Loading…
Monday, May 26
 

8:15am CEST

Coffee/Tea
Monday May 26, 2025 8:15am - 9:00am CEST
Meals provided by OWASP. Come join us in the Expo Hall
Monday May 26, 2025 8:15am - 9:00am CEST
  Meals provided by OWASP

8:15am CEST

Registration
Monday May 26, 2025 8:15am - 6:00pm CEST
Monday May 26, 2025 8:15am - 6:00pm CEST

9:00am CEST

3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training
Monday May 26, 2025 9:00am - 5:00pm CEST
Room 119
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Download the complete training outline: AI Whiteboard Hacking Training Details

Testimonial: "After years evaluating security trainings at Black Hat, including Toreon's Whiteboard Hacking sessions, I can say this AI threat modeling course stands out. The hands-on approach and flow are exceptional - it's a must-attend."
- Daniel Cuthbert, Global Head of Cyber Security Research, Black Hat Review Board Member

In today's rapidly evolving AI landscape, security threats like prompt injection and data poisoning pose significant risks to AI systems. Our 3-day AI Whiteboard Hacking training equips you with practical skills to identify, assess, and mitigate AI-specific security threats using our proven DICE methodology. Through hands-on exercises and real-world scenarios, you'll learn to build secure AI systems while ensuring compliance with regulations like the EU AI Act.

The training concludes with an engaging red team/blue team wargame where you'll put theory into practice by attacking and defending a rogue AI research assistant. Upon completion, you'll earn the AI Threat Modeling Practitioner Certificate and gain access to a year-long subscription featuring quarterly masterclasses, expert Q&A sessions, and continuously updated resources.

Led by Sebastien Deleersnyder, co-founder and CTO of Toreon, and Black Hat trainer, this training combines technical expertise with practical insights gained from real-world projects across government, finance, healthcare, and technology sectors.

Quick Overview:
·       Target Audience: AI Engineers, Software Engineers, Solution Architects, Security Professionals
·       Prerequisites: Basic understanding of AI concepts (pre-training materials provided)
·       Certification: AI Threat Modeling Practitioner Certificate
·       Bonus: 1-year AI Threat Modeling Subscription included

Our lineup of the hands-on exercises from the training that let you put AI security concepts into practice:
Day 1: Foundations & Methodology
· "AI Security Headlines from the Future" - Explore potential security scenarios
· "Diagramming the AI Assistant Infrastructure" - Map out real AI system components
· "Identification of STRIDE-AI threats for UrbanFlow" - Apply threat modeling to urban systems
· "Autonomous Vehicle System Attack Tree Analysis" - Build attack scenarios

Day 2: Implementation & Defense
· "The Curious Chatbot Challenge (Injection)" - Hands-on prompt injection threats
· "Applying OWASP AI Exchange on a RAG-powered CareBot" - Real-world threat library application
· "AI Security Architecture Building Blocks Workshop" - Design secure AI systems
· "AI Risk Assessment: Autonomous Healthcare Robots" - Evaluate real-world AI risks

Day 3: Advanced Concepts & Practical Application
· "Ethics in Action - The FairCredit AI Incident" - Navigate ethical AI challenges
· "Data minimization and secure data handling for AI agents" - Implement privacy-by-design
· "Mapping attacks and controls in an MLOps pipeline" - Secure the AI development lifecycle
· "Project Prometheus: The Rogue AI Research Assistant" - Red Team/Blue Team wargame finale

Download the complete training outline: AI Whiteboard Hacking Training Details
Speakers
avatar for Sebastien Deleersnyder

Sebastien Deleersnyder

CTO, Toreon
Sebastien Deleersnyder, also known as Seba, is a highly accomplished individual in the field of cybersecurity. He is the CTO and co-founder of Toreon, as well as the COO and lead threat modeling trainer of Data Protection Institute. Seba holds a Master's degree in Software Engineering... Read More →
Monday May 26, 2025 9:00am - 5:00pm CEST
Room 119 CCIB
  3-Day Training

9:00am CEST

3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access
Monday May 26, 2025 9:00am - 5:00pm CEST
Room 118
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Modern IT systems are increasingly complex, making full-stack expertise more essential than ever. That's why diving into full-stack pentesting is crucial—you will gain the skills needed to master modern attack vectors and implement effective defensive countermeasures.

For each attack, vulnerability and technique presented in this training, there is a lab exercise to help you develop your skills step by step. What's more, when the training is over, you can take the complete lab environment home to hack again at your own pace.

I found security bugs in many companies including Google, Yahoo, Mozilla, Twitter and in this training I'll share my experience with you.

Key Learning Objectives
After completing this training, you will have learned about:

- Hacking cloud applications
- API hacking tips & tricks
- Data exfiltration techniques
- OSINT asset discovery tools
- Tricky user impersonation
- Bypassing protection mechanisms
- CLI hacking scripts
- Interesting XSS attacks
- Server-side template injection
- Hacking with Google & GitHub search engines
- Automated SQL injection detection and exploitation
- File read & file upload attacks
- Password cracking in a smart way
- Hacking Git repos
- XML attacks
- NoSQL injection
- HTTP parameter pollution
- Web cache deception attack
- Hacking with wrappers
- Finding metadata with sensitive information
- Hijacking NTLM hashes
- Automated detection of JavaScript libraries with known vulnerabilities
- Extracting passwords
- Hacking Electron applications
- Establishing reverse shell connections
- RCE attacks
- XSS polyglot
- and more …

What Students Will Receive
Students will be handed in a VMware image with a specially prepared lab environment to play with all attacks, vulnerabilities and techniques presented in this training. When the training is over, students can take the complete lab environment home (after signing a non-disclosure agreement) to hack again at their own pace.

