech and enjoys tinkering with hardware and computer history. Outside of work, he's usually planning a backpacking or climbing trip.", "public_name": "Spencer B", "guid": "6dacdfd6-c98e-597f-9690-c61d823cead8", "url": "https://pretalx.com/bsidesatl-2026/speaker/EZYRGJ/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/AQV7WP/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/AQV7WP/", "attachments": []}, {"guid": "22bdf305-d3a1-5492-9050-04ffa378f604", "code": "ZHZ93T", "id": 103383, "logo": null, "date": "2026-10-03T14:00:00-04:00", "start": "14:00", "end": "2026-10-03T14:20:00-04:00", "duration": "00:20", "room": "Conference E", "slug": "bsidesatl-2026-103383-feds-watching-abusing-workload-identity-federation-for-cloud-persistence-and-privilege-escalation", "url": "https://pretalx.com/bsidesatl-2026/talk/ZHZ93T/", "title": "Feds Watching: Abusing Workload Identity Federation for Cloud Persistence and Privilege Escalation", "subtitle": "", "track": "Offensive Security & Research", "type": "20 minute talk", "language": "en", "abstract": "Workload Identity Federation (WIF) is the modern replacement for long-lived\ncloud credentials. Microsoft, Google, and AWS all recommend it as a security best\npractice: eliminate secrets, reduce risk, adopt federation. What they don't tell you\nis that the same feature creates a powerful, largely unmonitored path to privilege\nescalation and persistence that most organizations are not prepared to detect.\n\nThis talk presents original research into WIF exploitation across Entra ID, GCP,\nand AWS, with the deep dive focused on Microsoft Entra ID: the attack\nmechanics, the security boundaries, and the detection gaps that make this\ntechnique so valuable to adversaries. You'll see why federated credentials are\nstealthier than secrets or certificates at the audit-log level, how a licensing gap in\nConditional Access for workload identities leaves most organizations without the\ncontrols they think they have, and how some of Microsoft's own built-in\nboundaries federation chain blocking, token-lifetime enforcement, and more can\nhand defenders concrete signals to detect on.\n\nThe session closes with a live walk through of FedForge, a multi-cloud WIF\nexploitation tool built during this research, demonstrated against a real\nengagement: escalating privileges and establishing persistent cloud access after\nan on-prem Active Directory compromise. You'll leave knowing how to run this\ntechnique and, more importantly, how to catch it.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "URKNJX", "name": "Darrius Robinson", "avatar": "https://pretalx.com/media/avatars/DCHJBH_Q90QxPC.webp", "biography": "Darrius Robinson is a Security Consultant specializing in cloud security, identity, and adversary simulation. With over a decade of experience across IT and cybersecurity, he has worked in roles spanning systems administration, cloud engineering, security operations, and penetration testing, giving him a practical perspective on both building and breaking modern enterprise environments.", "public_name": "Darrius Robinson", "guid": "e92ea799-23e0-5ae0-9ceb-26e117e0ca2f", "url": "https://pretalx.com/bsidesatl-2026/speaker/URKNJX/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/ZHZ93T/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/ZHZ93T/", "attachments": []}, {"guid": "fde33eb0-e6af-588c-ad6f-db335a545c10", "code": "DGMB3D", "id": 103478, "logo": null, "date": "2026-10-03T14:30:00-04:00", "start": "14:30", "end": "2026-10-03T14:50:00-04:00", "duration": "00:20", "room": "Conference E", "slug": "bsidesatl-2026-103478-automated-vishing-how-ai-avatars-are-weaponizing-voice-social-engineering", "url": "https://pretalx.com/bsidesatl-2026/talk/DGMB3D/", "title": "Automated Vishing: How AI Avatars Are Weaponizing Voice Social Engineering", "subtitle": "", "track": "Offensive Security & Research", "type": "20 minute talk", "language": "en", "abstract": "AI voice avatars now need just 30 seconds of audio to sound convincingly human, and LLMs can drive them in real time to run fully automated social engineering attacks. In this talk, I'll share how I built a deepfake vishing agent, an AI \"IRS officer\" designed to scam victims into paying fake tax debt, in a single afternoon, and briefly walk through the technical stack behind it.\n\nThe real focus is what I found testing this attack against commercial AI avatar platforms: guardrails are inconsistent, easily bypassed, and disappear entirely once an attacker runs the pipeline locally with open-source tools. For enterprises, this means voice can no longer be trusted as a verification signal. I'll close with what defenders need to do now to prepare.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "LPGMPH", "name": "Deven Nahata", "avatar": "https://pretalx.com/media/avatars/3B3GSP_wcSrdIN.webp", "biography": "Deven Nahata is a Threat Research Co-Op at GetReal Security, a deepfake detection startup, where he works on threat research spanning adversarial testing, dataset generation, and analysis of emerging synthetic media threats. His research includes building a fully automated deepfake vishing agent to expose gaps in commercial AI avatar guardrails, and he has published on AI-driven social engineering, presenting his findings to audiences ranging from enterprise security teams to industry conferences.