AI
Beyond the Commit: Weaponizing and Hardening GitHub Actions
application securitycloud security
Cybersecurity
NDC Security 2026 2026
NDC Security 2026 is a premier in-person cybersecurity conference specifically tailored for software developers.
35
Talks
Day 1
15 talks
Prompt Hardening - Secure Code Generation Using AI
application securityai security
MCP Security: Keep Your AI Agents from Spilling the Tea
ai securitycloud securityidentity and access
Zero-Knowledge Proofs: Simultaneously ensuring integrity and privacy
cryptography
Securing Code in the Age of AI
application securityai security
Getting Authorization Right in .NET: Patterns, Pitfalls, and Practical Guidance
application securityidentity and access
Beyond Trust: Building Community-Driven Security Analysis for Your .NET Software Supply Chain
application securityai security
Your Website Is Running Code You've Never Seen
application security
Keynote: 25 Years of the Microsoft SDL
application securityai security
What we can learn from the World's Biggest Heists
offensive securitysecurity leadership
How to Know Your Client Is Real: Hardware-Backed Authentication Patterns
identity and access
ASP.NET Core meets OWASP Top 10 2025
application security
Won't somebody please think of the children!?
governance and riskai security
Has your flight been cancelled? You might be eligible for a cybersec session!
application securitymalware and threat intel
sshlogin: securely authenticating to remote Linux systems via a serial or a text-based interface
identity and accessapplication security
Day 2
20 talks
Hijacking Google's CI/CD Through Prompt Injection: The New Era of AI-Based Exploits
ai securityapplication security
Protocol-Hopping C2: Transport-Agnostic Command & Control That Won't Die
offensive securitydefensive security
Worms in our software supply chain - Where do we go from here?
application security
What's New in ASVS V5
application security
Anti-Patterns: How to Not implement a Cloud Security tool
cloud security
From WAN to NAS: A Pwn2Own Journey Through the SOHO Attack Surface
offensive securitynetwork and infrastructure
Secure and Compliant APIs - By Design
application security
Attacking AI
ai securityapplication security
app.alert(1) is the new alert(1): PDFs as a vector to inject JavaScript code in web applications
application securityoffensive security
The Risky Business, of AI Illiteracy
ai securitygovernance and risk
Connecting the dots to go from tabular security incident data to behavioral graph understanding
defensive securitynetwork and infrastructure
Learning security monitoring through failure
defensive security
Who Gave the Agent Admin Rights?! Securing Cloud & AI Machine Identities
ai securityidentity and access
Post-quantum cryptography for .NET developers
cryptography
Breaking the Black Box: Why Testing Generative AI Is Full Spectrum
ai security
Automated Security Testing with OWASP Nettacker
offensive securityapplication security
It is rough without a WAF
application securitydefensive security
AppSec Security: The SDLC in the age of agentic
application securityai security
OWASP Juice Shop: Take your security vitamins!
application security
Three decades of curl
network and infrastructureapplication security