Special Bonus
The ticket price includes FREE access to my 6 online courses:

- Fuzzing with Burp Suite Intruder
- Exploiting Race Conditions with OWASP ZAP
- Case Studies of Award-Winning XSS Attacks: Part 1
- Case Studies of Award-Winning XSS Attacks: Part 2
- How Hackers Find SQL Injections in Minutes with Sqlmap
- Web Application Security Testing with Google Hacking

What Students Say About My Trainings
References are attached to my LinkedIn profile (https://www.linkedin.com/in/dawid-czagan-85ba3666/). They can also be found here: https://silesiasecuritylab.com/services/training/#opinions – training participants from companies such as Oracle, Adobe, ESET, ING, …

What Students Should Know
To get the most of this training intermediate knowledge of web application security is needed. Students should have experience in using a proxy, such as Burp Suite Proxy or Zed Attack Proxy (ZAP), to analyze or modify the traffic.

What Students Should Bring
Students will need a laptop with 64-bit operating system, at least 8 GB RAM, 35 GB free hard drive space, administrative access, ability to turn off AV/firewall and VMware Player/Fusion installed (64-bit version). Prior to the training, make sure there are no problems with running x86_64 VMs.

Additional notes
This new 3-day training was sold out at top security conferences e.g. DEF CON 2024 (Las Vegas), Hack In Paris (Paris).

This is a 100% hands-on training: for each attack, vulnerability and technique presented in this training, there is a lab exercise to help students develop their skills step by step.
Speakers
avatar for Dawid Czagan

Dawid Czagan

Founder and CEO, Silesia Security Lab
Dawid Czagan is an internationally recognized security researcher and trainer. He is listed among top hackers at HackerOne. Dawid Czagan has found security bugs in Apple, Google, Mozilla, Microsoft and many others. Due to the severity of many bugs, he received numerous awards for... Read More →
Monday May 26, 2025 9:00am - 5:00pm CEST
Room 118 CCIB
  3-Day Training

9:00am CEST

3-Day Training: The Mobile Playbook - A guide for iOS and Android App Security
Monday May 26, 2025 9:00am - 5:00pm CEST
Room 120
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This three-day hands-on course, available in person or via remote access, teaches penetration testers, developers and engineers how to analyse Android and iOS applications for security vulnerabilities by going through the different phases of testing, including dynamic testing, static analysis, reverse engineering and Software Composition Analysis (SCA). The foundation for this will be the OWASP Mobile Application Security Testing Guide (MASTG). The OWASP MASTG is a comprehensive and open source mobile security testing book that covers both, iOS and Android and provides a methodology and very detailed technical test cases to ensure completeness and use the latest attack techniques against mobile applications. This course will give you hands-on experience with open source tools and advanced methodologies by guiding you through real-world scenarios.

Detailed outline

Day 1: We'll start the first day with an introduction to the OWASP MASVS and MASTG and the latest updates to it and then dive into the Android platform and its security architecture. Students will no longer be required to bring their own Android device, instead each student will be provided with a cloud-based virtualised Android device from Corellium.

Topics include:

- Intercepting network traffic from apps written in mobile app frameworks such as Google's Flutter
- Reverse engineering a Kotlin app and identifying and exploiting a real-world deep link vulnerability through manual source code review.
- Explore the differences and effectiveness of reverse engineering Android apps using Smali patching, Magisk and Dynamic Instrumentation with Frida
- Frida crash course to get started with dynamic instrumentation on Android apps
- Bypass different implementations of SSL pinning using Frida
- Use dynamic instrumentation with Frida to
- Bypass multiple root detection mechanisms
- Bypass Frida detection mechanisms
- Day 1 will be closed with a Capture the Flag (CTF)

On day 2 we start with applying our new skills to a real world app and wrap up the Android part and start with iOS. We will use a Github repo that will allow us to execute static scanning, SCA and secret scanning on Kotlin and Swift:

Android:

- Attacking a real world app and overcome it's protection mechanisms.
- Analyse the storage of an Android app and understand the various options on how and where files can be stored (app-specific, shared storage etc.)
- Using Brida (Frida and Burp) to bypass End2End encryption in an Android App
- Static Scanning of Kotlin source code, identifying vulnerabilities and eliminating false positives
- Scanning for secrets in an APK

iOS:

- Introduction into iOS Security fundamentals
- Scanning for secrets in a Swift repository and identifying ways to handle them securely.
- Software Composition Analysis (SCA) for iOS - Scanning 3rd party libraries and SDKs in mobile package managers for known vulnerabilities and mitigation strategies.
- Demonstration on how to test watchOS apps and it's limitations
- Statically scanning Swift source code, identifying vulnerabilities and eliminating false positives.

Day 3 focuses on iOS. We will begin the day by creating an iOS test environment using Corellium and dive into several topics, including:

- Intercepting network traffic of an iOS App in various scenarios, including intercepting traffic that is not HTTP
- Examining stateless authentication (JWT) in a mobile app
- A Frida crash course to get started with dynamic instrumentation for iOS applications
- Analyse the storage of an iOS app and understand the various options on how (Realm databases etc.) and where files can be stored.
- Testing methodology with a non-jailbroken (jailed) device by repackaging an IPA with the Frida gadget
- Using Frida to bypass runtime instrumentation of iOS applications
- Anti-Jailbreaking Mechanisms
- Frida's detection mechanism

We'll wrap up the final day with a CTF and participants can win a prize!

