Attendee check-in!
Get your badge, t-shirt, and swag!
We'll try to come up with something clever to say
If you've ever run a cutover, you know the feeling: the old system is going dark and the new one isn't fully up yet. That's where we are in 2026. This spring an AI model found 271 of the 423 security bugs Mozilla fixed in a single month, and more than 100 people wrote the fixes. AI agents keep breaking out to go hacking, and a federal career fair put chatbots in some of its booths. Work is mid-cutover too, and some hiring platforms are reporting 300+ applications for every hire.
This keynote is a year in review of cyber and AI: what went right in 2026 and what's ahead for 2027. Then it turns to the humans in the loop, and what all of this means for work and careers. It covers what the job numbers miss, where AI is adding work and new fields are hiring, how people protect their income, and how to get your work in front of the people who can hire or fund you.
The internet era ran a cutover like this one. In the years after the dot-com bust, whole new kinds of work became official job titles, information security analyst among them. Every cutover needs a runbook. You'll leave with some ideas for yours.
What could Ferris Bueller get up to in the modern day?
This talk is about building that: an AI stand-in for Zoom. The system listens to a meeting transcript as it is happening, decides when and how “I” should respond, generates a response in my speaking style, and routes synthetic audio/video back into the call. If someone says, “turn your camera on for proof,” the goal is to keep the bit going.
I’ll walk through the prototype architecture: capturing my own voice and mannerisms with consent, feeding live meeting context into an agent, generating plausible responses, pushing audio/video through virtual devices, and testing whether a real person can tell when the stand-in breaks.
Remember Ferris already hacked his school’s grade system, so this would be pretty canonically accurate.
Third-party Google Workspace integrations are everywhere, and so are the breaches. Over the past two years, attackers have repeatedly shown that productivity integrations are a reliable path into an enterprise: they carry broad OAuth scopes, they're trusted by users, and they rarely get scrutinized by security teams.
What most organizations haven't inventoried is Google Apps Script, the JavaScript runtime embedded in those integrations and in scripts your own employees are building. It runs in Google's cloud with your users' OAuth tokens, calls external URLs, and executes on a schedule. None of that shows up in your EDR, passes through a code review, or triggers a CASB alert.
This talk covers what that attack surface looks like from both sides.
We start with a supply chain compromise scenario: a Google Marketplace integration that uses Apps Script as remote code execution to exfiltrate Workspace data, propagate itself internally through Drive sharing, and bypass email security controls. The twist is that this attack doesn't require traditional OAuth consent phishing. It rides on scopes the target organization already granted to a legitimate-looking productivity tool.
Then we flip to the defender's side. We walk through three hunting primitives that work today: access_url audit events for detecting external script calls, code analysis via the Apps Script API and Drive enumeration, and a severity ranking framework for prioritizing what to investigate first.
We also cover the real limitations, and what you can do despite them.
Strip away the crayon drawings and here is what K-12 in the U.S. is: an enterprise network serving tens of millions of users, holding Social Security numbers, medical records, disability status, and behavioral data on children, staffed by people whose primary job is not security, under near-constant attack. One breach in 2024 exposed the records of 60 million students and 10 million teachers in a single hit. The sector gets compromised at a rate most industries would declare a national emergency. Nobody is talking about it.
This talk draws on the experience of defending a large urban district serving over 92,000 students, 14,000 staff, and 138 schools. It makes the case that K-12 is not a niche problem. It is the most honest stress test available for defending a high-value, data-rich environment with enterprise-scale exposure and a fraction of enterprise-level resources. The threat patterns, governance failures, defender strategies, and hard lessons from K-12 translate directly to any organization doing more with less.
The Electronic Security Village will be based on a combination of physical and electronic security that will allow attendees to explore and interact with industry equipment. The goal will be to provide attendees an opportunity to bypass common security vulnerabilities on doors, demonstrate the said vulnerability, and how to defend against them.
Chillout Room
When I saw advertisements about a video game cheat providing aimbot functions through realtime screen reading, I was skeptical. But I also saw an opportunity to fight fire with fire, or in this case AI vs AI. What I ended up with was an agentic approach to reverse engineering and malware analysis to make the process more accessible to researchers.
So, this talk is about the methodology, not just the findings. Instead of grepping across hundreds of classes, I asked direct questions like "where does screen capture connect to inference," and got back synthesized, verifiable answers instead of a list of files.
I'll walk through the pipeline that approach uncovered: three custom YOLOv5 models detecting enemies and heads, a dual-PC evasion mode that puts inference entirely off the game machine, and a licensing system more heavily obfuscated than the cheat itself. I'll also cover where the agent got things wrong, where Ghidra had to fill in, and how to structure a dynamic validation environment when your target actively phones home.
If you do reverse engineering, threat hunting, or malware analysis and haven't handed the exploratory work to an agent yet, this talk is the argument for why that's changing faster than you think.
Locks are puzzles and we like puzzles.
