AI
📕 Your AI Agent Has Production Access: Now What? 🔥
ai securitydefensive security
Topic
Defensive Security
Catching attackers in your environment — detection engineering, SOC operations, incident response, threat hunting, and forensics.
- blue teaming
- detection engineering
- SOC operations
- incident response
- threat hunting
- SIEM
- SOAR
- EDR
- log analysis
- alert triage
- digital forensics
- memory forensics
- network forensics
- security monitoring
- deception technology
- honeypots
- purple teaming
105
Talks
9
Conferences
BSidesSF 2026
20 talks📙 Kidnapping a Library: How Ransomware Taught the British Library to Follow Well-Known Best Practices 🏗️
malware and threat intelgovernance and riskdefensive security
💎 Detecting Race Conditions on macOS
defensive securityapplication security
📙 From $10 to $30M: Operating in the Data-Extortion Aftermath 🔥
defensive securitymalware and threat intel
📙 The Trusted Platform Module 🖥️
cryptographydefensive security
📙 Incident Readiness You and Your Leaders Will Actually Trust 🔥
defensive securitycloud security
📙 Hunting Malicious IDE Extensions: Building Detection at Scale Across Developer Workstations 🔥
defensive securityapplication security
🎤 Architecting the Modern SOC: The Evolving AI Reality for Blue Teams 🔥
defensive securityai securitygovernance and risk
AI for security - friend or foe?
ai securitydefensive security
📗 Orchestrating Resilience: Composing a New Score for Netflix Service Reliability 🏗️
defensive securitycloud security
📙 Running an efficient bug bounty program and PSIRT function 🔥
application securitydefensive security
📙 The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns 🔥
identity and accessdefensive security
📙 What a False Alarm Taught Us About Security as a 2-Person Startup 🔥
defensive securitycloud security
📗 Composing the Response: Building an Incident Pipeline from Scratch 🔥
defensive security
📙 Detection Allegro: Composing Detection Rules with Agentic Workflows 🔥
defensive securityai security
📙 Anatomy and Defense of LOTL Fileless Intrusions 🔥
defensive securitymalware and threat intel
📙 Conducting the Kill-Chain: Detecting APT Progression Through Music-Sequence Modeling 🤖
defensive securityai security
📗 Google Drive Hunter: Building the Tool Google Should’ve Built 🏗️
cloud securitydefensive security
📕 CloudShell Hide-n-Seek: enjoying the sweet persistent sounds of silence! 🔥
cloud securityoffensive securitydefensive security
Detection at Scale: Abstracting Detection Intent
defensive security
Detect, Decide, Defend: Building Cloud Native Security That Fights Back - Matthias Bertschy, ARMO
cloud securitydefensive security
📚 Tutorial: Attack Defense: Leverage eBPF To Reveal Attack Flows With Rich Context - Constanze Roedig, fusioncore.ai; Markus Gierlinger, Independent; Teodor Janez Podobnik, Prewave GmbH
defensive securitycloud securityoffensive security
In Falco's Nest: The Evolution of Cloud Native Runtime Security - Iacopo Rozzo, Sysdig; Aldo Lacuku, Kong Inc.
