~/conference

BSidesSF 2026

Name: BSidesSF 2026
Start: 2026-03-21
End: 2026-03-22
Location: San Francisco

date:2026-03-21..2026-03-22

location:San Francisco, United States

website:https://bsidessf.org/

series:BSidesSF · 7 editions

editions:[BSidesSF 2018, BSidesSF 2019, BSidesSF 2020, BSidesSF 2023, BSidesSF 2024, BSidesSF 2025, BSidesSF 2026]

tags:[security, ai-assisted-development]

title	author	length
Opening Remarks (Saturday)	Reed Loden	15m
Welcome to BSidesSF’s kickoff with the conference framed as security theater and a call to participate not spectate; organizers report 18 program changes so… Organiser at AMC IMAX, AMC at Metreon on
Let's Do the Timewarp Again! A Look Back to Move Forward	Anna Westelius	41m
A concise history of what actually changed: encryption becomes default after widespread push and the emergence of Let's Encrypt made HTTPS free and automated… Talk at AMC IMAX, AMC at Metreon on
The Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud	Yotam Meitar	47m
A multi‑cloud intrusion steals about $107M over seven months, culminating in an $80M heist; attackers social‑engineer the help desk to reset an approver’s… Talk at AMC IMAX, AMC at Metreon on
📕 AI-Powered AppSec: 10x Your Security Team Without Scaling Headcount 🖥️	Anshuman Bhartiya	45m
Built an internal platform called Priscia that runs CI hooks into a Flask backend, stores artifacts in DynamoDB, and queries multiple LLMs (Sonnet/Opus and… Talk at AMC Theatre 10, AMC at Metreon on
Your Load Balancer is Your New Perimeter: Attacks & Defenses at Scale	Arjun Sharma	32m
Four practical bypasses show how origin IPs leak and let attackers bypass CDNs: a certificate transparency leak reveals subdomains that resolve to load… Talk at AMC Theatre 09, AMC at Metreon on
The Phantoms of the Fraudpera: An Overview of Anti-Detection Tooling	Bobbie Chen	33m
Overview of commercial evasion tooling and attacker economics: four concrete categories—residential proxies, CAPTCHA solvers, anti-detect browsers, device… Talk at AMC Theatre 04, AMC at Metreon on
Detection at Scale: Abstracting Detection Intent	Gaurav Singh, Dario Amiri	45m
Claim: abstracting detection intent lets large teams and high event volumes scale detections by separating declarative pattern expression from system… Talk at AMC Theatre 13, AMC at Metreon on
State of (Absolute) AppSec	Seth Law, Ken Johnson, Kevin McDermott, Astha Singhal, Clint Gibler	40m
Panel argues application security must adapt to non-deterministic AI-infused apps where models change runtime behavior, not just scan outputs. Concrete changes… Talk at AMC Theatre 12, AMC at Metreon on
How to Be a GRC Hero (Without Heroics)	Stas Bojoukha	38m
Argues that spreadsheets and fire drills are obsolete and shows a working playbook: connect telemetry streams to controls so an MFA drop 99%→95% flips control… Talk at AMC Theatre 03, AMC at Metreon on
📙 Is Q-Day Worse than Y2K? Strategies for Surviving the Quantum Threats	Sandip Dholakia	43m
Claims that Q‑Day arrives in 5–10 years rest on steady hardware progress and a surprising estimate that breaking 256‑bit ECC needs ~317 million qubits (hour)… Talk at AMC Theatre 02, AMC at Metreon on
Follow the data to learn the secret	Dylan Ayrey	35m
Scans of HuggingFace (25% so far) with Truffle Hog process millions of files across ~880,000 datasets and flag almost 100,000 live secrets, including API keys… Talk at AMC Theatre 14, AMC at Metreon on
📗 Orchestrating Resilience: Composing a New Score for Netflix Service Reliability 🏗️	Sandhya Narayan, Prachi Jain	28m
Netflix replaces blanket freezes with a service tiered service model and a data-driven risk-aware launch rubric wired into CI/CD pipelines, classifying… Talk at AMC Theatre 09, AMC at Metreon on