\n\nDeven is currently pursuing a degree in Computer Engineering at Georgia Tech, where he also serves as a Research Analyst with the GT Venture Capital Club. His broader background includes research experience at Carnegie Mellon's Smart Sensing Lab, the University of Toronto, and Rilian Technologies, along with a first-author publication in AI-driven autonomous vehicle perception.", "public_name": "Deven Nahata", "guid": "24cf8513-375e-5921-aaef-7b9bdb2a41cc", "url": "https://pretalx.com/bsidesatl-2026/speaker/LPGMPH/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/DGMB3D/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/DGMB3D/", "attachments": []}, {"guid": "8ca1e7e4-5229-5e39-8dff-cb4951c086f1", "code": "BVXCMR", "id": 103539, "logo": null, "date": "2026-10-03T15:00:00-04:00", "start": "15:00", "end": "2026-10-03T15:20:00-04:00", "duration": "00:20", "room": "Conference E", "slug": "bsidesatl-2026-103539-syscall-all-the-things-an-intro-to-syscalls", "url": "https://pretalx.com/bsidesatl-2026/talk/BVXCMR/", "title": "Syscall All The Things: An Intro To Syscalls", "subtitle": "", "track": "Offensive Security & Research", "type": "20 minute talk", "language": "en", "abstract": "This presentation provides an introductory overview of Windows system calls (syscalls), their role within the operating system, and their significance in modern security research. Syscalls serve as the interface between userland applications and the Windows kernel, enabling programs to perform privileged operations through functions exposed by ntdll.dll. The presentation explores the structure of NtFunctions, syscall service numbers (SSNs), and the mechanics of how syscall instructions are generated and executed. Common methods for resolving SSNs, including dynamic discovery and hardcoded approaches, are examined along with the challenges introduced by differences across Windows versions. The presentation compares direct and indirect syscall methods, and discusses their advantages and limitations. The goal is to provide security practitioners with a foundational understanding of syscall internals, detection strategies, and the practical considerations involved in both exploiting and defending syscall based attack vectors.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "SGSFJB", "name": "Daniel Cornett", "avatar": null, "biography": "Daniel is a dedicated and passionate Security Consultant at Abricto Security, where he specializes in tool creation and internal network penetration testing. His technical expertise allows him to design innovative solutions to complex security challenges, helping organizations strengthen their defenses. Beyond his professional work, Daniel actively participates in Capture the Flag competitions, continuously honing his skills and staying at the forefront of cybersecurity developments. In his free time, he enjoys developing open-source tools aimed at improving penetration testing methodologies. Daniel\u2019s work reflects his passion for innovation and knowledge-sharing, as he strives to make a meaningful impact on the cybersecurity community while helping others enhance their skills and approaches in the field. Daniel received his Bachelor of Science in Cybersecurity from the University of North Georgia where he worked as an executive member for the UNG Cybersecurity club the Cyberhawks. He holds a variety of industry certifications, including Certified Ethical Hacker (CEH), GIAC Security Essentials (GSEC), eLearnSecurity Web Application Penetration Tester (eWPT), Offensive Security Certified Professional (OSCP), and OffSec Wireless Professional (OSWP).", "public_name": "Daniel Cornett", "guid": "339c98cb-8b65-5f74-bc2c-b541f5e1d4b3", "url": "https://pretalx.com/bsidesatl-2026/speaker/SGSFJB/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/BVXCMR/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/BVXCMR/", "attachments": []}, {"guid": "a7736a54-a029-54b7-b193-821d39d15c3b", "code": "73BT8C", "id": 103541, "logo": "https://pretalx.com/media/bsidesatl-2026/submissions/73BT8C/image_FOx2oUt.webp", "date": "2026-10-03T15:30:00-04:00", "start": "15:30", "end": "2026-10-03T15:50:00-04:00", "duration": "00:20", "room": "Conference E", "slug": "bsidesatl-2026-103541-salesforcesecure-one-cli-to-audit-them-all", "url": "https://pretalx.com/bsidesatl-2026/talk/73BT8C/", "title": "SalesforceSecure: One CLI to Audit Them All", "subtitle": "", "track": "Offensive Security & Research", "type": "20 minute talk", "language": "en", "abstract": "Salesforce environments rarely stand alone. Pen testers and defenders inherit Salesforce Core, Marketing Cloud, Snowflake data estates, backup platforms, and a sprawl of integrations. Each surface uses different APIs, auth models, and blind spots. Manual checklist reviews do not scale, and generic cloud scanners miss platform-specific risks such as guest-user Aura exposure, Snowflake service accounts tied to employee emails, and SFMC Data Management FTP users with non-expiring passwords.\n\n**SalesforceSecure (`sfaudit`)** is an open-source, read-only auditing CLI that runs structured checks across these surfaces and produces JSON, Markdown, and client-ready HTML reports. The tool integrates with SFDX, Snowflake REST and SQL APIs, SFMC installed packages, and Own (OwnBackup). Findings include severity, CWE references, and NIST-aligned control language where applicable.\n\nThis session walks through misconfiguration patterns seen in authorized assessments, demonstrates end-to-end audit workflows in lab or sandbox environments, and shows how to scope checks, interpret results, and pair automation with manual validation guides. Attendees leave with a repeatable methodology and a tool they can run on the next authorized engagement.