Whether you are a beginner who wants to learn mobile app testing from the ground up, or an experienced pentester or developer who wants to improve your existing skills to perform more advanced attack techniques, or just for fun, this training will help you achieve your goals.

The course consists of many different labs developed by the instructor and is approximately 65% hands-on and 35% lecture.

Upon successful completion of this course, students will have a better understanding of how to test for vulnerabilities in mobile applications, how to suggest the right mitigation techniques to developers, and how to perform tests consistently.

What students should bring

The following requirements must be met by students in order to be able to follow all exercises and participate fully:

- Laptop (Windows/Linux/macOS) with at least 8GB of RAM and 40GB of free disk space.
- Full administrative access in case of problems with the laptop environment (e.g. ability to disable VPN or AV/EDR)
- Virtualisation software (e.g. VMware, VirtualBox, UTM); a virtual machine will be provided for X86 and ARM architecture (for M1/M2/M3/M4 MacBooks) with all tools required for the training.
- Ideally a tablet to have a second screen for the practical lab slides when doing the hands-on sessions.

An iOS and Android device is NOT required as an emulated instance is provided for each student hosted at Corellium. This is a cloud-based environment that allows each student access to a jailbroken iOS device and a rooted Android device during the training.

What students will receive

- Slide deck and labs for the iOS and Android training as PDF and all videos for all demonstrations shared in class.
- All vulnerable apps used during the training, either as APK or IPA.
- Docker Containers with the APIs the apps were communicating with.
- Detailed write-ups for all labs so you can review them at your own pace after the course.
- Dedicated Slack channel used to help students prepare before the course, communicate during the course and stay in touch after the course for any questions.
- Printed hand-out of the Labs

What prerequisites should students have before attending this training?

- This course is for Beginners and Intermediate
- Basic understanding of mobile apps
- Able to use Linux command line



Speakers
avatar for Sven Schleier

Sven Schleier

Principal Security Consultant, Crayon
Sven is a Principal Security Consultant at Crayon, Austria and leads the professional services for cloud security. He also has extensive experience in offensive security engagements (penetration testing) and application security, specifically in guiding software development teams... Read More →
Monday May 26, 2025 9:00am - 5:00pm CEST
Room 120
  3-Day Training

10:30am CEST

AM Break
Monday May 26, 2025 10:30am - 11:00am CEST
Meals provided by OWASP
Monday May 26, 2025 10:30am - 11:00am CEST
  Meals provided by OWASP

12:30pm CEST

Lunch
Monday May 26, 2025 12:30pm - 1:30pm CEST
Meals provided by OWASP
Monday May 26, 2025 12:30pm - 1:30pm CEST
  Meals provided by OWASP

3:00pm CEST

PM Break
Monday May 26, 2025 3:00pm - 3:30pm CEST
Meals provided by OWASP
Monday May 26, 2025 3:00pm - 3:30pm CEST
  Meals provided by OWASP
 
Tuesday, May 27
 

8:15am CEST

Coffee/Tea
Tuesday May 27, 2025 8:15am - 9:00am CEST
Meals provided by OWASP. Come join us in the Expo Hall
Tuesday May 27, 2025 8:15am - 9:00am CEST
  Meals provided by OWASP

8:15am CEST

Registration
Tuesday May 27, 2025 8:15am - 6:00pm CEST
Tuesday May 27, 2025 8:15am - 6:00pm CEST

9:00am CEST

2-Day Training: Adam Shostack's Threat Modeling Intensive
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 121
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This hands-on, interactive class will focus on learning to threat model by executing each of the steps. Students will start with a guided threat modeling exercise, and we'll then iterate and break down the skills they're learning in more depth. We'll progressing through the Four Questions of Threat Modeling: what are we working on, what can go wrong, what are we going to do about it and did we do a good job. This is capped off with an end-to-end exercise that brings the skills together.
Speakers
avatar for Adam Shostack

Adam Shostack

Founder, Shostack & Associates
Adam Shostack is a leading expert on threat modeling. He has decades of experience delivering security. His experience ranges across the business world from founding startups to nearly a decade at Microsoft. His accomplishments include:  Helped create the CVE. Now an Emeritus member... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 121
  2-Day Training

9:00am CEST

2-Day Training: Application Security Training with Jim Manico
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 122
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Core Modules
00-00 Intro to App Security
00-01 Input Validation Basics
00-02 HTTP Security Basics
00-03 SOP and CORS
00-04 API and REST Security
00-05 Microservice Security
00-06 JSON Web Tokens
00-07 SQL and Other Injections
00-08 Cross-Site Request Forgery - CSRF Defenses for Various Architectures
00-09 File Upload and File I/O Security - Secure File Upload, File I/O Security
00-10 Deserialization Security - Safe Deserialization Practices
00-11 Artificial Intelligence Security - Securing AI Implementations, Full Course
00-12 Third-Party Library Security Management - Ensuring Third-Party Library Security
00-13 Introduction to Cloud Security - Basics of Cloud Security Management
00-14 Intro to iOS and Android Security - Mobile Security Fundamentals

Standards
01-00 OWASP Top Ten - Top Ten Web Security Risks
01-01 Intro to GDPR - European Data Privacy Law
01-02 OWASP ASVS - Comprehensive Secure Coding Standard
01-03 OWASP Top Ten Proactive Controls - Web Security Defense Categories
01-04 PCI Secure SDLC Standard - Credit Card SDLC Requirements

