AI
📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️
governance and riskapplication security
Topic
Application Security
Securing the software you build — from threat modeling and secure SDLC to SAST/DAST, API security, and software supply-chain defense.
- threat modeling
- secure SDLC
- SSDLC
- SAST
- DAST
- SCA
- IAST
- RASP
- API security
- web application security
- code review
- DevSecOps
- shift-left security
- dependency management
- software supply chain
- SBOM
- secure coding
- secrets management
- vulnerability disclosure
- CI/CD pipeline security
195
Talks
9
Conferences
BSidesSF 2026
29 talksThe AppSec Poverty Line: Minimal Viable Security
application securitysecurity leadership
The Show Must Go On: Putting on The BSidesSF Program
ai securityapplication security
📗 Web standard consortiums are a game with Chrome as the monopoly man
application securitygovernance and risk
💎 More Role Models in AppSec: How to Get It Right
application securitysecurity leadership
📙 MCPwned: Hacking MCP Servers with One Skeleton Key Vulnerability 🤖
application securityoffensive security
💎 Detecting Race Conditions on macOS
defensive securityapplication security
📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
offensive securityapplication securityai security
📙 One Thousand and One AI-Prevented CVEs: Vibe Coding a Whole New Supply Chain Defense 🤖
application securityai security
Sandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes
cloud securityapplication security
📙 Who Watches the NPM Watchers? 🏗️
application securitymalware and threat intel
📗 The Phantoms of the Fraudpera: An Overview of Anti-Detection Tooling 🖥️
offensive securityapplication security
Breaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
identity and accessapplication security
📙 Level Up Your Threat Modeling: Turning Security Into a Team Adventure 🖥️
application securitysecurity leadership
📙 Hunting Malicious IDE Extensions: Building Detection at Scale Across Developer Workstations 🔥
defensive securityapplication security
📙 Not My Vibe: When AI Coding Agents Go Off the Rails 🤖
ai securityapplication security
📙 From Noise to Notes: Orchestrating SAST with Developers through AI-Driven Remediation 🖥️
application securityai security
📗 Follow the data to learn the secret 🤖
offensive securityapplication security
📗 What happened to the lock icon? ⚖️
governance and riskapplication security
📙 Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026 🖥️
application securitycloud security
📙 Is Q-Day Worse than Y2K? Strategies for Surviving the Quantum Threats
cryptographyapplication security
📙 Running an efficient bug bounty program and PSIRT function 🔥
application securitydefensive security
📗 The great SAST dissonance: how to please every audience, at scale 🖥️
application security
📕 Making WAF Mainstream: From Static Defenses to Living, Learning Protection 🖥️
application securityai security
📗 When the supply chain hits a sour note 🖥️
application security
📙 Breaking Endpoint Anti-Ransomware: Going Browser Native 🏗️
offensive securityapplication securityidentity and access
Prompt, Commit, Repeat: Security at Scale When 1,000 Devs Go AI-Native
ai securityapplication security
📙 Practical (and impractical) git commit signing 🏗️
identity and accessapplication security
📕 AI-Powered AppSec: 10x Your Security Team Without Scaling Headcount 🖥️
application securityai security
KubeCon + CloudNativeCon Europe 2026
18 talksReal-World Supply-Chain Security - Alex Leong, Buoyant
application securitycloud security
Beyond Image Pull-Time: Ensuring Runtime Integrity With Image Layer Signing - Toddy Mladenov, Flora Taagen & Dallas Delaney, Microsoft
cloud securityapplication securitycryptography
Why Isn't the Fix in My Container? Tracking CVE Propagation Across 10,000 Projects - Mor Weinberger, Echo Security & Lior Kaplan, Kaplan Open Source
application securitycloud security
When Multitenancy Goes Wrong: A Deep Dive Into Kcp's First CVE - Marvin Beckers, ClickHouse
cloud securityapplication security
Advanced Kyverno Patterns : Automating Platform Security and Operations - Frank Jogeleit, Nirmata; Johannes Sonner, Deutsche Telekom