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "DUWUCT", "name": "David Edwards", "avatar": "https://pretalx.com/media/avatars/FKXWFD_9SRB4vT.webp", "biography": "A Veteran, Cybersecurity Professional with nearly 2 decades of experience working in the Information Technology and Security fields within the Security Consulting, Banking, and Military Contracting industries, developing processes and integrations across multiple platforms. I am currently focusing on application, network, and cloud penetration testing and vulnerability/exploit analysis, with the creation of tools through popular programming languages to increase efficiencies within testing capabilities.", "public_name": "David Edwards", "guid": "d5c84e92-1596-5dd7-87c9-ddada6431926", "url": "https://pretalx.com/bsidesatl-2026/speaker/DUWUCT/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/73BT8C/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/73BT8C/", "attachments": []}, {"guid": "69b6e373-8c94-5b3f-861a-46ae13914254", "code": "8T7FMN", "id": 103102, "logo": null, "date": "2026-10-03T16:00:00-04:00", "start": "16:00", "end": "2026-10-03T16:20:00-04:00", "duration": "00:20", "room": "Conference E", "slug": "bsidesatl-2026-103102-uac-pushing-the-boundaries", "url": "https://pretalx.com/bsidesatl-2026/talk/8T7FMN/", "title": "UAC: Pushing The Boundaries", "subtitle": "", "track": "Offensive Security & Research", "type": "20 minute talk", "language": "en", "abstract": "Dive into the current landscape of User Account Controls (UAC) and bypasses that are currently available to threat actors, red teamers, and penetration testers alike using Living Off the Land Binaries (LOLBAS).", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "GBZK8D", "name": "Daniel Krilich \"0xNeed\"", "avatar": "https://pretalx.com/media/avatars/JF99UE_ZdgGnuR.webp", "biography": "$whoami: My name is Dan. I am an Offensive Security Engineer at an IT-MSP that operates in the Financial Services market. I have my BS in Cybersecurity from Southern New Hampshire University. I like popping shells and long walks on the beach. Current certifications is CRTO, PNPT, PJPT, ISC^2 CC", "public_name": "Daniel Krilich \"0xNeed\"", "guid": "39dfa283-e886-5037-afe5-ee8d66a2afce", "url": "https://pretalx.com/bsidesatl-2026/speaker/GBZK8D/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/8T7FMN/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/8T7FMN/", "attachments": []}], "Conference Two": [{"guid": "d462620e-096b-5bda-b1c2-aa987afe2c36", "code": "RDEQJB", "id": 103508, "logo": "https://pretalx.com/media/bsidesatl-2026/submissions/RDEQJB/image_YJATXpu.webp", "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T16:00:00-04:00", "duration": "06:30", "room": "Conference Two", "slug": "bsidesatl-2026-103508-lockpick-village", "url": "https://pretalx.com/bsidesatl-2026/talk/RDEQJB/", "title": "Lockpick Village", "subtitle": "", "track": "Village", "type": "Full-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "Locks are puzzles and we like puzzles.\n\n\"Locksport is the sport or recreation of defeating locking systems. Its enthusiasts learn a variety of skills including lock picking, lock bumping, and a variety of other skills traditionally known only to locksmiths and other security professionals. Locksport followers enjoy the challenge and excitement of learning to defeat all forms of locks, and often gather together in sport groups to share knowledge, exchange ideas, and participate in a variety of recreational activities and contests.\" - Wikipedia\n\nWithout physical security, there is no security. Locks are the foundation on which all security is based. From the consumer to the security professional, it is a vital skill to see through the marketing department to find the appropriate lock for the security needed.\n\nJoin us as we explore the world of locksport.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "3WPYRF", "name": "Keith Watson", "avatar": null, "biography": "Christopher Atkinson and Keith Watson founded Atlanta Locksport on October 14th, 2019. Atlanta LockSport hosts the mini lockpicking village at dc404 meetings and we have monthly club meetings.\n\nAtlanta LockSport is a collection of lockpicking enthusiasts from the Atlanta area. Lockpicking is a fun hobby, and the fundamental knowledge of locks, their operation, and selection for physical security is an essential skill for cybersecurity professionals.", "public_name": "Keith Watson", "guid": "d9482a83-8172-5725-b168-5b575df79657", "url": "https://pretalx.com/bsidesatl-2026/speaker/3WPYRF/"}, {"code": "NHSC78", "name": "Tyler Thomas", "avatar": null, "biography": null, "public_name": "Tyler Thomas", "guid": "85e5b061-5387-532c-a906-8d78be66a122", "url": "https://pretalx.com/bsidesatl-2026/speaker/NHSC78/"}, {"code": "YB7E3Z", "name": "Stiv T", "avatar": "https://pretalx.com/media/avatars/VF3LJD_OMvq9ik.webp", "biography": "Business school dropout\nParty school graduate\nInformation Technology Specialist, PMP, CISSP", "public_name": "Stiv T", "guid": "f5718c5d-50dc-536a-843a-70b418bcdedf", "url": "https://pretalx.com/bsidesatl-2026/speaker/YB7E3Z/"}, {"code": "D38DDU", "name": "Smokintbird", "avatar": null, "biography": "Super NERD!