Securing Space: The Next Frontier for Security Engineers	Anshu Gupta	46m
Satellites look like code plus hardware and the talk shows concrete attacks, tooling, and defenses: the KSAT/Viasat-style outage via firmware overwrite and the… Talk at AMC Theatre 04, AMC at Metreon on
From $10 to $30M: Operating in the Data-Extortion Aftermath	Diego Matos	35m
Claims that multi-level extortion now mixes encryption, public leakage, DDoS and customer harassment, with active groups up 49% and leak events up 50%, and… Talk at AMC IMAX, AMC at Metreon on
Practice Cyber Skills Like a Musician	Bianca Ionescu	31m
Argues that musical discipline maps to cybersecurity through deliberate practice: drills, slow breakdowns, and repetition to build muscle memory for commands… Talk at AMC Theatre 07, AMC at Metreon on
The Phaaaaaaaaantom of the Salt Typhoon is there, inside i-SOON	Daniel Schwalbe	41m
Claims a reproducible opening in Chinese-sponsored APT Salt Typhoon’s TTPs by mapping domain infrastructure from a 2024 GitHub leak, using passive DNS pivots… Talk at AMC Theatre 13, AMC at Metreon on
Reverse Engineering Go Malware: From Manual to AI-Powered Analysis	Asher Davila	47m
Shows step-by-step reverse engineering of Go IoT malware (BotenaGo, PumaBot) using Ghidra, Radare2, r2ai and GhidraMCP to rebuild strings and payloads and map… Talk at AMC Theatre 14, AMC at Metreon on
📙 Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026 🖥️	Farshad Abasi	47m
Claim: threat models stop at design and miss deployed reality, so production scans must feed them. Gives numbers (94% of cloud infra has manual pieces, 6%… Talk at AMC Theatre 10, AMC at Metreon on
📗 Gettings PCAPs from Stingrays for $20 with Rayhunter	Cooper Quintin, Will Greenberg	46m
A $20 Android Orbit hotspot running Qualcomm DIAG becomes Rayhunter, a Rust tool that dumps QMDL/pcap frames and applies heuristics (2G downgrade, null cipher… Talk at AMC Theatre 02, AMC at Metreon on
📙 AI as an Accountable Entity: Governing Risk When Machines Make Decisions ⚖️	Pavithra Pradip	27m
AI decisions become risk-bearing services that need inventory, a simple materiality score (impact, autonomy, sensitivity) and assigned owners across model… Talk at AMC Theatre 03, AMC at Metreon on
Lessons Learned from Building Custom Hacker Hardware	c4m0ufl4g3	45m
Build story of Injectal and Hide: starts with off‑the‑shelf parts—Trinket M0, Arduino Nano 33 IoT, SparkFun XB radio and a DigiMesh radio—total prototype cost… Talk at AMC Theatre 04, AMC at Metreon on
AI for security - friend or foe?	Tom Alcock, Jackie Bow, Travis McPeak, Drew Hintz, Kyle Polley	42m
Panelists claim AI already cuts alert backlog to zero at one company and drops mean time to triage to minutes, describes an open‑sourced “easy agents” cloud… Talk on
So you think you can airgap? (No.)	Ziyad Edher	33m
Anthropic deploys and operates an egress limiter that literally counts every byte leaving training clusters, implements a large-burst token bucket to allow… Talk at AMC IMAX, AMC at Metreon on
Detecting Race Conditions on macOS	Olivia Gallucci	34m
GCD misconfiguration causes real exploitable timing windows: a missing target queue on an XPC listener lets handlers run concurrently and led to GSSCred CVE… Talk at AMC Theatre 07, AMC at Metreon on
Anatomy and Defense of LOTL Fileless Intrusions	Amol Sarwate	44m
84% of incidents in 2025 involve living-off-the-land binaries and 47% of initial access is via click‑to‑fix lures, the talk demonstrates. Asteroth uses LNK →… Talk at AMC Theatre 13, AMC at Metreon on
Not My Vibe: When AI Coding Agents Go Off the Rails	Aonan Guan, Zhengyu Liu	46m