defensive securitycloud security
Why Security of Kubernetes Comes Down to Linux Security - Marina Moore, Edera
cloud securitydefensive security
Automate Once, Run Anywhere: The Docker Moment for Security Workflows - Nancy Chauhan & Aseem Shrey, ShipSecAI
application securitydefensive securitycloud security
Hacking GPU Observability: eBPF & Ephemeral Containers in Action on Kubernetes - Brandon Kang, Akamai Technologies
cloud securitydefensive security
A Bug's-Eye View: Kubernetes SIG Security Explains It All - Ian Coldwater, Independent; Tabitha Sable & Rory McCune, Datadog; Iain Smart, AmberWolf; Mahé Tardy, Isovalent at Cisco
cloud securityapplication securitydefensive security
[un]prompted 2026
14 talks"Can You See What Your AI Saw?": GenAI Endpoint Observability for Detection Engineers
defensive securityai security
Detecting GenAI Threats at Scale with YARA-Like Semantic Rules
ai securitydefensive security
Natalie Isak & Waris Gill - Developing & Deploying AI Fingerprints | [un]prompted 2026
ai securitydefensive security
Glass-Box Security: Operationalizing Mechanistic Interpretability for Defending AI Agents
ai securitydefensive security
Rob T. Lee - SIFT-FIND EVIL! I Gave Claude Code R00t on DFIR SIFT Workstation | [un]prompted 2026
defensive securityai security
Joshua Saxe - The Hard Part Isn’t Building the Agent: Measuring Effectiveness | [un]prompted 2026
ai securitydefensive security
Matt Rittinghouse & Millie Huang - 1.8M Prompts, 30 Alerts | [un]prompted 2026
ai securitydefensive security
Sergej Epp - 8 Minutes to Admin. We Caught It in the Wild. | [un]prompted 2026
ai securitydefensive security
Bob Rudis & Glenn Thorpe - Detection & Deception Engineering in the Matrix | [un]prompted 2026
defensive security
Arthi Nagarajan - Exploring the AI Automation Boundary | [un]prompted 2026
ai securitydefensive security
Flash Talks | [un]prompted 2026
ai securitydefensive security
Training BrowseSafe: Lessons from Detecting Prompt Injection in Production Browser Agents
ai securitydefensive security
Rob T. Lee, Glenn Thrope, Dan Hubbard & Sergej Epp - Vibe Coded | [un]prompted 2026
ai securityoffensive securitydefensive security
Why Most ML Vulnerability Detection Fails (And What Actually Worked for Kernel Bugs)
ai securitydefensive security
NDC Security 2026
4 talksIt is rough without a WAF
application securitydefensive security
Connecting the dots to go from tabular security incident data to behavioral graph understanding
defensive securitynetwork and infrastructure
Protocol-Hopping C2: Transport-Agnostic Command & Control That Won't Die
offensive securitydefensive security
Learning security monitoring through failure
defensive security
DefCamp 2025
7 talksHacked by Words: A Live Ransomware Negotiation at DefCamp 2025
defensive securitymalware and threat intel
Agentify OSINT: Transforming Security News Feeds Into Actionable Intelligence at DefCamp 2025
malware and threat inteldefensive security
Access Denied (eventually) at DefCamp 2025
defensive securityidentity and access
Security layers: how much security is enough at DefCamp 2025
network and infrastructuredefensive security
AI-Powered Threat Intelligence: A Game Changer for Cyber Crisis Management
malware and threat inteldefensive security
Beyond Scanning - Why Vulnerability Assessment Isn't Sufficient for Attack Surface Management
defensive securityai security
C2 by Microsoft: What can go wrong if SCCM ends up in the wrong hands at DefCamp 2025
offensive securitydefensive security
OWASP Global AppSec USA 2025
3 talksHow Latest Browser Security Features Eliminate Bug Classes
application securitydefensive security
OWASP VXDF: Is that really vulnerable? Show me the VXDF!
application securitydefensive security
Benchmarking Scanner Blind Spots: How Runtime Context Uncovers Hidden Vulns
application securitydefensive security
DEF CON® 33 Hacking Conference
30 talksNot Just a Pipeline Leak: Reconstructing the Real Attack Behind tj-actions
application securityoffensive securitydefensive security
Takes All Kinds: Building Onramps for Emergency Web Archiving in Ukraine and Beyond
governance and riskdefensive security
Silent Sabotage: How Nation-State Hackers Turn Human Error into Catastrophic Failures
defensive securitynetwork and infrastructuremalware and threat intel
OSINT Enabled Ghost Mode: Counter-Surveillance for Everyday People Like Us
defensive securitymalware and threat intel
Safeguarding the Industrial Frontier: OT SOC & Incident Response
defensive securitynetwork and infrastructuregovernance and risk
Mastering Apple's Endpoint Security for Advanced macOS Malware Detection
defensive securitymalware and threat intel
Passing the Torch: Mentoring and Protecting Our Students in Education Spaces
defensive securitygovernance and risksecurity leadership
Binary Facades: Reversing approaches to extract embedded scripts in compiled macOS malware
malware and threat inteldefensive security
Teaching Your Reverse Proxy to Think: Fingerprint-Based Bot Blocking & Dynamic Deception
defensive securitynetwork and infrastructure
Deepfake Image and Video Detection
ai securitydefensive security
The Things know What You Did Last Session
defensive securitymalware and threat intel
How to secure unique ecosystem shipping 1 billion+ cores?