"Locksport is the sport or recreation of defeating locking systems. Its enthusiasts learn a variety of skills including lock picking, lock bumping, and a variety of other skills traditionally known only to locksmiths and other security professionals. Locksport followers enjoy the challenge and excitement of learning to defeat all forms of locks, and often gather together in sport groups to share knowledge, exchange ideas, and participate in a variety of recreational activities and contests." - Wikipedia
Without physical security, there is no security. Locks are the foundation on which all security is based. From the consumer to the security professional, it is a vital skill to see through the marketing department to find the appropriate lock for the security needed.
Join us as we explore the world of locksport.
This short-form technical course provides dives into Linux system monitoring using bpftrace, which uses eBPF to capture kernel events. We’ll start with a basic introductory tutorial, then move on to the practical challenges of tracing system calls, and navigating architectural differences (x86_64 vs. ARM64).
After this session, students will be able to:
- Build custom system call traces in bpftrace
- Troubleshoot tracing failures
- Navigate container observability
- Follow best practices and evolve their understanding
Two years ago I gave talks called "Unlocking Hidden Superpowers: Neurodiversity in Security". While the talk was received well, people came up afterward and asked the harder question: okay, I'm hired. Now what?
This talk is the answer I've been building since.
The research has gotten better since 2024, and more practical. We used to treat communication breakdowns as the neurodivergent person's problem to fix; the evidence now says both sides misread each other about equally, which changes who does the work. A single idea about how attention works explains a cluster of things that looked unrelated. And the exhausting part of the job, it turns out, isn't the job. It's performing normal for eight hours on top of it.
Then the part I skipped last time: what security work specifically asks of a neurodivergent brain. On-call rotations. SOC floors built for everything except focus. Clearance questionnaires, polygraphs calibrated to neurotypical baselines, AI hiring screens scoring eye contact. Some of that is fixable. All of it is worth naming out loud.
Most of what gets called a neurodivergent person's problem is a mismatch between a brain and an environment. Environments can be changed. Retention isn't a mystery, it's an engineering problem. You'll leave knowing which parts to change and how to ask for it.
Warning: Presentation still contains cats. Some things don't need evolving.
Dc864 would like to return this year to host their ctf. This year it is themed as a diselpunk game development studio. We have complete rework the scoreboard and challenges from scratch to test the competitors on a wide range of challenges from physical test, devsecops, to game binary analysis.
Come visit BSides Atlanta's Community Partners!
Infragard Atlanta Members Alliance
Cloud Security Alliance - Atlanta chapter
Women in Cyber
Kennesaw State University - Coles College of Business Graduate Degree Programs
Deepfake detectors routinely report impressive benchmark accuracy, but those benchmarks assume the images never leave the lab. In the real world, images are compressed, resized, cropped, filtered, and repeatedly re-encoded as they move across messaging apps and social media platforms, creating a gap between laboratory performance and operational reliability.
This talk presents Imposter, an open-source framework developed to evaluate how common "in-the-wild" image transformations affect modern deepfake detection systems. By comparing two state-of-the-art detection approaches under realistic distortions, the research demonstrates that seemingly insignificant processing can dramatically reduce detection performance for some models, while others remain comparatively resilient. Results show that models relying on local artifact-based features degrade rapidly under even minor compression and resizing, while models leveraging global semantic representations remain substantially more robust.
Rather than focusing on sophisticated adversarial attacks, this session examines the ordinary image processing that every security practitioner encounters every day—and why it represents an overlooked failure mode for AI-powered media forensics. Attendees will see where current detection systems break, why benchmark performance often overestimates operational reliability, and what defenders should consider before trusting deepfake detection in production environments.
Critical infrastructure such as power grids were built for reliability to minimize equipment failure or downtime to the communities they supply. Consequently, power grids often are equipped with decades-old legacy systems with minimal consideration to cyber security. Moreover, power grids leverage protocols that are insecure by design such as DNP3, a protocol essential for power grid communication between SCADA systems and field devices within substations. As cyber attacks targeting critical infrastructure are on the rise, leveraging machine learning for anomaly detection has become a growing initiative in defending power grid communication. This talk presents empirical research evaluating nine classical and deep learning models for DNP3 anomaly detection, deployed and benchmarked on a physical edge device under real hardware constraints. Results challenge the assumption that deep learning is inherently superior for OT detection, with classical models outperforming deep learning on both accuracy and inference speed by over 600 times on physical edge hardware. These findings carry broader implications for how organizations assess their critical infrastructure risk posture, particularly around the assumptions made about detection coverage in operational hardware environments. Furthermore it explores where behavioral detection falls short and why a layered defense strategy that accounts for specific threat categories remains essential for comprehensive DNP3 network protection.
Every MCP talk warns that exposing tools to an LLM is a new attack surface. True, but that's half the story. When we built a production MCP server, the more interesting outcome wasn't the new risk we introduced. It was the old risk we were forced to confront.
Putting an LLM in front of real services means you can no longer trust the caller. You can't assume a well-behaved frontend passes the right tenant ID, or that it hides actions the user shouldn't see. That assumption, that the app in front handles authorization, is one a lot of backends quietly depend on. Building the server correctly meant injecting user permissions at the server layer and enforcing scoping on every tool. Doing that surfaced services that had never been properly authorized. The build became an accidental security audit of the existing application.