Reversing Gemini CLI, Claude Code and Codex uncovers concrete attack paths: command injection via shell-tool gaps, workspace escapes through symlink and… Talk at AMC Theatre 14, AMC at Metreon on
📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️	Branden Rosenlieb	31m
Argues GRC must become an engineering function and shows a working pipeline: AWS audit playbook (Python + boto3) pulls configs to JSON, Terraform plan→JSON… Talk at AMC Theatre 03, AMC at Metreon on
📙 Level Up Your Threat Modeling: Turning Security Into a Team Adventure 🖥️	Stanley Harris	31m
A method that gamifies threat modeling into a role‑playing session claims to make developers stick with the process by mapping real systems, playing from a… Talk at AMC Theatre 10, AMC at Metreon on
The Trusted Platform Module	Eric Chiang	29m
Explains that the TPM is an API spec spanning thousands of pages implemented as discrete chips or fTPM on CPU, and shows live interaction using a Go package… Talk at AMC Theatre 02, AMC at Metreon on
📙 What a False Alarm Taught Us About Security as a 2-Person Startup 🔥	Alex Chantavy, Kunaal Sikka	30m
Two-person startup with $4.2M seed and first enterprise customers migrates from EC2 to ECS Fargate and a hosted Neo4j Aura graph; a failed local login… Talk at AMC IMAX, AMC at Metreon on
Elevating First-Time Female Voices on Stage	Poorna Rajaraman, Deepika Gupta	31m
A company-run six-month mentorship engine pairs novice-only applicants with experienced mentors matched by domain and time zone, uses a double-blind Technical… Talk at AMC Theatre 07, AMC at Metreon on
CISO Series Live Podcast Recording	David Spark, Mike Johnson, Sara Madden	49m
Live podcast records a 45-minute episode that airs May 5 featuring rapid audience games, vendor-selection rules like no three-year contracts up front… Interview at AMC Theatre 12, AMC at Metreon on
📙 Prompt, Commit, Repeat: Security at Scale When 1,000 Devs Go AI-Native	Balachandra Shanabhag	45m
Enterprises with thousands of developers face concrete failures: an AI agent nuked a Mac by deleting a home directory, prompt and code injections cause… Talk at AMC Theatre 04, AMC at Metreon on
📗 Threat Chords: Tuning into Persistent Patterns in Adversary Behavior 🔥	Karthika, Samhita Vempatti	44m
Claim: attackers reuse operational playbooks so defenders should detect sequences not single IOCs. Evidence: Scattered Spider/Shiny Hunters repeatedly use… Talk at AMC Theatre 13, AMC at Metreon on
📗 Cringe, Corrected: Hot Takes Fixed by the CIS Controls ⚖️	Lawrence Cruciana, Amelia Cruciana	26m
Session mines real social posts and maps bad advice to concrete CIS actions: identifies CentOS 6 is EOL and explains why unpatched OSes defeat FIDO2/SSH keys… Talk at AMC Theatre 03, AMC at Metreon on
📙 From Assistant to Assassin: Weaponizing An OpenClaw Vulnerability to Achieve 1-Click RCE 🖥️	Mav Levin	31m
OpenClaw contains a configuration-logic flaw that lets a crafted URL set a gateway, trigger client-side auto-login, and exfiltrate the admin authentication… Talk at AMC Theatre 10, AMC at Metreon on
📗 You Just Might Find, You Get What You Need: How MS Became My Unlikely Success Story	Emily Harden	25m
Rapidly diagnosed with MS after five MRIs and two spinal taps and a five‑day hospital stay, the story shows concrete pivots: three months on FMLA, trading… Talk at AMC Theatre 02, AMC at Metreon on
📙 The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns 🔥	Julie Agnes Sparks	21m
Okta shows 1,081 event types but useful hunting focuses on authentication and policy evaluation events; look for sessionId and dthash fields plus debugContext… Talk at AMC IMAX, AMC at Metreon on