User Interface Security
02-00 XSS Defense - Client-Side Web Security
02-01 Content Security Policy - Advanced Client-Side Web Security
02-02 Content Spoofing and HTML Hacking - HTML Client-Side Injection Attacks
02-03 React Security - Secure React Application Development
02-04 Vue.js Security - Secure Vue.js Application Development
02-05 Angular and AngularJS Security - Secure Angular App Development
02-06 Clickjacking - UI Redress Attack Defense

Identity & Access Management
03-01 Authentication Best Practices - Web Authentication Practices
03-02 Session Management Best Practices - Web Session Management Practices
03-03 Multi-Factor Authentication - NIST SP-800-63 Compliant MFA Implementation
03-04 Secure Password Policy and Storage - Secure User Password Policy and Storage
03-05 Access Control Design - ABAC/Capabilities-Based Access Control
03-06 OAuth2 Security - OAuth2 Authorization Protocol
03-07 OpenID Connect Security - OpenID Connect Federation Protocol

Crypto Modules
04-00 Secrets Management - Key and Credential Storage Strategies
04-01 HTTPS/TLS Best Practices - Transport Security Introduction
04-02 Cryptography Fundamentals - Part 1 - Terminology, Steganography, Attacks, Kerchoff's Principle, PFC
04-03 Cryptography Fundamentals - Part 2 - Hash Functions, Symmetric Cryptography, Randomness, Digital Signatures

Process
05-00 DevOps Best Practices - DevOps and DevSecOps with a CD/CI Focus
05-01 Secure SDLC and AppSec Management - Managing Secure Software Processes

Additional Topics
06-00 User and Helpdesk Awareness Training - Security Awareness for Non-Technical Staff
06-01 Social Engineering for Developers - Developer Protection Against Social Engineering
06-02 App Layer Intrusion Detection - Detecting App Layer Attacks
06-03 Threat Modeling Fundamentals - Security Design via Threat Modeling
06-04 Forms and Workflows Security - Secure Handling of Complex Forms
06-05 Java 8/9/10/11/12/13+ Security Controls - Java Security Advances
06-06 Logging and Monitoring Security - Security-Focused Logging
06-07 Subdomain Takeover - Preventing Subdomain Takeover Scenarios
06-08 Laravel and PHP Security - Focus on PHP Security

Lab Options
07-00 Competitive Web Hacking LABS - Hands-on Web Hacking Labs
07-01 Competitive API Hacking LABS - Hands-on API Hacking Labs
07-02 Secure Coding Knowledge LABS - Hands-on Secure Coding Labs
Speakers
avatar for Jim Manico

Jim Manico

Founder, Manicode Security
Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. He is also an investor/advisor for 10Security, Aiya, MergeBase, Nucleus Security, KSOC, and Inspectiv. Jim is a frequent speaker on secure software practices... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 122
  2-Day Training

9:00am CEST

2-Day Training: AppSec Automation Masterclass
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 124
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This training takes a comprehensive, focused and practical approach at implementing DevSecOps Practices with a focus on Application Security Automation. The training is a glued-to-your-keyboard hands-on journey with labs that are backed by practical examples of DevSecOps and AppSec Automation.

The Training starts with a view of DevSecOps and AppSec Automation, specifically in terms of embedding security activities in multiple stages of the Software Development Lifecycle. Subsequently, the training delves into specific Application Security Automation approaches for SAST, SCA and Supply-Chain Security, DAST and Integration of these tools into CI/CD tools and Automation Pipelines.
Speakers
avatar for Abhay Bhargav

Abhay Bhargav

Founder of the Chief Research Officer of AppSecEngineer and we45, we45
Abhay Bhargav is the Founder of the Chief Research Officer of AppSecEngineer, an elite, hands-on online training platform and we45 a specialized AppSec Company. Abhay started his career as a breaker of apps, in pentesting and red-teaming, but today is more involved in scaling AppSec... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 124
  2-Day Training

9:00am CEST

2-Day Training: Building a High-Value App Scanning Programme (2025 Update)
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 123
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

You bought the application security tools, you have the findings, but now what? Many organisations find themselves drowning in "possible vulnerabilities", struggling to streamline their processes and not sure how to measure their progress.

If you are involved in using SAST, DAST or SCA tools in your organisation, these may be familiar feelings to you.

In this course, which is being refreshed and updated for 2025, you will learn how to address these problems and more (in a vendor-neutral way)

For 2025, we are putting a particular emphasis on practicality and activities which bring value with topics including the following:

• Customising the tools to focus on your needs
• Building tool processes which fit your business
• Automating workflows using CI/CD without slowing it down
• Showing the value and improvements you are making
• Finding ways to scale triage to cut down noise
• Focusing on fixing what matters in your situation
• Advantages and disadvantages of alternative forms of remediation
• Comparison of the different tool types covered and which you may want to use in different situations.
• The use of Vulnerability Aggregation and ASPMs

To bring the course to life and let you apply what you learn, you will work in teams on table-top exercises where you design processes to cover specific scenarios, explain and justify your decisions to simulated stakeholders and practice prioritising your remediation efforts.

For these exercises, you will work based on specially designed process templates (which we will provide) which you can use afterwards to apply these improvements within your own organisation.