This talk covers what that looks like in practice: why you inject identity and permissions at the server rather than trusting the model; why reusing your existing service layer is both an architecture and a security decision; which tools you should refuse to build; where human-in-the-loop and rate limiting belong; and why we had to split the server off shared compute once agents, not humans, became the primary traffic.
If you're building or integrating an MCP server, this is the talk on what it will surface in the systems you already have.
There's a new standard for managing AI responsibly, ISO 42001, and right now it's mostly talked about by people who haven't actually done it. I have. This is the honest, jargon-free field report.
Published in late 2023, ISO 42001 is the world's first international standard for an AI Management System. Think of it as "ISO 27001, but for AI": a structured way for an organization to prove it's using AI responsibly, manage AI-specific risks like bias and data misuse, and stay ahead of fast-moving regulation. With roughly 1 in 5 organizations already using AI and regulators circling, it's about to matter a lot.
But what does implementing it actually involve? In this talk I'll demystify the standard in plain English, what it is, how it's structured, and the 38 controls everyone asks about, and then walk through our real implementation: where we started, what was genuinely hard, where auditors focus, and where most organizations trip up. No certification-body sales pitch, no acronym soup. You'll leave able to explain ISO 42001 to your boss, judge whether your organization should pursue it, and take a concrete first step if the answer is yes.
For decades, the economics of offensive security protected defenders. Turning a CVE into a working exploit took a skilled human researcher days to weeks of expensive, specialized labor — a cost curve that quietly rate-limited how much of the vulnerability backlog ever got weaponized. That curve just collapsed.
We ran a large language model pipeline against a corpus of 3,016 real CVEs and measured, end to end, what it actually costs an autonomous agent to reach a verified working exploit — not a suggestion, a reproduced one. The results reprice the entire threat model. Across the corpus, the median exploit was produced in roughly 13 minutes for about $3 in inference — against a human researcher benchmark measured in weeks. Seventy-four percent of analyzed CVEs were driven to a verified exploit, a meaningful share of them not on CISA's Known Exploited Vulnerabilities list — meaning "not yet exploited in the wild" no longer means "expensive to exploit."
This talk treats exploitation as a unit-economics problem. We'll walk through the measurement methodology (and where it breaks — the CVEs that stayed Unsolved), the cost-per-exploit and time-per-exploit distributions, and what happens to patch prioritization, KEV-based risk models, and attacker ROI when the marginal cost of a working exploit approaches the price of a coffee. We close with the counter-economics: AI-generated remediation measured in the same minutes-and-dollars terms.
Security professionals spend their careers thinking adversarially. Then 5PM hits. At home, the average practitioner has a VPN, Signal, a password manager, and a Ring camera. That's it. That's the plan.
This talk is about the gap between professional tradecraft and personal risk, and what it actually looks like to close it. We'll cover why the standard compensations fall short, why intelligence professionals face a uniquely asymmetric threat that most handle wrong in both directions, and why the threat landscape now includes a variable that doesn't show up in most personal threat models: ordinary people under economic pressure. Desperation is a threat actor too.
We'll apply the security/accessibility/usability tradeoff practitioners already understand to the home environment, covering physical security, communications resilience, and the question nobody in this room has a written answer to: what is your incident response plan for a home invasion?
The methodology is familiar. The target is just closer to home. The call is coming from inside the house, literally.
Everyone's selling the "autonomous SOC." Few are honest about where AI genuinely works in security operations versus where it quietly breaks.
This talk walks the incident response loop — See, Understand, Decide, Act — with a blunt verdict on each stage. AI is strong at investigation and enrichment, barely scratching detection engineering, and mostly wishful thinking on autonomous response.
The centerpiece is a live investigation: a Snowflake Cortex agent triaging a real attack scenario against a well-architected security data lake. You'll watch it reach a verdict — and watch where it gets fooled. I'll work the same alert myself so you can judge for yourself.
You'll leave knowing what to delegate to agents, what never to, and how to tell a real AI-SOC capability from a slide. Because when AI calls a threat benign, you can't fire the agent. A human still answers for it.
Everyone is performing threat modeling for the LLM. Almost no one is doing threat modeling for the decisions made by AI agents.
Modern AI systems do not just create text anymore. They make plans use tools get memory, run code connect to APIs and take actions, onbehalf of users. Every choice brings trust points and ways for attacks that traditional application threat modeling usually misses.
In this session we will go through an example of an agentic system and do a full threat modeling process from the point of view of an attacker. We will find assets, trust points, attacker goals and misuse scenarios before listing threats using STRIDE, MAESTRO, MITRE ATLAS and the OWASP Agentic AI recommendations. Then we will turn those results into security steps that engineering teams can use before launching.
Participants will walk away with a method they can use again and again for checking AI agent systems finding the important places where attacks can happen and putting threat modeling into secure AI development.
In March 2026, people discovered Chipotle's customer-support chatbot would happily solve LeetCode problems and write Python between burrito orders. Within days someone had turned it into a free coding agent running entirely on Chipotle's compute. The internet laughed and moved on, and missed the actual lesson.