offensive securitydefensive securityapplication security
Fingerprinting Maritime NMEA2000 Networks
network and infrastructuredefensive security
Let AI Auto-Generate Neural-ASR Rules for OT-specific Attacks via NLP Approach
defensive securityai security
Moonlight Defender - Purple Teaming in Space!
defensive securitynetwork and infrastructure
Hackers Dropping Mid-Heist Selfies: LLM Identifies Information Stealer Infection Vector and Extracts IoCs
defensive securitymalware and threat intel
Ask EFF
defensive securitymobile and iot securitygovernance and risk
SSH Honeypots and Walkthrough Workshops: A History
defensive security
Hacking Space to Defend It: Generating IoBs with SPARTA
defensive securitynetwork and infrastructure
Creating a Virtual Ship Environment Optimized for Cybersecurity Use
defensive securitynetwork and infrastructure
Red Russians: How Russian APT groups closely follow offensive security research
malware and threat inteldefensive security
Blurred Lines of Cyber Threat Attribution: The Evolving Tactics of North Korean Cyber Threat Actors
malware and threat inteldefensive security
Closing Patient Safety Gaps with Smart Tech and AI
ai securitydefensive security
Hacking Context for Auto Root Cause and Attack Flow Discovery
defensive securityai security
Man-in-the-Malware: Intercepting Adversarial Communications
defensive securitymalware and threat intel
Recording PCAPs from Stingrays With a $20 Hotspot
defensive securitynetwork and infrastructure
Countering Forensics Software by Baiting Them
defensive securitymobile and iot security
Red Alerts and Blue Oceans: Incident Response from a Sysadmin’s War Room in Maritime Ops
defensive securitynetwork and infrastructuregovernance and risk
Anatomy of a Crypto Scam
defensive security
Letthemin: Facilitating High-Value Purple Teams Using an Assumed Compromise Approach
defensive security
Black Hat USA 2025
15 talksWatching the Watchers: Exploring and Testing Defenses of Anti-Cheat Systems
defensive security
When 'Changed Files' Changed Everything: Uncovering and Responding to the tj-actions Supply Chain Breach
application securitydefensive security
Death by Noise: Abusing Alert Fatigue to Bypass the SOC (EDR Edition)
offensive securitydefensive security
Out Of Control: How KCFG and KCET Redefine Control Flow Integrity in the Windows Kernel
defensive security
Autonomous Timeline Analysis and Threat Hunting: An AI Agent for Timesketch
defensive securityai security
Black Hat USA 2025 | Advanced Bypass Techniques and a Novel Detection Approach
ai securitydefensive security
FACADE: High-Precision Insider Threat Detection Using Contrastive Learning
defensive securityidentity and access
Kernel-Enforced DNS Exfiltration Security: Framework Built for Cloud Environments to Stop Data Breaches via DNS at Scale
defensive securitycloud security
XUnprotect: Reverse Engineering macOS XProtect Remediator
malware and threat inteldefensive security
If Google Uses It to Find Webpages, We Can Use It to Find Fraudsters: TF-IDF for Real-Time Fraud Detection
defensive security
Protecting Small Organizations in the Era of AI Bots
defensive securitynetwork and infrastructure
Unmasking Supply Chain Attacks via Application Behaviour
defensive securitynetwork and infrastructure
Anomaly Detection Betrayed Us, so We Gave It a New Job: Enhancing Command Line Classification with Benign Anomalous Data
defensive security
Securing America: Readiness, Response, and Resilience for Critical Infrastructure Defense
defensive securitynetwork and infrastructure
The 11th Annual Black Hat USA Network Operations Center (NOC) Report
network and infrastructuredefensive security
OWASP Global AppSec USA 2024
5 talksThe Container Escape Room: An Exploration of Container Escapes
cloud securityoffensive securitydefensive security
Learning from Past Security Breaches: Strengthening AppSec Efforts and Focus
application securitydefensive securitygovernance and risk
The Path to Influence: How Three Threat Modelers Can Influence an Entire Organization
application securitysecurity leadershipdefensive security
Red, Blue, and Purple AI (Keynote)
offensive securitydefensive securityai security
Automatic application hardening by leveraging container runtime behavior analysis during CI processes
cloud securityapplication securitydefensive security