Be ready to work in a group, take part in discussions and present your findings and leave the course with clear strategies and ideas on how to get less stress and more value from these tools.
Speakers
avatar for Josh Grossman

Josh Grossman

CTO, Bounce Security
Josh Grossman has worked as a consultant in IT and Application Security and Risk for 15 years now, as well as a Software Developer. This has given him an in-depth understanding of how to manage the balance between business needs, developer needs and security needs which goes into... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 123
  2-Day Training

9:00am CEST

2-Day Training: Hacking Modern Web Apps: Master the Future of Attack Vectors
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 127
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This course is a 100% hands-on deep dive into the OWASP Security Testing Guide and relevant items of the OWASP Application Security Verification Standard (ASVS), so this course covers and goes beyond the OWASP Top Ten.

Long are the days since web servers were run by perl scripts apps written in Delphi. What is common between Walmart, eBay, PayPal, Microsoft, LinkedIn, Google and Netflix? They all use Node.js: JavaScript on the server.

Modern Web apps share traditional attack vectors and also introduce new opportunities to threat actors. This course will teach you how to review modern web apps, showcasing Node.js but using techniques that will also work against any other web app platform. Ideal for Penetration Testers, Web app Developers as well as everybody interested in JavaScript/Node.js and Modern app stack security.

Get a FREE taste for this training, including access to video recording, slides and vulnerable apps to play with:
1 hour workshop - https://7asecurity.com/free-workshop-web-apps

All action, no fluff, improve your security analysis workflow and immediately apply these gained skills in your workplace, packed with exercises, extra mile challenges and CTF, self-paced and suitable for all skill levels, with continued education via unlimited email support, lifetime access, step-by-step video recordings and interesting apps to practice, including all future updates for free.
Speakers
avatar for Abraham Aranguren

Abraham Aranguren

CEO, 7aSecurity
After 17 years in itsec and 24 in IT Abraham is now the CEO of 7ASecurity (7asecurity.com), a company specializing in penetration testing of web/mobile apps, infrastructure, code reviews and training. Co-Author of the Mobile, Web and Desktop (Electron) app 7ASecurity courses. Security... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 127
  2-Day Training

9:00am CEST

2-Day Training: Practical Privacy by Design - Going Beyond Security in your SDLC
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 125
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Privacy is hot! This course will teach you this in-demand skillset and give you hands-on experience with privacy challenges, guiding you to combine Privacy by Design with your security practice.

Our lives are becoming more and more digitized, resulting in a lot of personal data floating around in the cloud. Now, many organizations are keen to use personal data for marketing, personalization or monetization, however, all this personal data comes with increased risk and surprising impact. Noone wants to find out that their daughter is pregnant from the department store ads…

Moreover, data protection legislation is forcing companies to integrate a technical approach for privacy into system design. With ever higher demands for privacy-respecting products, security teams have implicitly gained additional responsibilities and are hard pressed to keep up with these emerging requirements and often feel like there is a substantial and growing skills gap. Incorporating privacy into security with a proactive approach is essential to addressing this!

Traditional security approaches have historically not focused on this aspect of data protection, leaving individuals at risk. While common compliance and governance aspects of privacy are important, the technical aspects of privacy engineering are substantially more challenging - and that is the primary focus of this course.

This interactive technical course will teach you privacy analysis skills that are valuable to security teams. You can leverage your existing security skills with just a shift of mindset, since privacy largely shares the same foundation as security. We will teach you how common security techniques, such as architecture specification, threat modeling, and mitigation design, can be adapted for privacy. You will learn to capture how sensitive data flows through the system, and identify and mitigate high impact privacy issues in the software system. This will enable you to build privacy into the core of the product design and development process, while aligning it efficiently with security practices.

The course will cover these main topics:
- Privacy engineering essentials
- Privacy architecture & feature analysis
- Data inventory, mapping, and tagging
- Privacy threats (e.g. LINDDUN)
- Privacy controls, mitigations, and technologies
- Full privacy process

Each of these topics will be taught in an engaging, interactive format, with plenty of hands-on, collaborative exercises. We will teach you both the technical skills and social aspects essential for successful privacy engineering. This will include an assortment of relevant scenarios for each module, realistic simulations of popular upcoming features, diagramming tasks, and open debates. You will gain confidence using proven design techniques in order to improve the privacy posture of your system. In each module, you'll gain hands-on privacy experience through a set of exercises and class discussions.

We received rave reviews on our previous delivery of this course, for example:
- "If you're looking for a challenging, in-depth Privacy course which focuses on the technical aspects, look no further. Yes, it's only a 2-day course, but during that time, you'll take a deep dive into threat modelling, architecture, and other aspects required for ensuring Privacy is included in the SDLC."
Speakers
avatar for Avi Douglen

Avi Douglen

Founder and CEO, Bounce Security
avatar for Dr. Kim Wuyts

Dr. Kim Wuyts

Manager Cyber & Privacy, PwC
Dr. Kim Wuyts is a leading privacy engineering expert with over 15 years of experience in security and privacy. Before joining PwC Belgium as Manager Cyber & Privacy, Kim was a senior researcher at KU Leuven where she led the development and extension of LINDDUN, a popular privacy... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 125
  2-Day Training

9:00am CEST

3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 119
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Download the complete training outline: AI Whiteboard Hacking Training Details

Testimonial: "After years evaluating security trainings at Black Hat, including Toreon's Whiteboard Hacking sessions, I can say this AI threat modeling course stands out. The hands-on approach and flow are exceptional - it's a must-attend."
- Daniel Cuthbert, Global Head of Cyber Security Research, Black Hat Review Board Member

In today's rapidly evolving AI landscape, security threats like prompt injection and data poisoning pose significant risks to AI systems. Our 3-day AI Whiteboard Hacking training equips you with practical skills to identify, assess, and mitigate AI-specific security threats using our proven DICE methodology. Through hands-on exercises and real-world scenarios, you'll learn to build secure AI systems while ensuring compliance with regulations like the EU AI Act.