The uncomfortable part: nothing was hacked. No protocol cracked, no auth bypassed, no prompt injected. The "exploit" was a faithful reimplementation of the bot's own chat client, wrapped in one thing, an OpenAI-compatible API which instantly dropped a captive support bot into the entire LLM tooling ecosystem: every SDK, every agent, every framework.
This talk names that pattern interface laundering, and argues it's a latent property of nearly every AI feature shipping today. Your support bot, your "summarize" button, your semantic search: if it's reachable and returns model output, someone can re-present it through a standard interface and take it somewhere you never intended. The friction you're counting on as a control gets laundered away in about forty lines of code.
We'll walk the (now-patched) Chipotle case, watch a deliberately vulnerable bot get laundered into a coding assistant on video, and leave with a hardening checklist that assumes the attacker isn't a browser: where to enforce scope, why per-session rate limits are theater, and how to spot the "phantom client" whose absence of human fingerprints gives a proxy away.
Model creators bake safety alignment into open weight models because they do not want to release a personalized Anarchist Cookbook, creating foreseeable harm, public backlash, and legal exposure. Many users want something different: capable models with fewer refusals, fewer restrictions, and less control retained by the developer.
Once the weights are downloaded, who gets the final say?
This talk follows the craft of model lockpicking. Researchers have shown that refusal behavior is not an unchangeable property of a model. It is produced by internal mechanisms that can be identified, weakened, and sometimes removed while much of the capability remains intact.
We will explore the latest research in modifying models to provide less push back or refusals for safety-aligned prompts and what the trade-offs are between refusal reduction and model accuracy.
This is not another prompt jailbreaking talk. Prompt attacks try to persuade a model to bend its rules. Model lockpicking changes the model itself.
Come see how we in the model-cracking community play a cat and mouse game with open weight model makers today, and why safety aligned may describe only the model as it left the factory.
Network pentests don’t ordinarily have time in scope to do significant research on products encountered during the assessment. This has forced many testers to rely on known CVEs instead of hunting for 0-days. LLM agents like Claude Code have strong capabilities for binary analysis and vulnerability discovery. Even large attack surfaces like appliances can be analyzed in hours. Significant vulnerabilities can be turned into exploits and handed to operators to use during pentests and red team engagements.
Attendees will walk away with a better understanding of how to stand up test labs that let LLMs rapidly discover and weaponize vulnerabilities, techniques for keeping agents on task during research, and a multi-pronged approach for assessing appliances, including patch-diffing, SBOM analysis, config review, binary reverse engineering, and fuzzing. We'll release a Claude Code plugin that integrates several of these approaches using tools like Binary Ninja, headless Ghidra, and IDA Pro. If coordinated disclosure completes before the conference talk, we will also release exploits for two critical vulnerabilities in a popular hypervisor management platform.
As the cybersecurity workforce continues to evolve, professionals at every career stage face common challenges: the field moves fast, and the networks that grow careers are rarely built inside a single organization. Community groups, nonprofits, and affinity-driven conferences have emerged to fill that gap, but most professionals engage with them passively, if at all. The difference between attending a community and actually investing in one is rarely discussed, and the returns are even more rarely measured.
This session examines what investment in cybersecurity community organizations actually looks like and how it benefits individuals and organizations. Attendees will explore the distinction between individual membership and organizational sponsorship, including the different types of access, obligations, and outcomes each model provides. The presentation draws on firsthand experience coordinating two years of involvement in WiCyS (Women in CyberSecurity), from building the internal business case for attendance to presenting at the national conference as a sponsor to illustrating how that engagement evolves over time.
Through examples drawn from individual career development and organizational strategy, this session addresses the landscape of cybersecurity community organizations, what separates those worth sustained investment from one-off events, and why the health of these communities should be a priority for the entire cybersecurity community. Participants will leave with a practical framework for evaluating community organizations, strategies for making the internal case to organizational leadership, and a clearer understanding of how community investment fits into long-term career and talent development planning.
Attendees will receive a ticket for their lunch wave, please adhere to your assigned time. Tickets may be traded with other attendees.
Every organization is racing to deploy AI agents. Almost none of them can tell you how those agents authenticate, what they are authorized to access, or how anyone would audit what they did. We spent 30 years building identity and access management for humans and service accounts. Agents break most of those assumptions at once. They act on a user's behalf, they chain calls across systems, and they make decisions no one explicitly approved.
This talk reframes agentic AI as an identity problem, not a model problem. Drawing on 20 years of enterprise identity architecture and recent work deploying AI in regulated environments, I will cover where the real risk lives: over-permissioned agents, confused-deputy attacks, token sprawl, and the audit gap that makes incident response nearly impossible after the fact.
Then we get practical. I will lay out least-privilege patterns for agents, how to scope and monitor agent identities, and a short checklist defenders can use before any agent reaches production. You will leave able to ask sharper questions about the agents already showing up in your environment.
"It took 9 seconds" wrote Jer Crane, founder of PocketOS, after an Ai coding agent deleted his company's entire production database and all backups in a single API call, despite explicit instructions no to. The same month, two more incidents made headlines. Same failure pattern every time, broad credentials, no confirmation gates, and systems designed as if a human is always in the loop.
Ai adoption is moving faster than governance can follow. Security and GRC teams are being left out of the conversations. This session puts them back in it.