Increasing the Analysis Surface of Large Language Models	Stephen Brennan, Ulrich	46m
Claim: model internals reveal attack signals that black‑box filters miss. The team develops attention-based analysis linking unsafe prompts to attention… Talk at AMC Theatre 14, AMC at Metreon on
Architecting the Modern SOC: The Evolving AI Reality for Blue Teams	Bryan Fite, Dean De Beer, Nicole Grinstead, Swathi Joshi	45m
Architectural choices for a modern SOC determine whether AI assistance helps or breaks operations: prioritize structured data and a federated data fabric… Talk at AMC Theatre 12, AMC at Metreon on
Demystifying File Similarity for Malware Detection	Udbhav Prasad	40m
Compares fuzzy hashes and ML on 800k labeled PE features from the EMBER dataset and AVclass labels from CrowdStrike, evaluating similarity with label… Talk at AMC Theatre 04, AMC at Metreon on
Practical (and impractical) git commit signing	Matthew Garrett	30m
Argues that commit signatures can give provenance but real tooling breaks the assurances; demonstrates working code and CI checks (links and repo provided) and… Talk at AMC Theatre 09, AMC at Metreon on
📗 Your Arch-Nemesis is a Data Scientist: What's the Difference Between Security and Privacy Work? ⚖️	Aleatha Parker-Wood	30m
Privacy focuses on purpose and use not just confidentiality, and the real adversary is often data scientists as adversary who reidentify or retain data… Talk at AMC Theatre 03, AMC at Metreon on
When the supply chain hits a sour note	Kennedy Toomey	25m
Chronicles an npm compromise that led to malicious releases downloaded 2.5 million downloads with only ~$500 stolen, then a Singularity GitHub Actions… Talk at AMC Theatre 10, AMC at Metreon on
📗 Web standard consortiums are a game with Chrome as the monopoly man	Simon Wijckmans	32m
Argues that web standards stall because most browsers run on Chromium dominance so a single vendor effectively vetoes progress, cites 40% Google presence at… Talk at AMC Theatre 02, AMC at Metreon on
More Role Models in AppSec: How to Get It Right	Alexandra Charikova	22m
After 100+ interviews the claim is clear: AppSec fails more from human gaps than tooling, and visibility fixes work better than more scanners. Data points… Talk at AMC Theatre 07, AMC at Metreon on
Composing the Response: Building an Incident Pipeline from Scratch	Geet Pradhan	29m
Builds a zero‑budget incident pipeline for early‑stage teams (employee #1/#2) that trades improvisation for plumbing: single intake, role-based command… Talk at AMC Theatre 13, AMC at Metreon on
📙 Conducting the Kill-Chain: Detecting APT Progression Through Music-Sequence Modeling 🤖	Krupa Brahmkstri, Sneha Rangari	31m
Sequence-aware detection engine uses music-inspired encoding, transformer attention and motive detection to score event progressions as harmonic dissonance… Talk at AMC Theatre 14, AMC at Metreon on
Breaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows	Bhaumik Shah	33m
Shows a 2025 Salesforce OAuth breach where a single integration token lets attackers access 7,000+ customer environments, reproduces token replay against a… Talk at AMC Theatre 10, AMC at Metreon on
"Ask the EFF" Panel	David Greene, Katharine Trendacosta, Samantha Baldwin, Cooper Quintin	46m
EFF panel lists concrete work and wins: about 36 years of org history and roughly 14 active litigations; a threat lab that finds malware on low-end kids’… Panel at AMC Theatre 12, AMC at Metreon on
📙 Incident Readiness You and Your Leaders Will Actually Trust 🔥	Shachar Hirshberg, Hadar Waldman	29m
A repeatable process called an environmental intelligence report queries existing logs (Athena, Splunk, S3), stores queries in notebooks, and uses LLM skills… Talk at AMC Theatre 13, AMC at Metreon on