The training concludes with an engaging red team/blue team wargame where you'll put theory into practice by attacking and defending a rogue AI research assistant. Upon completion, you'll earn the AI Threat Modeling Practitioner Certificate and gain access to a year-long subscription featuring quarterly masterclasses, expert Q&A sessions, and continuously updated resources.

Led by Sebastien Deleersnyder, co-founder and CTO of Toreon, and Black Hat trainer, this training combines technical expertise with practical insights gained from real-world projects across government, finance, healthcare, and technology sectors.

Quick Overview:
·       Target Audience: AI Engineers, Software Engineers, Solution Architects, Security Professionals
·       Prerequisites: Basic understanding of AI concepts (pre-training materials provided)
·       Certification: AI Threat Modeling Practitioner Certificate
·       Bonus: 1-year AI Threat Modeling Subscription included

Our lineup of the hands-on exercises from the training that let you put AI security concepts into practice:
Day 1: Foundations & Methodology
· "AI Security Headlines from the Future" - Explore potential security scenarios
· "Diagramming the AI Assistant Infrastructure" - Map out real AI system components
· "Identification of STRIDE-AI threats for UrbanFlow" - Apply threat modeling to urban systems
· "Autonomous Vehicle System Attack Tree Analysis" - Build attack scenarios

Day 2: Implementation & Defense
· "The Curious Chatbot Challenge (Injection)" - Hands-on prompt injection threats
· "Applying OWASP AI Exchange on a RAG-powered CareBot" - Real-world threat library application
· "AI Security Architecture Building Blocks Workshop" - Design secure AI systems
· "AI Risk Assessment: Autonomous Healthcare Robots" - Evaluate real-world AI risks

Day 3: Advanced Concepts & Practical Application
· "Ethics in Action - The FairCredit AI Incident" - Navigate ethical AI challenges
· "Data minimization and secure data handling for AI agents" - Implement privacy-by-design
· "Mapping attacks and controls in an MLOps pipeline" - Secure the AI development lifecycle
· "Project Prometheus: The Rogue AI Research Assistant" - Red Team/Blue Team wargame finale

Download the complete training outline: AI Whiteboard Hacking Training Details
Speakers
avatar for Sebastien Deleersnyder

Sebastien Deleersnyder

CTO, Toreon
Sebastien Deleersnyder, also known as Seba, is a highly accomplished individual in the field of cybersecurity. He is the CTO and co-founder of Toreon, as well as the COO and lead threat modeling trainer of Data Protection Institute. Seba holds a Master's degree in Software Engineering... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 119 CCIB
  3-Day Training

9:00am CEST

3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 118
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Modern IT systems are increasingly complex, making full-stack expertise more essential than ever. That's why diving into full-stack pentesting is crucial—you will gain the skills needed to master modern attack vectors and implement effective defensive countermeasures.

For each attack, vulnerability and technique presented in this training, there is a lab exercise to help you develop your skills step by step. What's more, when the training is over, you can take the complete lab environment home to hack again at your own pace.

I found security bugs in many companies including Google, Yahoo, Mozilla, Twitter and in this training I'll share my experience with you.

Key Learning Objectives
After completing this training, you will have learned about:

- Hacking cloud applications
- API hacking tips & tricks
- Data exfiltration techniques
- OSINT asset discovery tools
- Tricky user impersonation
- Bypassing protection mechanisms
- CLI hacking scripts
- Interesting XSS attacks
- Server-side template injection
- Hacking with Google & GitHub search engines
- Automated SQL injection detection and exploitation
- File read & file upload attacks
- Password cracking in a smart way
- Hacking Git repos
- XML attacks
- NoSQL injection
- HTTP parameter pollution
- Web cache deception attack
- Hacking with wrappers
- Finding metadata with sensitive information
- Hijacking NTLM hashes
- Automated detection of JavaScript libraries with known vulnerabilities
- Extracting passwords
- Hacking Electron applications
- Establishing reverse shell connections
- RCE attacks
- XSS polyglot
- and more …

What Students Will Receive
Students will be handed in a VMware image with a specially prepared lab environment to play with all attacks, vulnerabilities and techniques presented in this training. When the training is over, students can take the complete lab environment home (after signing a non-disclosure agreement) to hack again at their own pace.

Special Bonus
The ticket price includes FREE access to my 6 online courses:

- Fuzzing with Burp Suite Intruder
- Exploiting Race Conditions with OWASP ZAP
- Case Studies of Award-Winning XSS Attacks: Part 1
- Case Studies of Award-Winning XSS Attacks: Part 2
- How Hackers Find SQL Injections in Minutes with Sqlmap
- Web Application Security Testing with Google Hacking

What Students Say About My Trainings
References are attached to my LinkedIn profile (https://www.linkedin.com/in/dawid-czagan-85ba3666/). They can also be found here: https://silesiasecuritylab.com/services/training/#opinions – training participants from companies such as Oracle, Adobe, ESET, ING, …

What Students Should Know
To get the most of this training intermediate knowledge of web application security is needed. Students should have experience in using a proxy, such as Burp Suite Proxy or Zed Attack Proxy (ZAP), to analyze or modify the traffic.

What Students Should Bring
Students will need a laptop with 64-bit operating system, at least 8 GB RAM, 35 GB free hard drive space, administrative access, ability to turn off AV/firewall and VMware Player/Fusion installed (64-bit version). Prior to the training, make sure there are no problems with running x86_64 VMs.