Drawing from named, published incidents and mapped directly to NIST AI RMF and NIST Generative AI Profile (AI 600-1), this talk introduces my own actionable AI governance methodology.
You'll leave with a framework you can implement Monday morning, not a document you'll hope to be able to get to read someday. Because someday already happened. It took nine seconds.
AI security teams are being asked to trust systems that triage alerts, write code, classify risk, open tickets, call tools, and recommend action. The usual safety phrase is “human-in-the-loop.” But a human in the loop is not the same as a human in control.
This talk examines the human control layer behind AI-enabled security workflows. I will show how AI governance fails before the model fails: unclear decision rights, weak escalation paths, overloaded reviewers, missing override authority, and governance latency, the gap between machine-speed action and human-speed accountability.
Using practical examples from security operations, vulnerability management, AI coding tools, and enterprise governance, we will ask a simple question: if the AI system is wrong, unexpected, or correct in isolation but dangerous in composition, can the human actually stop it?
Attendees will leave with a field checklist for evaluating AI tools before deployment: what the agent can do, what evidence the human sees, when control transfers, who can override, and how the organization knows the control is working.
This is not an anti-AI talk. It is a pro-adoption talk for security teams that want AI to survive contact with real operations.
Attendees will receive a ticket for their lunch wave, please adhere to your assigned time. Tickets may be traded with other attendees.
Everyone deploying AI agents asks the same question: can these systems be trusted with production access? The industry responds with scores and leaderboards consisting of unauditable assertions from opaque evaluators running unreproducible tests. This talk presents an alternative approach.
I run AI workloads inside a contained execution plane leveraging Firecracker microVMs, closed-world nftables egress, and host-side enforcement to emit a signed evidence artifact for offline verification. The underlying threat model assumes the evaluated workload will achieve guest root and compromise the guest kernel.
I attempted five methodologies to capture guest syscalls from outside the guest: stock VMM, patched Firecracker with KVM guest-debug, host eBPF, sidecar monitoring, and Intel PT. The engineering reality is no such capture can be authoritative under a hostile guest kernel, where process identity and syscall-entry semantics become attacker-authored state. Introspection solves placement rather than attribution. Substrate alteration shifts the architecture along a curve, trading boundary strength for observation fidelity; gVisor detects syscalls because it implements them, thereby expanding the escape surface.
Consequently, I signed the gap instead of concealing it. This architecture treats "unavailable, not observed" as a first-class signed state, causes observation loss to fail closed to indeterminate, and invalidates the run upon detected escape or observation-root failure. The pass condition for the adversarial suite is not the absence of a successful exploit, but that no exploit succeed silently. Attendees leave equipped to answer a fundamental telemetry question: what does data look like when the system lies?
During an incident, teams are rarely short on information. They are short on a shared way to distinguish what they have observed from what they merely suspect. Alerts, dashboards, chat messages, and expert opinions arrive at different speeds, allowing a plausible explanation to harden into “the cause” before the team has tested it.
This talk examines how premature certainty shapes incident response and introduces a lightweight incident reasoning exercise for making assumptions easier to see and revise. Through a short, evolving scenario, attendees will explore how to separate observation from interpretation, preserve competing explanations, surface contradictory evidence, and identify which unknowns matter most to the next decision.
The exercise is designed to work without new software and can be adapted for tabletop exercises, incident reviews, or live response. It does not attempt to tell responders what decision to make. Instead, it gives teams a shared structure for examining how they reached their current understanding and what evidence would cause them to revise it.
Attendees will leave with practical prompts and a reusable exercise they can test with their own teams.
Most compliance programs treat audits as annual fire drills involving manual evidence collection and massive spreadsheets. This session introduces a different approach: Evidence-as-Code, where automated scripts continuously map system configurations to regulatory controls in real-time.
Using a distributed environment as a case study, this talk demonstrates how to build lightweight automation that reduces audit preparation time by 60% while providing engineers with continuous visibility into security posture. We will cover mapping technical configurations to frameworks like HIPAA and SOC 2, identifying configuration drift before it becomes an audit finding, and building evidence pipelines that satisfy both auditors and security teams. Attendees will learn how to turn compliance automation into actual security monitoring.
The Sony PSX DVR is an unusual combination of a PlayStation 2, digital video recorder, and consumer media appliance, which makes it a great platform for reverse engineering. In this introductory presentation, we will walk through our effort to understand the PSX DVR from the circuit board up, using it as a case study for a broad range of hardware and software reverse engineering techniques.
This talk will cover board-level reconnaissance, including identifying components, tracing interfaces, locating memory devices, and discussing approaches for extracting firmware from NAND storage. From there, we will follow the recovered software into Ghidra, demonstrating static-analysis workflows such as memory mapping, identifying code and data, recognizing program structures, documenting findings, and gradually turning an unfamiliar binary into something understandable.
The PSX DVR also contains several architectural and firmware-specific complications that make it more interesting than a typical introductory target. We will discuss how custom processor support and Ghidra language modules can be used when an instruction set is missing or poorly supported, and how hardware observations can guide software analysis.