📙 RBAC Atlas: Mapping Real-World Kubernetes Permissions and Exposing Risky Projects 🏗️	Lenin Alevski	35m
A tool called RBAC Atlas maps over‑permissive Kubernetes identities by running a CLI policy analyzer against Helm charts and YAML and publishing daily results… Talk at AMC Theatre 09, AMC at Metreon on
Building an open source security... (Fletcher Heisler, Marcelo Elizeche Landó)	Fletcher Heisler, Marcelo Elizeche Landó	28m
Open source IDP Authentic reaches 1M+ installations and scales from a Django codebase to a mixed stack with a partial Go rewrite and an active Rust rewrite PR… Talk on
How We Red-Teamed Our Own AI Agent: Lessons from... (Josiah Peedikayil, HS)	Josiah Peedikayil, HS	37m
Operation Pale Fire red-teams Goose, Block’s open-source AI agent and demonstrates an end-to-end chain: sending external invites via Google Calendar MCP… Talk on
Detection Allegro: Composing Detection Rules with... (Raphael Ruban, Chen Cao)	Raphael Ruban, Chen Cao	30m
Claims an 80% reduction in detection development and maintenance time by wiring a prompt-builder plus a coding agent into the CI: Gather log schemas and… Talk on
You’re Gonna Be Popular: Why They’re Getting a... (Ruby Murphy, Clea Ostendorf)	Ruby Murphy, Clea Ostendorf	32m
Hiring isn’t personal but it is noisy: four root causes—AI resumes vs AI screeners, volume-driven job descriptions, higher automated expectations, and lack of… Talk on
A Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)	Avi Lumelsky, Uri Katz	41m
Researchers report 23 AirPlay flaws that chain into a wormable zero-click RCE and demo full exploits on a MacBook, a Bose Wi‑Fi speaker and a Pioneer CarPlay… Talk on
The great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)	Claudio Merloni, Romain Gaucher	51m
SAST coverage misses the long tail: analysis of ~80,000 repositories surfaces ~7,000 unique dependencies and shows the top 1,000 libraries fully cover only… Talk on
A blueprint for building a generic... (Ashwin Sidhalinganahalli, Fletcher Ramee)	Ashwin Sidhalinganahalli, Fletcher Ramee	42m
A hub‑and‑spoke control plane called Guard stores all policies and pushes them to Topaz sidecar evaluators that run next to apps for millisecond P99 latency… Talk on
Kidnapping a Library: How Ransomware Taught the British Library to... (Brian Myers)	Brian Myers	41m
Ransomware group Rita compromises valid credentials via terminal services because a critical domain lacked MFA exception, stays undetected for days, then… Talk on
Breaking Endpoint Anti-Ransomware: Going... (Nishant Sharma, Vivek Ramachandran)	Nishant Sharma, Vivek Ramachandran	35m
Claims that ransomware can operate entirely in the browser and bypass EDR/SASE/SSE/DLP by abusing web-native controls, demonstrated with an OAuth consent… Talk on
Hunting Malicious IDE Extensions: Building Detection at Scale... (Vinod Tiwari)	Vinod Tiwari	29m
Developer workstations run IDE extensions with full user privileges across VS Code Cursor and JetBrains so a detection pipeline is built that inventories… Talk on
Making WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)	Roy Weisfeld, Surya Pentakota	43m
Shows a working edge security platform that layers AI over CDNs and WAFs to auto-enrich logs, backtest rules in log-only mode, and generate targeted… Talk on
From Auditions to Opening Night: Selecting Security Tools that... (Saurabh Sharma)	Saurabh Sharma	39m
Shows a repeatable selection process: baseline finds ~6,000 vulnerabilities with 13 critical fixes a year and a 325‑day mean time to remediate; pick vendor… Talk on
From pocket to Pwn: How we hacked a multinational Corp for $200 with... (Tim Shipp)	Tim Shipp	29m