Additional notes
This new 3-day training was sold out at top security conferences e.g. DEF CON 2024 (Las Vegas), Hack In Paris (Paris).

This is a 100% hands-on training: for each attack, vulnerability and technique presented in this training, there is a lab exercise to help students develop their skills step by step.
Speakers
avatar for Dawid Czagan

Dawid Czagan

Founder and CEO, Silesia Security Lab
Dawid Czagan is an internationally recognized security researcher and trainer. He is listed among top hackers at HackerOne. Dawid Czagan has found security bugs in Apple, Google, Mozilla, Microsoft and many others. Due to the severity of many bugs, he received numerous awards for... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 118 CCIB
  3-Day Training

9:00am CEST

3-Day Training: The Mobile Playbook - A guide for iOS and Android App Security
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 120
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This three-day hands-on course teaches penetration testers, developers and engineers how to analyse Android and iOS applications for security vulnerabilities by going through the different phases of testing, including dynamic testing, static analysis, reverse engineering and Software Composition Analysis (SCA). The foundation for this will be the OWASP Mobile Application Security Testing Guide (MASTG). The OWASP MASTG is a comprehensive and open source mobile security testing book that covers both, iOS and Android and provides a methodology and very detailed technical test cases to ensure completeness and use the latest attack techniques against mobile applications. This course will give you hands-on experience with open source tools and advanced methodologies by guiding you through real-world scenarios.

Detailed outline

Day 1: We'll start the first day with an introduction to the OWASP MASVS and MASTG and the latest updates to it and then dive into the Android platform and its security architecture. Students will no longer be required to bring their own Android device, instead each student will be provided with a cloud-based virtualised Android device from Corellium.

Topics include:

- Intercepting network traffic from apps written in mobile app frameworks such as Google's Flutter
- Reverse engineering a Kotlin app and identifying and exploiting a real-world deep link vulnerability through manual source code review.
- Explore the differences and effectiveness of reverse engineering Android apps using Smali patching, Magisk and Dynamic Instrumentation with Frida
- Frida crash course to get started with dynamic instrumentation on Android apps
- Bypass different implementations of SSL pinning using Frida
- Use dynamic instrumentation with Frida to
- Bypass multiple root detection mechanisms
- Bypass Frida detection mechanisms
- Day 1 will be closed with a Capture the Flag (CTF)

On day 2 we start with applying our new skills to a real world app and wrap up the Android part and start with iOS. We will use a Github repo that will allow us to execute static scanning, SCA and secret scanning on Kotlin and Swift:

Android:

- Attacking a real world app and overcome it's protection mechanisms.
- Analyse the storage of an Android app and understand the various options on how and where files can be stored (app-specific, shared storage etc.)
- Using Brida (Frida and Burp) to bypass End2End encryption in an Android App
- Static Scanning of Kotlin source code, identifying vulnerabilities and eliminating false positives
- Scanning for secrets in an APK

iOS:

- Introduction into iOS Security fundamentals
- Scanning for secrets in a Swift repository and identifying ways to handle them securely.
- Software Composition Analysis (SCA) for iOS - Scanning 3rd party libraries and SDKs in mobile package managers for known vulnerabilities and mitigation strategies.
- Demonstration on how to test watchOS apps and it's limitations
- Statically scanning Swift source code, identifying vulnerabilities and eliminating false positives.

Day 3 focuses on iOS. We will begin the day by creating an iOS test environment using Corellium and dive into several topics, including:

- Intercepting network traffic of an iOS App in various scenarios, including intercepting traffic that is not HTTP
- Examining stateless authentication (JWT) in a mobile app
- A Frida crash course to get started with dynamic instrumentation for iOS applications
- Analyse the storage of an iOS app and understand the various options on how (Realm databases etc.) and where files can be stored.
- Testing methodology with a non-jailbroken (jailed) device by repackaging an IPA with the Frida gadget
- Using Frida to bypass runtime instrumentation of iOS applications
- Anti-Jailbreaking Mechanisms
- Frida's detection mechanism

We'll wrap up the final day with a CTF and participants can win a prize!

Whether you are a beginner who wants to learn mobile app testing from the ground up, or an experienced pentester or developer who wants to improve your existing skills to perform more advanced attack techniques, or just for fun, this training will help you achieve your goals.

The course consists of many different labs developed by the instructor and is approximately 65% hands-on and 35% lecture.

Upon successful completion of this course, students will have a better understanding of how to test for vulnerabilities in mobile applications, how to suggest the right mitigation techniques to developers, and how to perform tests consistently.

What students should bring

The following requirements must be met by students in order to be able to follow all exercises and participate fully:

- Laptop (Windows/Linux/macOS) with at least 8GB of RAM and 40GB of free disk space.
- Full administrative access in case of problems with the laptop environment (e.g. ability to disable VPN or AV/EDR)
- Virtualisation software (e.g. VMware, VirtualBox, UTM); a virtual machine will be provided for X86 and ARM architecture (for M1/M2/M3/M4 MacBooks) with all tools required for the training.
- Ideally a tablet to have a second screen for the practical lab slides when doing the hands-on sessions.

An iOS and Android device is NOT required as an emulated instance is provided for each student hosted at Corellium. This is a cloud-based environment that allows each student access to a jailbroken iOS device and a rooted Android device during the training.

