AI
📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️
governance and riskapplication security
Topic
Governance & Risk
Running a defensible program on paper as well as in practice — frameworks, compliance regimes, third-party risk, and privacy engineering.
- NIST
- ISO 27001
- CIS
- SOC2
- PCI-DSS
- HIPAA
- GDPR
- DORA
- NIS2
- risk management
- risk quantification
- security metrics
- board reporting
- audit readiness
- third-party risk
- vendor security assessment
- data privacy
- privacy engineering
- security policy
- regulatory compliance
- cyber insurance
108
Talks
9
Conferences
BSidesSF 2026
16 talks📙 Kidnapping a Library: How Ransomware Taught the British Library to Follow Well-Known Best Practices 🏗️
malware and threat intelgovernance and riskdefensive security
📗 Web standard consortiums are a game with Chrome as the monopoly man
application securitygovernance and risk
Ask the EFF Panel
governance and risk
🎤 Architecting the Modern SOC: The Evolving AI Reality for Blue Teams 🔥
defensive securityai securitygovernance and risk
CISO Series Live Podcast Recording
security leadershipgovernance and riskai security
📗 Cringe, Corrected: Hot Takes Fixed by the CIS Controls ⚖️
governance and risk
Let's Do the Timewarp Again! A Look Back to Move Forward
security leadershipgovernance and risk
📗 What happened to the lock icon? ⚖️
governance and riskapplication security
📗 The Epistemology of Trust 💼
security leadershipgovernance and risk
📗 Building an open source security project with 1M+ installations ⚖️
identity and accessgovernance and risksecurity leadership
📙 AI as an Accountable Entity: Governing Risk When Machines Make Decisions ⚖️
ai securitygovernance and risk
📙 The Risky Business of Risk Illiteracy 💼
governance and risk
📙 Security on a Shoestring: A Low-Budget Security Revival Tour 🖥️
governance and risksecurity leadership
📗 Your Arch-Nemesis is a Data Scientist: What's the Difference Between Security and Privacy Work? ⚖️
governance and risk
📙 How to Be a GRC Hero (Without Heroics) ⚖️
governance and risk
Advanced Kyverno Patterns : Automating Platform Security and Operations - Frank Jogeleit, Nirmata; Johannes Sonner, Deutsche Telekom
cloud securityapplication securitygovernance and risk
Audit-Ready Kubernetes: How Chase UK Leveraged Policy as Code for Continuous Compliance - Jim Bugwadia, Nirmata & Nischay Goyal, JP Morgan Chase
cloud securitygovernance and risk
Open Policy Agent. (OPA) Intro & Deep Dive - Charlie Egan & Anders Eknert, Apple
identity and accessapplication securitygovernance and risk
Strengthening CNCF Projects: Impact of Security Self-Assessments - Eddie Knight, Sonatype; Bradley Andersen, k8gb; Justin Cappos, New York University; Shuting Zhao, Nirmata; Orlin Vasilev, SUSE
application securitycloud securitygovernance and risk
Kubernetes Security at Shopify Scale: Automating Security Across an Infrastructure Monorepo - Jie Wu & Pulkit Garg, Shopify
cloud securityapplication securitygovernance and risk
The Shared Service Blueprint: A Guide to Multi-Tenancy, Illustrated With KEDA - Aya Igarashi, Preferred Networks, Inc.
cloud securityidentity and accessgovernance and risk
SB💣💣M: Making SBOMs Play Together - Jacopo Bufalino, CNAM & Agathe Blaise, Thales SIX GTS France
application securitycloud securitygovernance and risk
Privacy as Infrastructure: Declarative Data Protection for AI on Kubernetes - Joaquin Rodriguez, Microsoft & Krishnendu Dasgupta, AXONVERTEX AI
cloud securityai securitygovernance and risk
Policy Engines for Kubernetes: Picking One Without Losing Your Mind - Nabarun Pal, Broadcom
cloud securitygovernance and risk
[un]prompted 2026
7 talksAI Notetakers: The Most Important Person in the Room
ai securitygovernance and risk
Ragini Ramalingam - Enterprise AI Governance at Snowflake | [un]prompted 2026
governance and riskai security
Establishing AI Governance Without Stifling Innovation: Lessons Learned
governance and riskai security
Hooking Coding Agents with the Cedar Policy Language
ai securitygovernance and risk
Kinetic Risk: Securing and Governing Physical AI in the Wild
ai securitygovernance and risk
The AI Security Larsen Effect: How to Stop the Feedback Loop
ai securitygovernance and risk
Three Phases of AI Adoption: From GPU Lottery to Enterprise Agreements
ai securitygovernance and risk
NDC Security 2026
2 talksWon't somebody please think of the children!?