\n...here to make everything more complicated", "public_name": "Smokintbird", "guid": "c4774be7-44ee-54bb-8b66-9d363c16063d", "url": "https://pretalx.com/bsidesatl-2026/speaker/D38DDU/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/RDEQJB/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/RDEQJB/", "attachments": []}], "Conference Three": [{"guid": "c85e65e8-ec2c-5e52-8eb0-9a3dc258d524", "code": "LEKSKP", "id": 103672, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T14:00:00-04:00", "duration": "04:30", "room": "Conference Three", "slug": "bsidesatl-2026-103672-workshop-linux-system-monitoring-with-bpftrace-and-ebpf", "url": "https://pretalx.com/bsidesatl-2026/talk/LEKSKP/", "title": "Workshop: Linux system monitoring with bpftrace and eBPF", "subtitle": "", "track": "Workshop", "type": "Half-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "This short-form technical course provides dives into Linux system monitoring using bpftrace, which uses eBPF to capture kernel events.  We\u2019ll start with a basic introductory tutorial, then move on to the practical challenges of tracing system calls, and navigating architectural differences (x86_64 vs. ARM64).\n\nAfter this session, students will be able to:\n- Build custom system call traces in bpftrace\n- Troubleshoot tracing failures\n- Navigate container observability\n- Follow best practices and evolve their understanding", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "S37JRM", "name": "Markus De Shon", "avatar": "https://pretalx.com/media/avatars/QVGPYC_SlI9GXm.webp", "biography": "Markus has worked on Detection Engineering for more than 20 years at SecureWorks, Google, Netflix, Databricks and more.", "public_name": "Markus De Shon", "guid": "9e12115f-1394-5d71-8cbf-fe8151950b6b", "url": "https://pretalx.com/bsidesatl-2026/speaker/S37JRM/"}, {"code": "FP9JCX", "name": "Julian Shalaby", "avatar": null, "biography": null, "public_name": "Julian Shalaby", "guid": "abf4437e-e064-5aa3-af3f-3fc3a2732a6a", "url": "https://pretalx.com/bsidesatl-2026/speaker/FP9JCX/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/LEKSKP/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/LEKSKP/", "attachments": []}], "Conference Four": [{"guid": "81bb0f77-890c-5cf9-940f-dbba6d4244a1", "code": "9BS8WU", "id": 103429, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T10:20:00-04:00", "duration": "00:50", "room": "Conference Four", "slug": "bsidesatl-2026-103429-now-what-neurodivergent-retention-after-the-hire", "url": "https://pretalx.com/bsidesatl-2026/talk/9BS8WU/", "title": "Now What? Neurodivergent Retention After the Hire", "subtitle": "", "track": "Community, Career, & Soft Skills", "type": "50 minute talk", "language": "en", "abstract": "Two years ago I gave talks called \"Unlocking Hidden Superpowers: Neurodiversity in Security\". While the talk was received well, people came up afterward and asked the harder question: okay, I'm hired. Now what?\n\nThis talk is the answer I've been building since.\n\nThe research has gotten better since 2024, and more practical. We used to treat communication breakdowns as the neurodivergent person's problem to fix; the evidence now says both sides misread each other about equally, which changes who does the work. A single idea about how attention works explains a cluster of things that looked unrelated.  And the exhausting part of the job, it turns out, isn't the job. It's performing normal for eight hours on top of it.\n\nThen the part I skipped last time: what security work specifically asks of a neurodivergent brain. On-call rotations. SOC floors built for everything except focus. Clearance questionnaires, polygraphs calibrated to neurotypical baselines, AI hiring screens scoring eye contact. Some of that is fixable. All of it is worth naming out loud.\n\nMost of what gets called a neurodivergent person's problem is a mismatch between a brain and an environment.  Environments can be changed.  Retention isn't a mystery, it's an engineering problem. You'll leave knowing which parts to change and how to ask for it.\n\nWarning: Presentation still contains cats. Some things don't need evolving.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "KUNSDX", "name": "Xavier Ashe", "avatar": "https://pretalx.com/media/avatars/VSLX9U_Qp4iDtf.webp", "biography": "Xavier Ashe has been hacking since the late 80s and been working in information security since the early 90s.  He is currently a Senior Vice President at Truist and a Georgia Institute of Technology alumnus.  Xavier has over 30 years of leadership experience in information security, working for various firms including IBM, Gartner, and Carbon Black.  Xavier was the first hire at the startup, Drawbridge Networks, where he was instrumental in bringing the first microsegmentation solution for servers and workstations to market.  Mr. Ashe has plenty of war stories, including the first DDOS attack ever, Target, Sony, Aramco, NotPetya, and others.  Xavier is an accomplished speaker and has presented at many security conferences including DefCon, BlackHat, RSA, BSides, Splunk .conf, SANS, and others.  \n\nWhen not hacking the planet, Xavier spends time with his 8 kids, enjoys backpacking, and is a privacy advocate.  