Conference Schedule

After years of phishing and physical social engineering engagements (plus a career in law enforcement spent being lied to professionally), I’ve learned that deception rarely beats our logic. The Deception Masterclass looks at the psychology behind why smart, skeptical people still hold the door, click the link, and read out the MFA code, and why most of us are far worse at spotting lies than we think. Building on research from behavioral science and real-world tradecraft, this talk teaches defenders how to recognize and resist manipulation and teaches red teamers how to weaponize it.

Social engineering & the human layer

North Korean IT worker operations need other people's identities, so I invented a persona and reached out to one. From April to June 2026, an operator walked a fake college student through handing over my LinkedIn and Gmail logins, pitched me a front company with a card price analytics product, and offered a 50/50 split if I would do his job interviews. This talk covers what they asked for, what they said, and how to spot it.

Cybercrime, fraud & OSINTSocial engineering & the human layer

A pull request was opened. Not merged. Not even reviewed, the CI checks just ran. An attacker walked out with the secrets. Attackers rarely break into a CI pipeline; the pipeline opens the door, hands them a token, and politely runs their code. This talk tells that story through three of the past year's worst GitHub Actions supply-chain breaches: Nx S1ngularity, the reviewdog/tj-actions cascade, and Shai-Hulud v2. We don't just recap them, we recreate their root causes live, watching untrusted pull-request data walk straight into a privileged workflow and chain from one careless pull_request_

AppSec, CI/CD & supply chain

AI coding assistants are increasingly running our code in hosted sandbox environments. But how secure are these black boxes? I built an ecosystem called tunnel.pizza to find out. By adding a simple startup script to a major AI platform's code environment, I was able to spawn a reverse shell and get a live bash console directly into their infrastructure. This talk demonstrates the mechanics of this reverse shell, how to interactively explore hosted execution environments, and what security teams need to know to defend against untrusted compute access.

Securing AI agents & LLM appsOffense, exploitation & Windows internals

AI has been part of security long enough that we can finally stop treating it as either magic or the end of the world. This talk takes a skeptical look at the myths surrounding AI security, from replacing analysts and supercharging attackers to prompt injection and autonomous hacking. Space Rogue separates hype from what we’ve actually learned and argues that many AI security failures are familiar problems in new packaging: excessive permissions, weak isolation, poor oversight, and misplaced trust. AI changes the tools, but security fundamentals still apply.

AI strategy, risk & hype

Welcome to Philadelphia! Home of the cheesesteak, soft pretzels, Tastykakes, and some rather interesting cybersecurity stories. Normally, a Philly food tour means walking the city, arguing about who makes the best cheesesteak, and eating more than any reasonable person should. This one is different. Nobody’s getting fed, we’re not walking anywhere, and hackers managed to get involved. Come hungry for stories and leave with a new appreciation for what it takes to keep your favorite foods available. Please don’t ask whether Pat’s or Geno’s is better. I’m not starting that fight.

Cybercrime, fraud & OSINT

Most incident response plans are written for the incident someone imagined, not the one the organization actually gets, and most tabletop exercises end up confirming the plan instead of breaking it. This talk covers building IR playbooks and exercises designed to fail productively: stress-testing decision points, communication chains, and legal or regulatory notification triggers before a real incident does it instead. Drawn from both playbook development and live exercise facilitation, it covers what separates a paper plan from an organization that actually recovers, and how current breach no

Incident response & ransomware

An EDR alert names a host. An identity alert names a UPN. Neither tells you what that system does for the business, who uses it, or what an attacker could reach from it. Static criticality ratings and CMDB tiers go stale the day they are written, and timelining only shows what your telemetry saw. This talk demos MasterBlaster, a technology-agnostic API layer between your SIEM and BloodHound that precomputes business context, observed and potential access into durable facts, so when an alert fires, one API call tells you how much it matters.

Detection engineering & threat hunting

ike computers are smart devices mounted to handlebars that record rides a cyclist goes on with GPS and sensor data, then uploads it to a backend cloud for users to view and share. In the pursuit of modifying my own to add new functionality, I discovered a fleet wide issue that effectively turns each device into a beacon shouting out a riders personal info and credentials at all times while in range. This talk covers the full discovery process of the exploit and shines a lite on why security matters in all industries.

Hardware, OT, RF & physical infrastructure

Going AFK (away from keyboard) means a lot of things. For an infosec worker, hacker, technologist--whatever your flavour--exercising their First Amendment rights these days, it means serious preparation and answering hard questions. It means finding the safest and most survivable course of action for yourself and your group. Security-minded planning for events demands site surveys, proper clothing and tools, digital privacy, escape and evasion, and checklists for all of it. Let's cover some of these essentials and give ourselves a head start.

Career, community & communication

Cybersecurity is full of guidance about what organizations should fix—but far less is said about what security leaders intentionally choose not to fix. Every CISO operates with finite budgets, technical debt, competing business priorities, and more risk than any organization can realistically eliminate. This panel brings together experienced cybersecurity leaders for a candid conversation about the uncomfortable reality of risk acceptance.

GRC, risk & vendor management

At some point in your career you’re going to be asked to talk about what you’ve been working on. Awesome! The catch? Your audience isn’t your technical peers. They are, to put it frankly, not a nerd. They may even be an executive or C-suite officer. How do you communicate your work to them? This talk will give you some tips for getting started.