cloud securityapplication securitygovernance and risk
Tailor Made: Dynamic Fine-Grained Authorization for API Traffic - Erica Hughberg, Tetrate & Andres Aguiar, Okta
identity and accessapplication securitycloud security
Kubernetes Third Party Audit Review - Iain Smart, AmberWolf; Amir Montazery, Open Source Technology Improvement Fund; Rey Lejano, Red Hat; Tabitha Sable, Datadog; Pietro Tirenna, Shielder
cloud securityoffensive securityapplication security
Automating and Scaling of Threat Modelling for Cloud Native Architecture - Hanna Papirna & Emma Yuan Fang, EPAM Systems
application securitycloud security
Open Policy Agent. (OPA) Intro & Deep Dive - Charlie Egan & Anders Eknert, Apple
identity and accessapplication securitygovernance and risk
Strengthening CNCF Projects: Impact of Security Self-Assessments - Eddie Knight, Sonatype; Bradley Andersen, k8gb; Justin Cappos, New York University; Shuting Zhao, Nirmata; Orlin Vasilev, SUSE
application securitycloud securitygovernance and risk
Kubernetes Security at Shopify Scale: Automating Security Across an Infrastructure Monorepo - Jie Wu & Pulkit Garg, Shopify
cloud securityapplication securitygovernance and risk
Automate Once, Run Anywhere: The Docker Moment for Security Workflows - Nancy Chauhan & Aseem Shrey, ShipSecAI
application securitydefensive securitycloud security
SB💣💣M: Making SBOMs Play Together - Jacopo Bufalino, CNAM & Agathe Blaise, Thales SIX GTS France
application securitycloud securitygovernance and risk
Invisible Guardrails: Enabling Developer Velocity With a Secure Platform - James Elías Sigurðarson & Vignir Hafsteinsson, Asana
cloud securityapplication securityidentity and access
A Bug's-Eye View: Kubernetes SIG Security Explains It All - Ian Coldwater, Independent; Tabitha Sable & Rory McCune, Datadog; Iain Smart, AmberWolf; Mahé Tardy, Isovalent at Cisco
cloud securityapplication securitydefensive security
Cert-manager – Project Update: Beyond 2026 - Tim Ramlot & Maël Valais, Palo Alto Networks
cryptographycloud securityapplication security
Hack Me If You Can: Learning Kubernetes Security Through a Role-Play Battle - Aoi Takahashi, Recruit Co., Ltd. & Keita Mochizuki, NTT DATA Japan Corporation
cloud securityoffensive securityapplication security
Harbor Project - The Maintainers Session - Yan Wang, Broadcom & Vadim Bauer, 8gears
application securitycloud security
[un]prompted 2026
8 talksCode Is Free: Securing Software in the Agentic Future
ai securityapplication security
Heather Adkins & Four Flynn - Evaluating Threats & Automating Defense at Google | [un]prompted 2026
application securityai security
Guardrails beyond Vibes: Shipping Security Agents in Production
ai securityapplication security
Security Guidance as a Service: Building an AI-Native Blueprint for Defensive Security
application securityai security
Piotr Ryciak - Vibe Check: Security Failures in AI-Assisted IDEs | [un]prompted 2026
ai securityapplication security
Dan Guido - 200 Bugs/Week/Engineer: How We Rebuilt Trail of Bits Around AI | [un]prompted 2026
ai securityapplication security
Srajan Gupta - Injecting Security Context During Vibe Coding | [un]prompted 2026
application securityai security
Source to Sink: How to Improve LLM First-Party Vuln Discovery
ai securityapplication security
NDC Security 2026
21 talksBeyond the Commit: Weaponizing and Hardening GitHub Actions
application securitycloud security
Secure and Compliant APIs - By Design
application security
AppSec Security: The SDLC in the age of agentic
application securityai security
sshlogin: securely authenticating to remote Linux systems via a serial or a text-based interface
identity and accessapplication security
It is rough without a WAF
application securitydefensive security
Keynote: 25 Years of the Microsoft SDL
application securityai security
Prompt Hardening - Secure Code Generation Using AI
application securityai security
Worms in our software supply chain - Where do we go from here?
application security
OWASP Juice Shop: Take your security vitamins!