His advocacy includes lobbying at the Georgia capital and training non-technical people about digital privacy and threat modeling.", "public_name": "Xavier Ashe", "guid": "5af00f10-cbb2-54a0-a865-77bbb9239bc5", "url": "https://pretalx.com/bsidesatl-2026/speaker/KUNSDX/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/9BS8WU/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/9BS8WU/", "attachments": []}, {"guid": "98e650eb-1044-5bc0-876d-4feadc86f369", "code": "NVCJVJ", "id": 103605, "logo": null, "date": "2026-10-03T10:30:00-04:00", "start": "10:30", "end": "2026-10-03T11:20:00-04:00", "duration": "00:50", "room": "Conference Four", "slug": "bsidesatl-2026-103605-you-left-your-threat-model-at-the-office", "url": "https://pretalx.com/bsidesatl-2026/talk/NVCJVJ/", "title": "You Left Your Threat Model at the Office", "subtitle": "", "track": "Community, Career, & Soft Skills", "type": "50 minute talk", "language": "en", "abstract": "Security professionals spend their careers thinking adversarially. Then 5PM hits. At home, the average practitioner has a VPN, Signal, a password manager, and a Ring camera. That's it. That's the plan.\n\nThis talk is about the gap between professional tradecraft and personal risk, and what it actually looks like to close it. We'll cover why the standard compensations fall short, why intelligence professionals face a uniquely asymmetric threat that most handle wrong in both directions, and why the threat landscape now includes a variable that doesn't show up in most personal threat models: ordinary people under economic pressure. Desperation is a threat actor too.\n\nWe'll apply the security/accessibility/usability tradeoff practitioners already understand to the home environment, covering physical security, communications resilience, and the question nobody in this room has a written answer to: what is your incident response plan for a home invasion?\n\nThe methodology is familiar. The target is just closer to home. The call is coming from inside the house, literally.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "FHP7FK", "name": "Joe Gray", "avatar": "https://pretalx.com/media/avatars/8F9UBG_BNmCNkU.webp", "biography": "Joe Gray is a veteran of the U.S. Navy Submarine Force and Expert Cyber Threat Researcher at Kudelski Security. Previously the Founder and Principal Instructor of The OSINTion, he has spent years building practical OSINT and operational security curriculum for students across skill levels.\n\nJoe is the inaugural winner of the DerbyCon Social Engineering Capture the Flag, a distinction that earned him the DerbyCon Black Badge. His CTF record includes winning the TraceLabs OSINT Search Party at DEFCON 28 as a member of The Password Inspection Agency, DEFCON 29 as a member of The Federal Bureau of OH-SHINT, and DEFCON 30 as a member of The Eff Ess Bees. Independently, he placed 2nd in the HackFest Quebec Missing Persons CTF, 4th in the DerbyCon OSINT CTF, and 3rd in the National Child Protection Task Force Missing Persons CTF.\n\nHe is the author of Practical Social Engineering via No Starch Press and the creator of the OSINT tools DECEPTICON Bot and WikiLeaker. His work has been featured in Forbes and Dark Reading.", "public_name": "Joe Gray", "guid": "c9bab2e6-55b4-5e3a-b452-61db4d4e3c89", "url": "https://pretalx.com/bsidesatl-2026/speaker/FHP7FK/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/NVCJVJ/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/NVCJVJ/", "attachments": []}, {"guid": "e657923c-a24d-54b1-ae9d-1ccb17d0a0d0", "code": "MHK8S7", "id": 103667, "logo": null, "date": "2026-10-03T11:30:00-04:00", "start": "11:30", "end": "2026-10-03T11:50:00-04:00", "duration": "00:20", "room": "Conference Four", "slug": "bsidesatl-2026-103667-more-than-a-member-our-experience-investing-in-cybersecurity-affinity-communities", "url": "https://pretalx.com/bsidesatl-2026/talk/MHK8S7/", "title": "More Than a Member: Our Experience Investing in Cybersecurity Affinity Communities", "subtitle": "", "track": "Community, Career, & Soft Skills", "type": "20 minute talk", "language": "en", "abstract": "As the cybersecurity workforce continues to evolve, professionals at every career stage face common challenges: the field moves fast, and the networks that grow careers are rarely built inside a single organization. Community groups, nonprofits, and affinity-driven conferences have emerged to fill that gap, but most professionals engage with them passively, if at all. The difference between attending a community and actually investing in one is rarely discussed, and the returns are even more rarely measured.\n\nThis session examines what investment in cybersecurity community organizations actually looks like and how it benefits individuals and organizations. Attendees will explore the distinction between individual membership and organizational sponsorship, including the different types of access, obligations, and outcomes each model provides. The presentation draws on firsthand experience coordinating two years of involvement in WiCyS (Women in CyberSecurity), from building the internal business case for attendance to presenting at the national conference as a sponsor to illustrating how that engagement evolves over time.\n\nThrough examples drawn from individual career development and organizational strategy, this session addresses the landscape of cybersecurity community organizations, what separates those worth sustained investment from one-off events, and why the health of these communities should be a priority for the entire cybersecurity community. Participants will leave with a practical framework for evaluating community organizations, strategies for making the internal case to organizational leadership, and a clearer understanding of how community investment fits into long-term career and talent development planning.