governance and riskai security
The Risky Business, of AI Illiteracy
ai securitygovernance and risk
DefCamp 2025
4 talksStop Making Nonsense - Cutting through compliance complexity at DefCamp 2025
governance and risk
RAGe Against the Machine: AI-Powered Compliance and Cybersecurity at DefCamp 2025
governance and riskai security
Evolving the approach to Third Party Risk Management at DefCamp 2025
governance and risk
Threat Modelling in Modern Systems at DefCamp 2025
application securitygovernance and risk
OWASP Global AppSec USA 2025
7 talksUltimate Build Power, Itty Bitty Security Controls - OWASP's New Top 10 for Citizen Developer Risk
application securitygovernance and risk
How to Embed Privacy Threat Modeling in Agile Sprint Rituals Without Slowing Teams Down
application securitygovernance and risk
Privacy by Design: What Are Engineers Supposed to Do With That?
application securitygovernance and risk
Stop Trying to "Manage Risk" (Keynote)
governance and risksecurity leadership
OWASP AIVSS Project: What it is, why we need it and how we are doing it
ai securitygovernance and risk
From Maturity to Mastery: Accelerating Software Security with OWASP SAMM
application securitygovernance and risk
OWASP Top 10 Annoucement
application securitygovernance and risk
DEF CON® 33 Hacking Conference
34 talksCritically Neglected: Cybersecurity for buildings
network and infrastructuregovernance and risk
Third-Party Access Granted: A Postmortem on Student Privacy and the Exploit That's Still in Production
governance and risk
Scamming the Scammers: Weaponizing Open Source Against Pig Butchering and Organized Crime
malware and threat intelgovernance and risk
Secure Code Is Critical Infrastructure: Hacking Policy for the Public Good
application securitygovernance and risk
Takes All Kinds: Building Onramps for Emergency Web Archiving in Ukraine and Beyond
governance and riskdefensive security
"We are currently clean on OPSEC": The Signalgate Saga
governance and riskoffensive security
Cryptocurrency Opening Keynote
cryptographygovernance and risk
Fear vs. Physics: Diagnosing Grid Chaos
network and infrastructuregovernance and risk
The Price for Progress: Ethical Cybersecurity and Tech-Driven Communities
governance and risksecurity leadershipai security
Hull Integrity: Applying MOSAICS to Naval Mission Systems
network and infrastructuregovernance and risk
Safeguarding the Industrial Frontier: OT SOC & Incident Response
defensive securitynetwork and infrastructuregovernance and risk
Passing the Torch: Mentoring and Protecting Our Students in Education Spaces
defensive securitygovernance and risksecurity leadership
Veilid la revoluçion : Your data is yours to own
network and infrastructurecryptographygovernance and risk
Fighting the Digital Blockade: A View from Taiwan
network and infrastructuregovernance and risk
Threat Dynamics on the Seas
malware and threat intelnetwork and infrastructuregovernance and risk
Dark Capabilities: When Tech Companies Become Threat Actors
governance and risksecurity leadershipoffensive security
Cyber Volunteering and Community Defense - DEF CON Franklin and the Cyber Resilience Corps 1 Year In
governance and risksecurity leadership
No Spook Leaves Randomness to Chance
cryptographygovernance and risk
Post-Quantum Panic: When Will the Cracking Begin, and Can We Detect it?
cryptographygovernance and risk
What’s Really in the Box? The Case for Hardware Provenance and HBOMs
application securitynetwork and infrastructuregovernance and risk
Ask EFF
defensive securitymobile and iot securitygovernance and risk
State of Open Source in the Federal Government
governance and riskapplication security
They deployed Health AI on us. We’re bringing the rights & red teams.