application security
Hijacking Google's CI/CD Through Prompt Injection: The New Era of AI-Based Exploits
ai securityapplication security
Beyond Trust: Building Community-Driven Security Analysis for Your .NET Software Supply Chain
application securityai security
What's New in ASVS V5
application security
Three decades of curl
network and infrastructureapplication security
Has your flight been cancelled? You might be eligible for a cybersec session!
application securitymalware and threat intel
Your Website Is Running Code You've Never Seen
application security
ASP.NET Core meets OWASP Top 10 2025
application security
Attacking AI
ai securityapplication security
Securing Code in the Age of AI
application securityai security
Automated Security Testing with OWASP Nettacker
offensive securityapplication security
Getting Authorization Right in .NET: Patterns, Pitfalls, and Practical Guidance
application securityidentity and access
app.alert(1) is the new alert(1): PDFs as a vector to inject JavaScript code in web applications
application securityoffensive security
DefCamp 2025
8 talksTEE in Web3: Myths, Risks, and Real-World Pitfalls
cryptographyapplication security
Hacking the Edge: Real-World ESI Exploits at DefCamp 2025
offensive securityapplication security
Another One Bites the DAST at DefCamp 2025
application security
Exploring Browser Permissions and Exploiting Permission Hijacking at DefCamp 2025
application securityoffensive security
Poisoning Pidgins in the Park at DefCamp 2025
offensive securityapplication security
Threat Assessment and Remediation Analysis for Nanosatellite On Board Computers at DefCamp 2025
network and infrastructureapplication security
Browser Side-Channel Vulnerabilities: Discovering Installed Apps via URL Protocol Handlers
offensive securityapplication security
Threat Modelling in Modern Systems at DefCamp 2025
application securitygovernance and risk
OWASP Global AppSec USA 2025
18 talksHow Latest Browser Security Features Eliminate Bug Classes
application securitydefensive security
Ultimate Build Power, Itty Bitty Security Controls - OWASP's New Top 10 for Citizen Developer Risk
application securitygovernance and risk
How to Embed Privacy Threat Modeling in Agile Sprint Rituals Without Slowing Teams Down
application securitygovernance and risk
Indirect Prompt Injection: Architectural Testing Approaches for Real World AI/ML Systems
ai securityapplication securityoffensive security
Privacy by Design: What Are Engineers Supposed to Do With That?
application securitygovernance and risk
The Future of AppSec is Continuous Context (Keynote)
ai securityapplication securitysecurity leadership
OWASP VXDF: Is that really vulnerable? Show me the VXDF!
application securitydefensive security
Benchmarking Scanner Blind Spots: How Runtime Context Uncovers Hidden Vulns
application securitydefensive security
Your RPA is Mine: Complete Takeover of RPA Ecosystems
application securityoffensive security
The SCA Balancing Act
application securitysecurity leadership
Lost in Translation: Exploiting Unicode Normalization
application securityoffensive security
From Maturity to Mastery: Accelerating Software Security with OWASP SAMM
application securitygovernance and risk
Two Paths to Security Upskilling: Startup and Enterprise
security leadershipapplication security
Security Champions at Scale: Transforming Security Culture by Aligning Incentives and Gamification
security leadershipapplication security
Beyond the Checklist: Building an AppSec Culture That Engineers Don't Dread
application securitysecurity leadership
Plugins Gone Rogue: Attacking Developer Environments
application securityoffensive security
OWASP Top 10 Annoucement
application securitygovernance and risk
From Soft Skills to Hard Data: Measuring the Impact of Culture and Security Champions
application securitysecurity leadership
DEF CON® 33 Hacking Conference
35 talksNot Just a Pipeline Leak: Reconstructing the Real Attack Behind tj-actions
application securityoffensive securitydefensive security
Escaping the Privacy Sandbox with Client-Side Deanonymization Attacks
offensive securityapplication security
Secure Code Is Critical Infrastructure: Hacking Policy for the Public Good
application securitygovernance and risk
Beyond Assistants: Securing Agentic AI Systems and Multi-Agent Workflows in High-Stakes Environments
ai securityapplication security
What is Dead May Never Die: The Ghost of Internet Explorer in Windows: MapUrlToZone
offensive securityapplication security
Direct Memory, Access Everywhere
application securitynetwork and infrastructure
Passkeys Pwned: Turning WebAuthn Against Itself
identity and accessoffensive securityapplication security
Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen
offensive securityapplication security
Edge of Tomorrow: Foiling Large Supply Chain Attacks By Taking 5k Abandoned S3 Buckets from Malware and Benign Software
application securitycloud securitymalware and threat intel
The DOMino Effect: Automated Detection and Exploitation of DOM Clobbering Vulnerability at Scale
application securityoffensive security
How to secure unique ecosystem shipping 1 billion+ cores?