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "ZBKZ8K", "name": "Grace Pfohl", "avatar": "https://pretalx.com/media/avatars/MHPBXA_pWarKXx.webp", "biography": "Grace Pfohl is a Senior Consultant on risk3sixty\u2019s ethOS Compliance Consulting team and serves as the AI Advisory Team Lead. She leads AI governance, security, and privacy engagements, helping organizations implement ISO/IEC 42001 programs as part of broader compliance initiatives through audits, risk assessments, and AI management system implementations.\n\nWith a strong technical background and deep specialization in AI governance, Grace has played a key role in helping organizations achieve some of the earliest ISO/IEC 42001 certifications. She works closely with clients to implement AI management systems aligned with emerging global standards, translating regulatory requirements into practical, risk\u2011based governance programs.\n\nGrace holds both BS and MS degrees in Computer Science from the Georgia Institute of Technology, with a specialization in Human\u2011Computer Interaction. She is a certified ISO 42001 Lead Auditor and Implementer and regularly guides organizations through ISO 42001 implementations and internal audits, helping operationalize responsible AI practices at scale. She is also an active member of the WiCyS community, sharing applied perspectives on AI governance and responsible AI.", "public_name": "Grace Pfohl", "guid": "e728de3a-8c51-51ab-af44-ee1809c87652", "url": "https://pretalx.com/bsidesatl-2026/speaker/ZBKZ8K/"}, {"code": "NEQRQG", "name": "Lindsey Nicholas", "avatar": "https://pretalx.com/media/avatars/E3MVKD_WRwwUPu.webp", "biography": "Lindsey Nicholas is an AI Product Specialist at risk3sixty with a background as both an auditor and GRC program implementer supporting security and compliance initiatives across multiple frameworks. Before moving into product, Lindsey worked directly with organizations to assess, design, and operationalize governance, risk, and compliance programs, giving her firsthand insight into the real\u2011world challenges GRC teams face.\n\nToday, she brings that practitioner perspective into building AI agents for internal teams and customers, focused on automating core GRC workflows while remaining secure, audit\u2011ready, and aligned with enterprise risk expectations. Lindsey\u2019s work at risk3sixty sits at the intersection of compliance expertise and applied AI, helping organizations scale GRC operations without sacrificing trust or control.", "public_name": "Lindsey Nicholas", "guid": "7b281e55-b638-5e66-b823-9cbeb7ccb201", "url": "https://pretalx.com/bsidesatl-2026/speaker/NEQRQG/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/MHK8S7/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/MHK8S7/", "attachments": []}, {"guid": "3496ede7-c975-5796-a8bf-c4c363a083b0", "code": "RBQMUR", "id": 102961, "logo": null, "date": "2026-10-03T13:30:00-04:00", "start": "13:30", "end": "2026-10-03T14:20:00-04:00", "duration": "00:50", "room": "Conference Four", "slug": "bsidesatl-2026-102961-listening-as-a-red-team-tradecraft", "url": "https://pretalx.com/bsidesatl-2026/talk/RBQMUR/", "title": "Listening as a Red Team Tradecraft", "subtitle": "", "track": "Community, Career, & Soft Skills", "type": "50 minute talk", "language": "en", "abstract": "In 2017 I owned a client's domain in under an hour. This year, same scope, I had to beg them for credentials just to get started. My tooling did not get worse. The client got better, because somewhere in those years I stopped talking and started listening.\nRed Teamers train to enumerate, pivot, and escalate. We do not train to ask \"what else?\" and shut up long enough to hear the answer. That gap is where engagements die as 200-finding PDFs nobody reads.\nI'll show how three books from outside our field reshaped how I scope and report. You will leave knowing how the quietest skill in the room turns a findings dump into a client who keeps getting harder to hack.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "LFZKZY", "name": "Qasim", "avatar": "https://pretalx.com/media/avatars/D7HR9R_tTOIhpB.webp", "biography": "Qasim is the Director of Cybersecurity at a leading healthcare organization, overseeing detection, incident response, vulnerability management, purple teaming, and cybersecurity engineering. With a strong background in offensive security and risk management, he has helped organizations strengthen their defenses against evolving threats. Passionate about bridging the gap between cybersecurity and business, Qasim specializes in offensive security and cybersecurity strategy. He is also a dedicated educator, mentoring professionals and sharing his expertise at conferences such as BSides and Black Hat. Committed to advancing cybersecurity in healthcare, he drives innovation in proactive defense and risk management.", "public_name": "Qasim", "guid": "1b9dc015-3beb-5657-90b5-aafb61f513a7", "url": "https://pretalx.com/bsidesatl-2026/speaker/LFZKZY/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/RBQMUR/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/RBQMUR/", "attachments": []}, {"guid": "80e11471-6cf5-5115-9e37-6060d6bb8bdd", "code": "CJZT8S", "id": 103728, "logo": null, "date": "2026-10-03T14:30:00-04:00", "start": "14:30", "end": "2026-10-03T14:50:00-04:00", "duration": "00:20", "room": "Conference Four", "slug": "bsidesatl-2026-103728-chatcve-how-i-used-ai-to-compress-years-of-cybersecurity-learning-into-weeks", "url": "https://pretalx.com/bsidesatl-2026/talk/CJZT8S/", "title": "ChatCVE: How I Used AI to Compress Years of Cybersecurity Learning Into Weeks", "subtitle": "", "track": "Community, Career, & Soft Skills", "type": "20 minute talk", "language": "en", "abstract": "In 51 days I completed a master's in cybersecurity, passed 5 industry certifications on the first attempt, and used what I learned to land an application security role after 400 applications and nearly two dozen interviews. I didn't get there by luck. I used AI as a deliberate accelerant for learning, not a replacement for it. In this talk I'll walk through the exact framework that compressed years of study into weeks, how that same approach led me to discover a CVE, the specific ways I've seen AI wreck entry-level candidates' growth instead of helping it, and a practical playbook for using AI to build real skill rather than the appearance of it. I'll close with where I think AI takes entry-level cybersecurity hiring next.