ai securityoffensive securitygovernance and risk
#ReclaimTech - A community movement
governance and riskidentity and access
The depths that marketers will plummet to
governance and riskmalware and threat intel
China's Health Sector Ambitions and Information Needs: Implications for U.S. Health Care Cyber Defense
malware and threat intelgovernance and risk
Stories from a Tor dev
network and infrastructuregovernance and risk
The Ultimate Hack: Applying Lessons Learned from the loss of TITAN to Maritime Cybersecurity
network and infrastructuregovernance and risk
Private, Private, Private: Access Everywhere
identity and accessgovernance and risk
Red Alerts and Blue Oceans: Incident Response from a Sysadmin’s War Room in Maritime Ops
defensive securitynetwork and infrastructuregovernance and risk
VDP in Aviation - How it shouldn't be done!
application securitygovernance and risk
From Shanghai to the Shore: The Silent Threat in Global Shipping
network and infrastructuregovernance and risk
The Worst ICS/OT Love Story Ever Told
network and infrastructuregovernance and risk
How Computers Kill People: Marine Systems
network and infrastructuregovernance and risk
Black Hat USA 2025
7 talksAppleStorm - Unmasking the Privacy Risks of Apple Intelligence
governance and riskoffensive security
Digital Dominoes: Scanning the Internet to Expose Systemic Cyber Risk
governance and riskcloud security
Pwning User Phishing Training Through Scientific Lure Crafting
offensive securitygovernance and risk
Use and Abuse of Personal Information -- Politics Edition
governance and risk
Black Hat USA 2025 | Keynote: Threat Modeling and Constitutional Law
governance and risk
Exploiting DNS for Stealthy User Tracking
network and infrastructuregovernance and risk
Black Hat USA 2025 | Vulnerability Haruspicy: Picking Out Risk Signals from Scoring System Entrails
governance and riskmalware and threat intel
OWASP Global AppSec USA 2024
22 talksOWASP: The Next 25 years
application securitysecurity leadershipgovernance and risk
Slack's Vulnerability Aggregator: How we built a platform to manage vulnerabilities at scale
application securitygovernance and risk
OWASP Top 10 for Large Language Models: Project Update
ai securityapplication securitygovernance and risk
3 Day Training: Web Application Security Essentials
governance and riskapplication security
Hackuracy: Boosting AST accuracy through hacking
application securityoffensive securitygovernance and risk
OWASP Application Security Verification Standard (ASVS)
application securitygovernance and risk
OWASP DevSecOps Maturity Model (DSOMM)
application securitygovernance and risk
Practical Software Supply Chain Security Solutions
application securitygovernance and risk
Bridging Security & Privacy Standards: Harnessing OpenCRE for Effective Mapping
governance and riskapplication security
The Missing Link - How we collect and leverage SBOMs
application securitygovernance and risknetwork and infrastructure
Learning from Past Security Breaches: Strengthening AppSec Efforts and Focus
application securitydefensive securitygovernance and risk
AppSec Meets Project Management: Hacking the Frameworks for Secure Software
application securitygovernance and risksecurity leadership
Striding Your Way to LINDDUN: Threat Modeling for Privacy
application securitygovernance and risk
Maturing Your Application Security Program with ASVS-Driven Development
application securitygovernance and risk
AI Code Generation - Benefits, Risks and Mitigation Controls
application securityai securitygovernance and risk
I Know What You Did Last Summer: Lessons Learned from Privacy Breaches and Scandals
governance and riskapplication security
OWASP Top 10 Risks for Open Source Software
application securitygovernance and risk
OWASP AI Exchange experts on the future of security for AI
ai securitygovernance and riskapplication security
5 Steps to VEX Success: Managing the End-to-End Workflow
application securitygovernance and risk
OWASP Software Assurance Maturity Model (SAMM)
application securitygovernance and risk
OWASP DefectDojo
application securitygovernance and risk
Businesses Run On Risk And Debt: Why Communicating Security Risk Is Hard
security leadershipgovernance and risk