Finally, we will present an unresolved encryption problem within the PSX DVR ecosystem as an open challenge. This talk is intended for anyone curious about reverse engineering, from beginners looking for a starting point to experienced researchers interested in helping crack a strange piece of Sony hardware history.
Malicious residential proxy networks have become a crucial part of modern cybercrime infrastructure, offering threat actors anonymity and disguising malicious activity. This talk traces the continued evolution of a malicious proxy networks and how it attempt to evade detection.
We begin by discussing what proxy networks are, the differences between benign and malicious proxies, and how a malicious proxy service evolved to hide from defenders. Then we will cover Faceless, a malicious proxy network; and TheMoon, the malware family that targeted IoT devices to feed the malicious network.
Next we will cover the Doppelganger proxy service and Kadnap, the sophisticated new malware family that uses a custom implementation of the Kademlia Distributed Hash Table (DHT) protocol to hide C2 infrastructure within the noise of legitimate peer-to-peer traffic.
In 2017 I owned a client's domain in under an hour. This year, same scope, I had to beg them for credentials just to get started. My tooling did not get worse. The client got better, because somewhere in those years I stopped talking and started listening.
Red Teamers train to enumerate, pivot, and escalate. We do not train to ask "what else?" and shut up long enough to hear the answer. That gap is where engagements die as 200-finding PDFs nobody reads.
I'll show how three books from outside our field reshaped how I scope and report. You will leave knowing how the quietest skill in the room turns a findings dump into a client who keeps getting harder to hack.
Enterprises are bolting AI tools onto their SaaS stack faster than security teams can review them. The threat model most orgs are missing: data sync utilities plus an AI coding assistant equals bulk exfiltration with a long-lived OAuth refresh token and zero admin visibility. This talk covers how a lean enterprise security team built a default-deny enforcement model and an LLM-powered assessment pipeline to govern thousands of OAuth integrations without drowning in manual reviews. Walk away with the governance pattern, the analyst panel + adversarial critic design, and the architectural decisions that make it work at a scale no human-only team can match.
Before an attacker scans a single IP address or sends the first phishing email, they often know far more about your organization than most defenders realize, starting with nothing more than a domain name.
DNS is much more than a naming system. It exposes an organization’s Internet presence in ways defenders may overlook. Every forgotten subdomain, cloud migration, delegated zone, certificate, and trust relationship contributes another chapter to your organization’s Internet story.
Using three real-world incidents, we’ll demonstrate how DNS reveals what you forgot, who you trust, what you built, and how attackers turn those clues into actionable intelligence.
We’ll examine Hazy Hawk’s abuse of dangling CNAME records, the Sea Turtle campaign’s exploitation of DNS trust relationships, and research demonstrating how Certificate Transparency logs expose newly created Internet infrastructure within minutes of deployment.
Attendees will leave with a new perspective on what their own DNS reveals and how attackers use publicly available Internet information long before they make their first move.
We're used to doing threat-modeling on-premise Active Directory in a tiered structure, but applying these same principles to Entra comes with unique challenges. In this talk, we'll take a look at where risk resides not just in IT administrative personnel, but identities who pose risks to the business operations.
This talk will come with real-world examples of identity compromises which were avoidable, either due to gaps in Conditional Access controls or hidden privileges in Entra, and actionable steps to take for reducing risk in any Entra tenant without 3rd party products.
Workload Identity Federation (WIF) is the modern replacement for long-lived
cloud credentials. Microsoft, Google, and AWS all recommend it as a security best
practice: eliminate secrets, reduce risk, adopt federation. What they don't tell you
is that the same feature creates a powerful, largely unmonitored path to privilege
escalation and persistence that most organizations are not prepared to detect.
This talk presents original research into WIF exploitation across Entra ID, GCP,
and AWS, with the deep dive focused on Microsoft Entra ID: the attack
mechanics, the security boundaries, and the detection gaps that make this
technique so valuable to adversaries. You'll see why federated credentials are
stealthier than secrets or certificates at the audit-log level, how a licensing gap in
Conditional Access for workload identities leaves most organizations without the
controls they think they have, and how some of Microsoft's own built-in
boundaries federation chain blocking, token-lifetime enforcement, and more can
hand defenders concrete signals to detect on.
The session closes with a live walk through of FedForge, a multi-cloud WIF
exploitation tool built during this research, demonstrated against a real
engagement: escalating privileges and establishing persistent cloud access after
an on-prem Active Directory compromise. You'll leave knowing how to run this
technique and, more importantly, how to catch it.
Standard prompt injections are fleeting, but what happens when an attacker forces an AI agent to permanently remember a malicious instruction? Welcome to context and memory poisoning—the next frontier of LLM vulnerabilities where attacks outlive the active chat session.
In this fast-paced, 20-minute session, we bypass slide fluff and jump straight into live labs demonstrating how autonomous agents and RAG pipelines can be silently subverted. You will witness a "sleeping agent" attack: an indirect injection that poisons an AI’s thread summary, allowing an attacker to trigger delayed data exfiltration long after the initial interaction has ended.
But we won't leave you undefended. In the second half of this rapid-fire demo, we will pivot to mitigation. We’ll deploy programmatic LLM guardrails and demonstrate the precise architectural boundaries required to intercept and defuse context poisoning before it corrupts your internal data stores.