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "SSMDKB", "name": "Brayden Arnold", "avatar": "https://pretalx.com/media/avatars/XTSUFW_BlxI5uz.webp", "biography": "Brayden Arnold is an Application Security Analyst at a Fortune 100 company, where he helps identify, validate, and remediate security findings across the software development lifecycle, translating technical vulnerabilities into risk decisions alongside engineering and development teams. He holds a Master's in Cybersecurity and Information Assurance along with certifications spanning offensive security, GRC, and threat intelligence, and recently earned his first published, high-severity CVE through independent vulnerability research. He continues to build his expertise in application security, penetration testing, and secure development practices, with a growing interest in how AI is reshaping both how practitioners learn and how the threat landscape itself evolves.", "public_name": "Brayden Arnold", "guid": "e90c9412-ae87-5814-aceb-a0f5fb667360", "url": "https://pretalx.com/bsidesatl-2026/speaker/SSMDKB/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/CJZT8S/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/CJZT8S/", "attachments": []}, {"guid": "75c8edfd-0f88-560a-91b9-4e4293cc245d", "code": "F8UTLR", "id": 103037, "logo": null, "date": "2026-10-03T15:00:00-04:00", "start": "15:00", "end": "2026-10-03T15:50:00-04:00", "duration": "00:50", "room": "Conference Four", "slug": "bsidesatl-2026-103037-from-doer-to-builder-reinventing-yourself-in-an-industry-that-never-sits-still", "url": "https://pretalx.com/bsidesatl-2026/talk/F8UTLR/", "title": "From Doer to Builder: Reinventing Yourself in an Industry That Never Sits Still", "subtitle": "", "track": "Community, Career, & Soft Skills", "type": "50 minute talk", "language": "en", "abstract": "In cybersecurity, the skills that got you hired can expire before your first review. Most of us respond by running harder, closing tickets with our heads down. But lasting careers belong to people who can reinvent themselves, and lasting firms belong to those who help them do it.\n\nReinvention isn't a one-time pivot, it's a muscle. Think of it as renovating a house, not demolishing it. You keep the foundation, your judgment and relationships, and rebuild the rooms.\nI lead people strategy at a bootstrapped security and compliance firm, risk3sixty. When you can't simply buy new talent every time the market shifts, building and evolving the people you already have becomes the strategy, not a perk.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "UQDXV3", "name": "Jessica Andree", "avatar": "https://pretalx.com/media/avatars/AECVJZ_tBw2HLA.webp", "biography": "A native of Maryland and a Division 1 tennis player from West Point, she brings a unique blend of discipline, teamwork, and leadership to her role as VP of People & Vibes at risk3sixty.\nAfter graduating from the United States Military Academy at West Point, Jessica served as a human resource officer in the U.S. Army, specializing in talent management and development for combat units and the Army's General Officers. Following her military service, she earned her master\u2019s in leadership from Georgetown University, further honing her skills in people and organizational development.\n\nIn 2020, Jessica joined risk3sixty as an Associate and quickly rose through the ranks, taking on roles of increasing responsibility in the People Operations team. In her current role as VP of People, Jessica leads risk3sixty's Vibes (HR) functions and has been instrumental in building the company's culture of 'Investing in People.'\n\nUnder Jessica's leadership, risk3sixty has built a high-performance culture that values collaboration, continuous learning, and employee wellbeing. She's implemented innovative programs to support employee growth and development, and instrumental in maintaining risk3sixty's employee retention and engagement rates.For Jessica, the key to success is creating an environment where every employee can thrive to keep the flywheel spinning. Her philosophy is simple: \"Take care of your people, and they'll take care of the business.