AI
📕 A Worm in the Apple: Wormable Zero-Click RCE in AirPlay Impacts Billions of Apple and IoT Devices 🖥️
offensive securitymobile and iot security
Cybersecurity
BSidesSF 2026 2026
Security BSides San Francisco is a two-day information security conference. It is a conference by the community for the community.
87
Talks
Day 1
87 talks
Let's Do the Timewarp Again! A Look Back to Move Forward
security leadershipgovernance and risk
📙 What a False Alarm Taught Us About Security as a 2-Person Startup 🔥
defensive securitycloud security
📙 The Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud 🏗️
cloud securityidentity and access
📙 So you think you can airgap? (No.) 🏗️
cloud security
📙 Kidnapping a Library: How Ransomware Taught the British Library to Follow Well-Known Best Practices 🏗️
malware and threat intelgovernance and riskdefensive security
📙 From $10 to $30M: Operating in the Data-Extortion Aftermath 🔥
defensive securitymalware and threat intel
📙 From pocket to Pwn: How we hacked a multinational Corp for $200 with what's in our pockets 🏗️
offensive securitymobile and iot security
📙 The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns 🔥
identity and accessdefensive security
📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
offensive securityapplication securityai security
📙 The Trusted Platform Module 🖥️
cryptographydefensive security
📙 Is Q-Day Worse than Y2K? Strategies for Surviving the Quantum Threats
cryptographyapplication security
📗 You Just Might Find, You Get What You Need: How MS Became My Unlikely Success Story
security leadership
📗 Gettings PCAPs from Stingrays for $20 with Rayhunter
mobile and iot securitynetwork and infrastructure
📗 Web standard consortiums are a game with Chrome as the monopoly man
application securitygovernance and risk
📙 How to Be a GRC Hero (Without Heroics) ⚖️
governance and risk
📙 AI as an Accountable Entity: Governing Risk When Machines Make Decisions ⚖️
ai securitygovernance and risk
📗 Your Arch-Nemesis is a Data Scientist: What's the Difference Between Security and Privacy Work? ⚖️
governance and risk
📗 Cringe, Corrected: Hot Takes Fixed by the CIS Controls ⚖️
governance and risk
📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️
governance and riskapplication security
📗 The Phantoms of the Fraudpera: An Overview of Anti-Detection Tooling 🖥️
offensive securityapplication security
📙 Securing Space: The Next Frontier for Security Engineers 🏗️
network and infrastructureoffensive security
📗 Lessons Learned from Building Custom Hacker Hardware 🏗️
offensive securitynetwork and infrastructure
📙 Demystifying File Similarity for Malware Detection 🔥
malware and threat intel
Prompt, Commit, Repeat: Security at Scale When 1,000 Devs Go AI-Native
ai securityapplication security
📗 What happened to the lock icon? ⚖️
governance and riskapplication security
💎 Elevating First-Time Female Voices on Stage
security leadership
💎 More Role Models in AppSec: How to Get It Right
application securitysecurity leadership
📙 Breaking Endpoint Anti-Ransomware: Going Browser Native 🏗️
offensive securityapplication securityidentity and access
💎 Detecting Race Conditions on macOS
defensive securityapplication security
💎 Practice Cyber Skills Like a Musician
security leadership
📗 You’re Gonna Be Popular: Why They’re Getting a Callback and You’re Not
security leadership
📗 How the Vietnam War created single sign-on — and how it's evolved since
identity and access
📗 Building an open source security project with 1M+ installations ⚖️
identity and accessgovernance and risksecurity leadership
📙 A blueprint for building a generic authorization service for your organization 🏗️
identity and access
📙 Red Teaming from outside: Identifying and exploiting SaaS systems for access 🏗️
offensive securitycloud security
The Show Must Go On: Putting on The BSidesSF Program
ai securityapplication security
📙 Your Load Balancer is Your New Perimeter: Attacks & Defenses at Scale 🏗️
network and infrastructurecloud security
📙 Practical (and impractical) git commit signing 🏗️
identity and accessapplication security
📙 RBAC Atlas: Mapping Real-World Kubernetes Permissions and Exposing Risky Projects 🏗️
cloud securityidentity and access
Sandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes
cloud securityapplication security
📙 Who Watches the NPM Watchers? 🏗️
application securitymalware and threat intel