Attendees will walk away with a clear understanding of persistent AI vulnerabilities and actionable code patterns to secure their organization's AI memory pipelines today.
Security teams invest heavily in endpoint, network, and cloud - but source code repositories remain one of the most under-protected assets in the enterprise. Your repos aren't just code: they contain proprietary logic, hardcoded secrets, infrastructure-as-code, CI/CD pipelines, and deployment keys. They're the blueprint to everything. And attackers know it.
This talk breaks down how adversaries actually target source code platforms: from compromised personal access tokens and CI/CD pipeline poisoning to secrets sprawl, supply chain attacks, and over-permissioned insiders - and walks through a practical, layered defense framework any security team can act on.
We'll cover five layers of defense: identity and access controls, repository hardening, CI/CD pipeline security, secrets detection and response, and audit log-driven monitoring and detection. Each layer includes concrete, actionable guidance: what to configure, what to alert on, and what "good" looks like.
AI voice avatars now need just 30 seconds of audio to sound convincingly human, and LLMs can drive them in real time to run fully automated social engineering attacks. In this talk, I'll share how I built a deepfake vishing agent, an AI "IRS officer" designed to scam victims into paying fake tax debt, in a single afternoon, and briefly walk through the technical stack behind it.
The real focus is what I found testing this attack against commercial AI avatar platforms: guardrails are inconsistent, easily bypassed, and disappear entirely once an attacker runs the pipeline locally with open-source tools. For enterprises, this means voice can no longer be trusted as a verification signal. I'll close with what defenders need to do now to prepare.
In 51 days I completed a master's in cybersecurity, passed 5 industry certifications on the first attempt, and used what I learned to land an application security role after 400 applications and nearly two dozen interviews. I didn't get there by luck. I used AI as a deliberate accelerant for learning, not a replacement for it. In this talk I'll walk through the exact framework that compressed years of study into weeks, how that same approach led me to discover a CVE, the specific ways I've seen AI wreck entry-level candidates' growth instead of helping it, and a practical playbook for using AI to build real skill rather than the appearance of it. I'll close with where I think AI takes entry-level cybersecurity hiring next.
We analyzed hundreds of router firmware images and uncovered numerous critical vulnerabilities, including remote code execution in devices that you might be using at home today. We’ll break down the most significant findings from our project, how they were discovered and validated, and the recurring flaws that appeared across vendors and product lines. We’ll also examine what large scale firmware analysis reveals about the state of consumer router security.
Welcome to critical heaven.
Cybersecurity incidents affecting operational technology (OT) and industrial control systems (ICS) increasingly threaten the reliability and safety of critical infrastructure sectors such as electric power, oil and gas, and manufacturing. A recent survey, reported in the Wall Street Journal May 28, 2026 revealed that nearly two-thirds of CEOs at blue-chip firms cited cyberattacks as their biggest concern in the second quarter, up from 56% in the previous three-month period. Rapid advances in frontier AI models, like Anthropic’s Mythos and OpenAI’s GPT-5.5, also have many companies worried that hackers will be able to identify vulnerabilities several times faster than cybersecurity teams can patch them.
While current cybersecurity frameworks focus primarily on technical controls, many incidents originate from organizational, procedural, and human factors. In contrast, the nuclear industry has long addressed comparable systemic risks through defining and anchoring a nuclear safety culture within each of the US nuclear plant operating organizations. This paper provides a roadmap on how executive leaders can utilize the US nuclear power industry's safety culture experience for strengthening cybersecurity resilience in critical infrastructure environments.
By integrating nuclear safety culture principles into cybersecurity governance, critical infrastructure operators can strengthen both prevention and resilience against cyber-physical threats. The paper concludes by outlining practical recommendations for adapting nuclear safety culture concepts to cybersecurity programs, including leadership engagement, operational training, incident reporting mechanisms, and regulatory frameworks.
This presentation provides an introductory overview of Windows system calls (syscalls), their role within the operating system, and their significance in modern security research. Syscalls serve as the interface between userland applications and the Windows kernel, enabling programs to perform privileged operations through functions exposed by ntdll.dll. The presentation explores the structure of NtFunctions, syscall service numbers (SSNs), and the mechanics of how syscall instructions are generated and executed. Common methods for resolving SSNs, including dynamic discovery and hardcoded approaches, are examined along with the challenges introduced by differences across Windows versions. The presentation compares direct and indirect syscall methods, and discusses their advantages and limitations. The goal is to provide security practitioners with a foundational understanding of syscall internals, detection strategies, and the practical considerations involved in both exploiting and defending syscall based attack vectors.
In cybersecurity, the skills that got you hired can expire before your first review. Most of us respond by running harder, closing tickets with our heads down. But lasting careers belong to people who can reinvent themselves, and lasting firms belong to those who help them do it.
Reinvention isn't a one-time pivot, it's a muscle. Think of it as renovating a house, not demolishing it. You keep the foundation, your judgment and relationships, and rebuild the rooms.
I lead people strategy at a bootstrapped security and compliance firm, risk3sixty. When you can't simply buy new talent every time the market shifts, building and evolving the people you already have becomes the strategy, not a perk.