\"", "public_name": "Jessica Andree", "guid": "76b229f1-e770-5452-9f20-72c1c18e0160", "url": "https://pretalx.com/bsidesatl-2026/speaker/UQDXV3/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/F8UTLR/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/F8UTLR/", "attachments": []}], "Conference Six": [{"guid": "5064ef52-2b0a-5abb-928a-0b06405788d9", "code": "EDNSC8", "id": 103162, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T16:00:00-04:00", "duration": "06:30", "room": "Conference Six", "slug": "bsidesatl-2026-103162-dc864-ctf", "url": "https://pretalx.com/bsidesatl-2026/talk/EDNSC8/", "title": "DC864 CTF", "subtitle": "", "track": "Contest", "type": "Full-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "Dc864 would like to return this year to host their ctf. This year it is themed as a diselpunk game development studio. We have complete rework the scoreboard and challenges from scratch to test the competitors on a wide range of challenges from physical test, devsecops, to game binary analysis.", "description": null, "recording_license": "", "do_not_record": false, "persons": [{"code": "RF3SZD", "name": "Rbrins", "avatar": null, "biography": "While I\u2019ve been paid professionally for information security for the past 10 years, I\u2019ve been a tinkering of computer software for many more. I\u2019m the current ctf lead for DC864 but could not make it possible with the rest of the team and their technical abilities. \n\nEmacs should have won the editor war.", "public_name": "Rbrins", "guid": "454e7379-4f22-57fe-a31a-1158d3402c9d", "url": "https://pretalx.com/bsidesatl-2026/speaker/RF3SZD/"}, {"code": "87RHKK", "name": "Scott Goodwin", "avatar": null, "biography": "IT Internal Auditor, Cybersecurity professional\nIf looking to get into the industry, stop by and have a talk.", "public_name": "Scott Goodwin", "guid": "89d7e6c5-a24b-524f-9ee4-c6440a9d9146", "url": "https://pretalx.com/bsidesatl-2026/speaker/87RHKK/"}, {"code": "UQVGLL", "name": "Nick Mansfield", "avatar": null, "biography": "Lead Penetration Tester", "public_name": "Nick Mansfield", "guid": "a2fd39ed-048e-5ec3-8072-73e901e5fb93", "url": "https://pretalx.com/bsidesatl-2026/speaker/UQVGLL/"}, {"code": "DLZVCA", "name": "Luke Kapustka", "avatar": null, "biography": "I'm a professional penetration tester and red team operator. The security community has given me a lot, and I like to give back when I can.\n\nI like hands-on DIY work. I'm like a mad scientist, my house is filled with invisible conveniences that (mostly) work.", "public_name": "Luke Kapustka", "guid": "d18a5064-c7a3-5334-9d16-339fcc14f4ab", "url": "https://pretalx.com/bsidesatl-2026/speaker/DLZVCA/"}], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/EDNSC8/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/EDNSC8/", "attachments": []}], "Conference Seven": [{"guid": "21e50100-34ee-57c5-8276-bd6c392092d7", "code": "MEUQQ3", "id": 105841, "logo": null, "date": "2026-10-03T09:30:00-04:00", "start": "09:30", "end": "2026-10-03T16:00:00-04:00", "duration": "06:30", "room": "Conference Seven", "slug": "bsidesatl-2026-105841-community-partners", "url": "https://pretalx.com/bsidesatl-2026/talk/MEUQQ3/", "title": "Community Partners", "subtitle": "", "track": null, "type": "Full-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "Come visit BSides Atlanta's Community Partners!\n\n- Infragard Atlanta Members Alliance\n\n- Cloud Security Alliance - Atlanta chapter\n\n- Women in Cyber\n\n- Kennesaw State University - Coles College of Business Graduate Degree Programs", "description": null, "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/MEUQQ3/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/MEUQQ3/", "attachments": []}], "Conference Dining Room": [{"guid": "761fcdf8-0a2c-5bc0-9bf6-3d9a647ef981", "code": "R3VLLH", "id": 105839, "logo": null, "date": "2026-10-03T11:30:00-04:00", "start": "11:30", "end": "2026-10-03T12:30:00-04:00", "duration": "01:00", "room": "Conference Dining Room", "slug": "bsidesatl-2026-105839-lunch-wave-1", "url": "https://pretalx.com/bsidesatl-2026/talk/R3VLLH/", "title": "Lunch - Wave #1", "subtitle": "", "track": null, "type": "Lunch", "language": "en", "abstract": "Attendees will receive a ticket for their lunch wave, please adhere to your assigned time. Tickets may be traded with other attendees.", "description": null, "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/R3VLLH/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/R3VLLH/", "attachments": []}, {"guid": "fc7930de-89a4-560b-9005-32ae8d2f0c75", "code": "ZFUJF8", "id": 105840, "logo": null, "date": "2026-10-03T12:30:00-04:00", "start": "12:30", "end": "2026-10-03T13:30:00-04:00", "duration": "01:00", "room": "Conference Dining Room", "slug": "bsidesatl-2026-105840-lunch-wave-2", "url": "https://pretalx.com/bsidesatl-2026/talk/ZFUJF8/", "title": "Lunch - Wave #2", "subtitle": "", "track": null, "type": "Lunch", "language": "en", "abstract": "Attendees will receive a ticket for their lunch wave, please adhere to your assigned time. Tickets may be traded with other attendees.", "description": null, "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/ZFUJF8/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/ZFUJF8/", "attachments": []}], "Hudson Grille - Midtown location": [{"guid": "09f831fa-6ad0-56ac-ac6b-142af7d77b0b", "code": "PJXZRS", "id": 105843, "logo": null, "date": "2026-10-03T18:00:00-04:00", "start": "18:00", "end": "2026-10-03T21:00:00-04:00", "duration": "03:00", "room": "Hudson Grille - Midtown location", "slug": "bsidesatl-2026-105843-after-party", "url": "https://pretalx.com/bsidesatl-2026/talk/PJXZRS/", "title": "After Party", "subtitle": "", "track": null, "type": "Half-day activity (Villages, Workshops, Contests only)", "language": "en", "abstract": "Come join us at the After Party, sponsored by Bishop Fox!\n\nHudson Grille - Midtown location\n\n942 Peachtree Street NE\n\nA nice, easy 15-minute walk from the conference venue!", "description": null, "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://pretalx.com/bsidesatl-2026/talk/PJXZRS/feedback/", "origin_url": "https://pretalx.com/bsidesatl-2026/talk/PJXZRS/", "attachments": []}]}}]}}}