Claims a full-domain compromise using off‑the‑shelf gear for about $200 (real cost ~$125 after the $25 Android developer fee). Uses a magnetic nRF24 card… Talk on
Red Teaming from outside: Identifying and exploiting SaaS systems... (Rojan Rijal)	Rojan Rijal	39m
Shows concrete attack chains: abuse of Amazon SES mail-from subdomain to deliver phishing that bypasses SPF/DKIM checks; exploiting unauthenticated GETs used… Talk on
From Noise to Notes: Orchestrating SAST with Developers... (Adrián Puente Z.)	Adrián Puente Z.	31m
Walkthrough shows how a SAST rollout uses Snyk Pro and Semgrep to cut 5,000 noisy findings to ~800, prioritize by business risk and scan 40% of repos that… Talk on
Security for AI Agents Using an Ensemble of Fine-tuned... (Lidan Hazout, Bar Kaduri)	Lidan Hazout, Bar Kaduri	38m
Runtime guardrail intercepts agent tool calls pre-invocation interception and runs an ensemble of fine-tuned SLMs (4–12B) in parallel — instruction‑violation… Talk on
Power Dynamics in Security Leadership: a legato leitmotif... (Sarai Rosenberg)	Sarai Rosenberg	28m
Claims that authoritative directives always withdraw trust and that trust is faster to lose than to build; a four-step method to influence without… Talk on
Closing Remarks (Reed Loden)	Reed Loden	12m
Record attendance nears 3,000 total badges, with 92 sessions (2 keynotes, 86 talks, 4 panels), 602 CFP submissions and 154 presenters producing 3,766 slides… Talk
Saving Bug Bounties from AI Slop	Anto Joseph	32m
Bug bounty platforms drown in AI-generated spam and nonreproducible reports, so the talk demonstrates a working system that uses ZK-TLS/TLSNotary MPC… Talk at AMC Theatre 14, AMC at Metreon on
Opening Remarks (Sunday)	Reed Loden	15m
Welcome back to Day Two with specifics: more than 2,000 people attended yesterday, 58 talks ran across 16 theaters, and the CTF shows an eight-way tie as of… Organiser at AMC IMAX, AMC at Metreon
Against the Tyranny of Optimization: On the Stability of Automated Republics	Katie Moussouris	40m
Against the Tyranny of Optimization: On the Stability of Automated Republics Katie Moussouris AI is transforming cybersecurity faster than institutions can… Talk at AMC IMAX, AMC at Metreon on
📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️	Christo Roberts, Dan Hollinger	41m
Claim: 41% of logins match previously exposed credentials and during a Black Friday week 95% automated during Black Friday week, attackers use Claude Code with… Talk at AMC IMAX, AMC at Metreon on
We Pwn the Night: Growing & Leading an 31337 security research team	Keith Hoodlet	46m
Goal: hire >25% headcount and have every new researcher find zero days in 45 days. Process pairs attitude, aptitude, engagement screening with a C/C++ or Go… Talk at AMC Theatre 12, AMC at Metreon on
Who Watches the NPM Watchers?	Paul McCarty	38m
Research uses canary packages — NPM packages embedding Think Canary tokens (JavaScript payloads, EXEs, PDFs, .env and AWS credential decoys, images in READMEs)… Talk at AMC Theatre 09, AMC at Metreon on
What happened to the lock icon?	Serena Chen	26m
Chrome removes the familiar lock icon in a 2023 redesign after evidence the icon misleads users: a 2021 study finds only 11% correctly identified what the lock… Talk at AMC Theatre 07, AMC at Metreon on
📕 CloudShell Hide-n-Seek: enjoying the sweet persistent sounds of silence! 🔥	Jenko Hwong, Chris Ryan	46m
A multi‑cloud CTF shows an attacker chaining an SSRF to IMDS to dump temporary API creds, enumerate S3, then use those creds to fetch a federated console URL… Talk at AMC Theatre 13, AMC at Metreon on
The AppSec Poverty Line: Minimal Viable Security (Tanya Janca)	Tanya Janca	41m