offensive securitydefensive securityapplication security
Quantum-Resistant Healthcare
cryptographyapplication security
HTTP/1.1 Must Die! The Desync Endgame
offensive securityapplication security
What’s Really in the Box? The Case for Hardware Provenance and HBOMs
application securitynetwork and infrastructuregovernance and risk
State of Open Source in the Federal Government
governance and riskapplication security
Client or Server? The Hidden Sword of Damocles in Kafka
application securitycloud security
Burning, trashing, spacecraft crashing: a collection of vulnerabilities that will end your space mission
offensive securityapplication security
Sometimes you find bugs, sometimes bugs find you
offensive securityapplication security
Unexpected Connections: How a vulnerability in obscure dealer software could have unlocked your car from anywhere
mobile and iot securityapplication security
Paywall Optional: Stream for Free with a New Technique, Recursive Request Exploits (RRE)
offensive securityapplication security
Gold Bug: Puzzle Panel with Friends
cryptographyapplication security
Escaping the Privacy Sandbox with Client-Side Deanonymization Attacks
offensive securityapplication security
Malware in the gist: How malicious packages on npm bypass existing security tools
application securitymalware and threat intel
Weaponizing Trust: Investigating a Threat Actor Targeting Security Researchers and Academics
malware and threat inteloffensive securityapplication security
Safe Harbor or Hostile Waters: Unveiling the Hidden Perils of the TorchScript Engine in PyTorch
application securityoffensive security
Silent Leaks: Harvesting Secrets from Shared Linux Environments
offensive securityapplication security
Breaking the Chain: Advanced Offensive Strategies in the Software Supply Chain
offensive securityapplication securitycloud security
Examining Access Control Vulnerabilities in GraphQL - A Feeld Case Study
application securityoffensive security
Regex For Hackers
offensive securityapplication security
VDP in Aviation - How it shouldn't be done!
application securitygovernance and risk
How API flaws led to admin access to over 1,000 USA dealers and control over your car
application securitymobile and iot security
So Long, and Thanks for All the Phish
offensive securityapplication security
Referral Beware, Your Rewards Are Mine
offensive securityapplication security
Patching Critical Infrastructure: Announcing the Winners of DARPA’s AI Cyber Challenge
ai securityapplication security
7 Vulns in 7 Days: Breaking Bloatware Faster Than It’s Built
offensive securityapplication security
Black Hat USA 2025
12 talksBack to the Future: Hacking and Securing Connection-based OAuth Architectures in Agentic AI and Integration Platforms
identity and accessapplication security
When 'Changed Files' Changed Everything: Uncovering and Responding to the tj-actions Supply Chain Breach
application securitydefensive security
HTTP/1.1 Must Die! The Desync Endgame
application securityoffensive security
Hack to the Future: Owning AI-Powered Tools with Old School Vulns
ai securityapplication security
Lost in Translation: Exploiting Unicode Normalization
application securityoffensive security
Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications
application security
Lost & Found: The Hidden Risks of Account Recovery in a Passwordless Future
identity and accessapplication security
Black Hat USA 2025 | More Flows, More Bugs: Empowering SAST with LLMs and Customized DFA
application securityai security
Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange
application securitycryptography
Let LLM Learn: When Your Static Analyzer Actually 'Gets It'
application securityai security
QUACK: Hindering Deserialization Attacks via Static Duck Typing
application security
Unveiling the Hidden Perils of the TorchScript Engine in PyTorch
application securityai security
OWASP Global AppSec USA 2024
46 talksHow to get developers to want to adopt AppSec
application securitysecurity leadership
OWASP: The Next 25 years
application securitysecurity leadershipgovernance and risk
Slack's Vulnerability Aggregator: How we built a platform to manage vulnerabilities at scale
application securitygovernance and risk
OWASP JuiceShop
application securityoffensive security
GraphQL Exploitation: Secondary Context Attacks and Business Logic Vulnerabilities