When we threat model an application, we map endpoints, look for unpatched dependencies, and scan for leaked credentials. But we consistently ignore the software, processes, and AI agents enforcing the rules. As security organizations aggressively shift to Policy-as-Code and deploy automated RAG-based AI compliance engines to audit frameworks like ISO 27001 or NIST, our governance layer is becoming a highly privileged, highly soft target.
This talk dissects how attackers exploit predictable corporate milestones and breach the very tooling stacks designed to audit them. We will look at how an adversary can weaponize automated compliance pipelines via document data poisoning and prompt injection to force false-positive checkmarks on insecure architectures. Finally, we will step through how we can harden our operational governance workflows, ensuring our automated gatekeepers aren't turned against us.
Have you ever been looking at a pcap in Wireshark and gotten overwhelmed by the sheer number of packets? Wireshark is a great tool but looking at network traffic packet by packet often results in losing the plot of the story. It's much easier to read a story if it has chapters, a table of contents, and an index.
SO-CRATES is a new free and open source project that can help you tell the story whether you are analyzing pcaps, binaries, or log files. Designed from first principles, it's a single container image that is simple yet tremendously powerful. In this talk, we'll discuss the reasons for building a new tool, how it compares to existing tools, and then see how you can view network alerts, file alerts, and log alerts. We'll then dive deeper into browsing network metadata (DNS, HTTP, TLS, flows), extracting ASCII transcripts, viewing per-packet hexdumps, and carving individual streams.
As AI continues to reshape industries, organizations are increasingly confronted with new ethical, compliance, and security challenges. AI systems, whether predictive or generative, are rapidly being integrated into business processes, decision-making, and customer engagement, introducing risks that traditional governance structures may not fully address. This session explores how organizations can implement effective AI governance to balance innovation with accountability, transparency, and trust.
Attendees will gain a foundational understanding of AI systems as they relate to information security and privacy, their shared responsibility model, and the implications of AI adoption across roles, from model developers and cloud service providers to end users. The presentation highlights how emerging compliance frameworks, such as ISO/IEC 42001 (AI Management Systems), ISO/IEC 23894 (AI Risk Management), and the NIST AI Risk Management Framework, provide structure and guidance for managing AI responsibly.
Through examples drawn from real-world consulting and auditing experiences, presenters will examine the growing regulatory landscape, including the EU AI Act and evolving U.S. state laws, and discuss the implications for compliance and assurance programs such as SOC 2 and HITRUST. Participants will leave with practical strategies to identify AI-related risks, conduct AI system impact assessments, and integrate AI governance into existing compliance frameworks, preparing their organizations to thrive responsibly in the age of AI.
Salesforce environments rarely stand alone. Pen testers and defenders inherit Salesforce Core, Marketing Cloud, Snowflake data estates, backup platforms, and a sprawl of integrations. Each surface uses different APIs, auth models, and blind spots. Manual checklist reviews do not scale, and generic cloud scanners miss platform-specific risks such as guest-user Aura exposure, Snowflake service accounts tied to employee emails, and SFMC Data Management FTP users with non-expiring passwords.
SalesforceSecure (sfaudit) is an open-source, read-only auditing CLI that runs structured checks across these surfaces and produces JSON, Markdown, and client-ready HTML reports. The tool integrates with SFDX, Snowflake REST and SQL APIs, SFMC installed packages, and Own (OwnBackup). Findings include severity, CWE references, and NIST-aligned control language where applicable.
This session walks through misconfiguration patterns seen in authorized assessments, demonstrates end-to-end audit workflows in lab or sandbox environments, and shows how to scope checks, interpret results, and pair automation with manual validation guides. Attendees leave with a repeatable methodology and a tool they can run on the next authorized engagement.
AI-powered code reviewers need access to the same source code, configuration files, credentials, and business logic they are supposed to protect. Without appropriate safeguards, the security tool itself can become a data-exfiltration risk.
This talk shares practical lessons from building an open-source AI-assisted SAST auditor that operates through VS Code, the command line, and CI pipelines. We will examine how an agent can scout a codebase, trace authentication and authorization paths across files, verify suspected vulnerabilities, and produce structured findings containing CWE mappings, attack vectors, proof-of-concept steps, verification evidence, and remediation guidance.
We will also threat-model the auditor itself. Topics include repository sandboxing, secret redaction before model access, prompt injection through source-code comments, false-positive reduction, incomplete coverage, and the limits of static AI analysis.
A short demonstration will show the difference between recognizing suspicious code and verifying an exploitable path. Attendees will leave with a practical checklist for introducing LLM-based tools into application-security workflows without blindly trusting the model or exposing the code those tools are intended to protect.
Dive into the current landscape of User Account Controls (UAC) and bypasses that are currently available to threat actors, red teamers, and penetration testers alike using Living Off the Land Binaries (LOLBAS).
Time to end the day by giving stuff away, then get to the after-party!
Come join us at the After Party, sponsored by Bishop Fox!
Hudson Grille - Midtown location
942 Peachtree Street NE
A nice, easy 15-minute walk from the conference venue!