Career, community & communication

When a critical security incident strikes, the technical tools matter, but human leadership determines whether the operation succeeds or collapses. This talk pulls back the curtain on modern incident command in 2026, examining the high-stakes reality of managing major breaches under intense pressure. Attendees will explore the friction between technical triage and stakeholder communication, learning how to maintain team morale, clear roadblocks, and steer high-stress operations from chaos to containment.

Incident response & ransomware

What happens when native offensive tradecraft goes fileless? This talk pushes PowerShell beyond scripting, bringing WinAPI, NTAPI, direct and indirect syscalls, and process injection into a managed runtime. Through real-world successes, failures, and a working POC, this talk explores AMSI, CLR, AV/EDR visibility, and AI-assisted development revealing just how far PowerShell can go and what defenders can do to detect it.

Offense, exploitation & Windows internals

What happens when systems can no longer trust where they are? From spoofed navigation signals to disrupted critical infrastructure, attacks on geolocation services are becoming a real-world threat. This session explores the evolving cyber risks facing location technologies and provides practical lessons for securing resilient, trustworthy positioning systems in an increasingly connected world.

Hardware, OT, RF & physical infrastructure

Space systems are critical to modern life, underpinning communications, weather forecasting, navigation, internet access, and much more. The cost-to-orbit has also decreased dramatically over the past few years, making it easier for organizations to put hardware into space. Yet, many defenders lack visibility into their full threat surface, including how attackers have historically exploited space systems and how prevalent these targets have become today. This session provides an introductory overview of the broad attack surface facing satellites and space systems, ranging from specialized ne

Hardware, OT, RF & physical infrastructure

This talk will cover the rapidly shrinking validity period for end entity public certificates. With the CA/B forum about to cut the certificate lifecycle in half this March, it is now time for organizations to truly understand what impact this has based on their staff levels and how many certificates they manage. This session will make the CA/B clock rulings clear and provide real actionable recommendations that conference participants can take back to their company for success!

Cryptography & post-quantumIdentity, auth & secrets

The nastiest game cheats don't live in the game, and the nastiest malware doesn't live in your apps. Both run in kernel mode—often by exploiting or loading vulnerable drivers—where user-mode software simply can't see them. So anti-cheat, EDR and antivirus went into the kernel too. Now it's two drivers at the same privilege level, and whoever loads first, hides best, or blinds the other wins. The Windows Runtime Attestation Report breaks that stalemate using Virtualization-Based Security (VBS) and cryptography.

You've read the headlines: AI is coming for cybersecurity. Then you fired up fable, asked "what is cyber," and got told your question tripped a guardrail. This talk breaks down the wall between the hype and the work. We show how a real red team uses AI as a force multiplier across research, development, and operations. And no, before you ask, we're not running that automated pentest bot you saw on GitHub, X, and YouTube.

Offense, exploitation & Windows internalsAI for defenders

By impersonating employees and outwitting common identity verification procedures, threat actors use phone-based social engineering attacks against IT help desks to achieve account takeover in ways that bypass security controls. This talk will reveal just how easy it is to circumvent common verification procedures and explain why and how these processes fail. Attendees will learn practical, best-practice methods for verifying employee identities over the phone and thwarting social engineering attacks.

Social engineering & the human layerIdentity, auth & secrets

Passkeys are now the default auth method in Entra ID, but that just scratches the surface of a successful passkey rollout. In this session we’ll explore what things look like in an enterprise that has only allowed phishing-resistant authentication for the last year and change. What’s worked, what’s sucked, and what still needs to be done, with actionable takeaways to start or accelerate your organizations own passkey journey.

Identity, auth & secrets

An experienced ransomware negotiator takes you behind the scenes of Threat Actor Communications (TA Comms or TACOs) in the high-stakes reality of ransomware response. Drawing on extensive field experience across threat actors ranging from infamous outfits to unknown newcomers, this talk breaks down the strategic methodology and adaptability required to negotiate effectively. As a special feature, learn two previously undisclosed cases from RansomHub's mysterious collapse, including first-hand evidence of administrators defrauding their own affiliates during high-value negotiations.

Incident response & ransomware

As cybersecurity individuals (directly or adjacent), we are constantly and frequently exposed to and informed of all the “latest and greatest” of threats, exploits, emerging technology, and more. We are challenged to consume this and better ourselves, fellow workers, or the business. What has lapsed to be realized, is that much of our focus has been on present needs, less so in our “future selves”. This presentation will discuss ways an attendee can use their work skillset to bolster their community, so they contribute towards a better #communityimmunity for safer cyber education for all.

Career, community & communication

While popular coding agents excel at building security tools for SOC and threat hunting, they trap teams in single-vendor ecosystems where model refusals can disrupt defense workflows. Security engineers need the freedom to swap models—Anthropic, OpenAI, Gemini, or local open source—and correlate across multiple SIEM/EDR tools without vendor lock-in. This talk demonstrates how to build vendor-agnostic blue-team agents using frameworks like Pydantic AI, paired with OpenTelemetry for deep observability, to optimize development, reliability, and runtime performance.

AI for defenders