offensive securityapplication security
OWASP Top 10 for Large Language Models: Project Update
ai securityapplication securitygovernance and risk
Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail
application securityoffensive security
3 Day Training: Web Application Security Essentials
governance and riskapplication security
Modernizing the Application Penetration Engagement and Reporting Lifecycle
offensive securityapplication security
Hackuracy: Boosting AST accuracy through hacking
application securityoffensive securitygovernance and risk
O My Data: OData Injection attack and other injections in Microsoft Power Platform and UiPath
application securityoffensive security
OWASP Serverless Top 10
application securitycloud security
OWASP Application Security Verification Standard (ASVS)
application securitygovernance and risk
OWASP DevSecOps Maturity Model (DSOMM)
application securitygovernance and risk
Practical Software Supply Chain Security Solutions
application securitygovernance and risk
Bridging Security & Privacy Standards: Harnessing OpenCRE for Effective Mapping
governance and riskapplication security
The Missing Link - How we collect and leverage SBOMs
application securitygovernance and risknetwork and infrastructure
Learning from Past Security Breaches: Strengthening AppSec Efforts and Focus
application securitydefensive securitygovernance and risk
AppSec Meets Project Management: Hacking the Frameworks for Secure Software
application securitygovernance and risksecurity leadership
OWASP Coraza - Web Application Firewall
application securitynetwork and infrastructure
Striding Your Way to LINDDUN: Threat Modeling for Privacy
application securitygovernance and risk
Escaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
application securityai security
Maturing Your Application Security Program with ASVS-Driven Development
application securitygovernance and risk
AI Code Generation - Benefits, Risks and Mitigation Controls
application securityai securitygovernance and risk
Hidden Chains: Revealing High-Impact Bugs from Bounty submissions
offensive securityapplication security
Under the Radar: How we found 0-days in the Build Pipeline of OSS Packages
application securityoffensive security
The Path to Influence: How Three Threat Modelers Can Influence an Entire Organization
application securitysecurity leadershipdefensive security
From Hype to Reality: The Broken State of DevSecOps and Its Maturity Model
application securitysecurity leadership
Don't Make This Mistake: Painful Learnings of Applying AI in Security
application securityai security
Breaking the Mold: Navigating the Intersection of Technology, Security, and Trust (Keynote)
security leadershipapplication security
OWASP Mobile Application Security (MAS)
mobile and iot securityapplication security
Automatic application hardening by leveraging container runtime behavior analysis during CI processes
cloud securityapplication securitydefensive security
Kernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
mobile and iot securityoffensive securityapplication security
From Start Line to Security Finish: Running Your Application Security Program Like a Marathon
application securitysecurity leadership
Web Security Experts: Are you overlooking WebRTC vulnerabilities?
offensive securityapplication securitynetwork and infrastructure
I Know What You Did Last Summer: Lessons Learned from Privacy Breaches and Scandals
governance and riskapplication security
AI Under the Hood: Unmasking Hidden Threats
ai securityapplication security
Millions Of Public Certificates Are Reusing Old Private Keys
cryptographyapplication security
Who Hurt You? Earning the trust of developers
application securitysecurity leadership
Threat Modeling in the Age of AI
ai securityapplication security
OWASP Top 10 Risks for Open Source Software
application securitygovernance and risk
OWASP AI Exchange experts on the future of security for AI
ai securitygovernance and riskapplication security
5 Steps to VEX Success: Managing the End-to-End Workflow
application securitygovernance and risk
OWASP Software Assurance Maturity Model (SAMM)
application securitygovernance and risk
OWASP DefectDojo
application securitygovernance and risk
Learning from "edge of tomorrow" to build an effective security design review program
application securitysecurity leadership