📗 Orchestrating Resilience: Composing a New Score for Netflix Service Reliability 🏗️
defensive securitycloud security
📗 Google Drive Hunter: Building the Tool Google Should’ve Built 🏗️
cloud securitydefensive security
📕 AI-Powered AppSec: 10x Your Security Team Without Scaling Headcount 🖥️
application securityai security
Breaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
identity and accessapplication security
📙 Level Up Your Threat Modeling: Turning Security Into a Team Adventure 🖥️
application securitysecurity leadership
📙 Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026 🖥️
application securitycloud security
📙 Security on a Shoestring: A Low-Budget Security Revival Tour 🖥️
governance and risksecurity leadership
📙 From Assistant to Assassin: Weaponizing An OpenClaw Vulnerability to Achieve 1-Click RCE 🖥️
offensive securityai security
📗 The great SAST dissonance: how to please every audience, at scale 🖥️
application security
📙 From Noise to Notes: Orchestrating SAST with Developers through AI-Driven Remediation 🖥️
application securityai security
📗 When the supply chain hits a sour note 🖥️
application security
The AppSec Poverty Line: Minimal Viable Security
application securitysecurity leadership
📕 Making WAF Mainstream: From Static Defenses to Living, Learning Protection 🖥️
application securityai security
📗 The Epistemology of Trust 💼
security leadershipgovernance and risk
📙 The Risky Business of Risk Illiteracy 💼
governance and risk
Ask the EFF Panel
governance and risk
CISO Series Live Podcast Recording
security leadershipgovernance and riskai security
📙 How to sell your soul, err, your security program 💼
security leadership
📙 Power Dynamics in Security Leadership: a legato leitmotif lullaby on leading lightly and luminously 💼
security leadership
📙 We Pwn the Night: Growing & Leading an 31337 security research team 💼
security leadershipoffensive security
📙 From Auditions to Opening Night: Selecting Security Tools that hits the high notes 💼
security leadership
AI for security - friend or foe?
ai securitydefensive security
🎤 Architecting the Modern SOC: The Evolving AI Reality for Blue Teams 🔥
defensive securityai securitygovernance and risk
📕 CloudShell Hide-n-Seek: enjoying the sweet persistent sounds of silence! 🔥
cloud securityoffensive securitydefensive security
📙 Running an efficient bug bounty program and PSIRT function 🔥
application securitydefensive security
📗 Threat Chords: Tuning into Persistent Patterns in Adversary Behavior 🔥
malware and threat intelidentity and access
📗 Composing the Response: Building an Incident Pipeline from Scratch 🔥
defensive security
📙 Incident Readiness You and Your Leaders Will Actually Trust 🔥
defensive securitycloud security
📙 Detection Allegro: Composing Detection Rules with Agentic Workflows 🔥
defensive securityai security
📕 Your AI Agent Has Production Access: Now What? 🔥
ai securitydefensive security
📗 The Phaaaaaaaaantom of the Salt Typhoon is there, inside i-SOON 🔥
malware and threat intel
Detection at Scale: Abstracting Detection Intent
defensive security
📙 Anatomy and Defense of LOTL Fileless Intrusions 🔥
defensive securitymalware and threat intel
📙 Hunting Malicious IDE Extensions: Building Detection at Scale Across Developer Workstations 🔥
defensive securityapplication security
📙 Conducting the Kill-Chain: Detecting APT Progression Through Music-Sequence Modeling 🤖
defensive securityai security
📕 Pwning and Defending AI Agent Code Interpreters 🤖
offensive securitycloud securityai security
📕 Security for AI Agents Using an Ensemble of Fine-tuned Small Language Models 🤖
ai security
📙 Increasing the Analysis Surface of Large Language Models 🤖
ai security
📙 One Thousand and One AI-Prevented CVEs: Vibe Coding a Whole New Supply Chain Defense 🤖
application securityai security
📗 How We Red-Teamed Our Own AI Agent: Lessons from Operation Pale Fire 🤖
ai securityoffensive security
📙 Reverse Engineering Go Malware: From Manual to AI-Powered Analysis 🤖
malware and threat intelai security
📙 MCPwned: Hacking MCP Servers with One Skeleton Key Vulnerability 🤖
application securityoffensive security
📗 Follow the data to learn the secret 🤖
offensive securityapplication security
📙 Saving Bug Bounties from AI Slop 🤖
offensive securityai security
📙 Not My Vibe: When AI Coding Agents Go Off the Rails 🤖
ai securityapplication security