Defines an “AppSec Poverty Line” as the smallest set of controls under‑resourced teams must implement: input validation, parameterized queries, output… Talk at AMC Theatre 10, AMC at Metreon on
Pwning and Defending AI Agent Code Interpreters (Kinnaird McQuade)	Kinnaird McQuade	45m
Claims live exploitability of code interpreters: prompt-to-RCE, credential theft, and covert C2 payloads. Uses interact and a bespoke DNS C2 that encodes… Talk at AMC Theatre 14, AMC at Metreon on
The Epistemology of Trust (Mike Wilkes)	Mike Wilkes	34m
Argues for measuring resilience by breach cadence (how often you get hit) instead of probability and shows concrete fixes: use EPSS v4 to prioritize reachable… Talk at AMC Theatre 12, AMC at Metreon on
Sandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes (Mark Manning)	Mark Manning	43m
Covers practical limits of seccomp for Kubernetes: tracing tools (strace, Inspector Gadget, tracie) give inconsistent syscall sets across the same image, a… Talk at AMC Theatre 09, AMC at Metreon on
Security on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)	Jared Casner	33m
Argues that a credible security program is possible on a tiny budget by prioritizing basics: passkeys and phishing-resistant MFA, SPF/DKIM/DMARC, short‑lived… Talk at AMC Theatre 10, AMC at Metreon on
The Risky Business of Risk Illiteracy (Sean Juroviesky)	Sean Juroviesky	26m
Claim: 68% of breaches stem from non‑malicious human factors and 98% of those would be stopped by enforcing MFA. Build an inventory, layered data‑flow diagrams… Talk at AMC Theatre 12, AMC at Metreon on
Running an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)	Garrett McNamara, Jeff Guerra	45m
Covers concrete steps: implement a two-way vendor API integration, add Slack chat‑ops or Tines automations to auto‑triage and escalate, build a ServiceNow app… Talk at AMC Theatre 13, AMC at Metreon on
One Thousand and One AI-Prevented CVEs: Vibe Coding a Whole New... (Brandon Wu)	Brandon Wu	44m
Pipeline combines a deterministic callgraph built with Semgrep static analysis and GitHub usage scraping with selective LLM research to auto‑generate tests and… Talk at AMC Theatre 14, AMC at Metreon on
How the Vietnam War created single sign-on — and how it's evolved... (Connor Peshek)	Connor Peshek	28m
Claims that modern single sign-on traces to an NSA system called Bell Field created during Vietnam, which centralizes keys to issue one-time session keys so… Talk at AMC Theatre 07, AMC at Metreon on
How to sell your soul, err, your security program (Jenn Gile)	Jenn Gile	35m
Shows how to stop preaching security and start selling outcomes by borrowing product marketing practices: identify the buying committee, run 3–5 interviews per… Talk at AMC Theatre 12, AMC at Metreon on
MCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)	Jonathan Leitschuh	45m
Weaponizes DNS rebinding against SSE/streaming HTTP MCP servers to pivot a browser into local/dev infrastructure, exfiltrates environment variables and… Talk at AMC Theatre 14, AMC at Metreon on
Google Drive Hunter: Building the Tool Google Should’ve Built (Ayman Elsawah)	Ayman Elsawah	23m
Open-source tool Sleuthther (formerly Google Drive Hunter) scans every Google Workspace user via Directory and Drive APIs, exports per-user sheets with direct… Talk at AMC Theatre 09, AMC at Metreon on
Your AI Agent Has Production Access: Now What? (Jack)	Jack	45m
Outlines a practical security stack: identify the lethal trifecta (network egress, sensitive-data access, untrusted input) and remove any leg or severely scope… Talk at AMC Theatre 13, AMC at Metreon on
nothing matches

-- 91 of 91 talks indexed --