What students will receive

- Slide deck and labs for the iOS and Android training as PDF and all videos for all demonstrations shared in class.
- All vulnerable apps used during the training, either as APK or IPA.
- Docker Containers with the APIs the apps were communicating with.
- Detailed write-ups for all labs so you can review them at your own pace after the course.
- Dedicated Slack channel used to help students prepare before the course, communicate during the course and stay in touch after the course for any questions.
- Printed hand-out of the Labs

What prerequisites should students have before attending this training?

- This course is for Beginners and Intermediate
- Basic understanding of mobile apps
- Able to use Linux command line



Speakers
avatar for Sven Schleier

Sven Schleier

Principal Security Consultant, Crayon
Sven is a Principal Security Consultant at Crayon, Austria and leads the professional services for cloud security. He also has extensive experience in offensive security engagements (penetration testing) and application security, specifically in guiding software development teams... Read More →
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Room 120
  3-Day Training

9:00am CEST

Global Board of Directors Private/Closed Face to Face Meeting
Tuesday May 27, 2025 9:00am - 5:00pm CEST
Tuesday May 27, 2025 9:00am - 5:00pm CEST
  Closed Meeting

10:30am CEST

AM Break
Tuesday May 27, 2025 10:30am - 11:00am CEST
Meals provided by OWASP
Tuesday May 27, 2025 10:30am - 11:00am CEST
  Meals provided by OWASP

12:30pm CEST

Lunch
Tuesday May 27, 2025 12:30pm - 1:30pm CEST
Meals provided by OWASP
Tuesday May 27, 2025 12:30pm - 1:30pm CEST
  Meals provided by OWASP

3:00pm CEST

PM Break
Tuesday May 27, 2025 3:00pm - 3:30pm CEST
Meals provided by OWASP
Tuesday May 27, 2025 3:00pm - 3:30pm CEST
  Meals provided by OWASP
 
Wednesday, May 28
 

8:15am CEST

Coffee/Tea
Wednesday May 28, 2025 8:15am - 9:00am CEST
-
Meals provided by OWASP. Come join us in the Expo Hall
Wednesday May 28, 2025 8:15am - 9:00am CEST
-
  Meals provided by OWASP

8:15am CEST

Registration
Wednesday May 28, 2025 8:15am - 6:00pm CEST
Wednesday May 28, 2025 8:15am - 6:00pm CEST

9:00am CEST

1-Day Training: Master AI security
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 129
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Learn AI security based on the latest greatest - straight from the forefront of AI security research and standardisation.

Last year in Lisbon, this training broke all the OWASP records with 50 attendees online and on-site.
Your trainer is Rob van der Veer, Chief AI Officer at Software Improvement Group, with 33 years of AI experience, founder of the OWASP AI Exchange, co-editor for the AI Act security standard, member of the ISO/IEC 27090 for AI security, co-founder of OpenCRE, and main author of ISO 5338 on AI engineering.

Some testimonials of previous masters of AI security:

Ahmed El Sheikh: “I highly recommend this training to anyone interested in advancing their understanding of the intersection between AI and security.”

Marco Sebscak: “The Master AI Security training is as valuable training that I would recommend to any Cybersecurity professional.”

This training is a unique opportunity to become proficient in the intricate and rapidly evolving field of AI security.
Soon, nearly every digital organisation will be deploying systems that incorporate AI. This presents a significant challenge, regardless of whether you are an AppSec specialist, a developer, or a red teamer. What are your responsibilities? What constitutes the new AI attack surface, and what threats emerge from it? What measures can you take to mitigate these emerging risks?

This one-day intensive training program will equip you with the knowledge to tackle these AI-related challenges effectively, enabling you to apply what you learn immediately. Starting with a pragmatic overview of AI, the course then delivers an exhaustive exploration of the distinctive vulnerabilities AI introduces, the possible attack vectors, and the most current strategies to counteract threats like prompt injection, data poisoning, model theft, evasion, and more. Through practical exercises, you will gain hands-on experience in enacting strong security measures, attacking AI systems, conducting threat modelling on AI, and targeted vulnerability assessments for AI applications.
By day's end, you will possess a thorough comprehension of the core principles and techniques critical to strengthening AI systems. You will have gained practical insights and the confidence to implement cutting-edge AI security measures.

A key resource that is used in the training is the OWASP AI Exchange, located at owaspai.org and the training has been enriched with the latest insights from the work being done for the official EU AI Act security standard.

The training is designed for all levels of attendees. as the material is new from the cutting edge of research and standardization. No in-depth security or AI knowledge is required, although some experience with either AI or security is helpful.

No recordings will be made.

Attendees will be provided with handout slides and afterwards with the unique Master AI security certificate.
Speakers
avatar for Rob van der Veer

Rob van der Veer

Chief AI Officer, Software Improvement Group
Rob van der Veer is an AI pioneer with 33 years of AI experience, specializing in engineering, security and privacy. He is the lead author of the ISO/IEC 5338 standard on AI lifecycle, contributor to OWASP SAMM, co-founder of OWASP's digital bridge for security standards OpenCRE... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 129
  1-Day Training

9:00am CEST

1-Day Training:How to build a Successful Security Champions Program
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 130
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Do you feel a disconnect between your cybersecurity efforts and engineering activities? If so, a Security Champions Program could bridge the gap. By involving engineers in security topics that align with their work, a Security Champions program not only enhances security awareness but also fosters a culture of security across your organization. However, creating such a program requires careful planning, innovative strategies, and a solid understanding of what drives individuals to champion security initiatives.

This training will equip you with practical tools and actionable insights to design and launch a successful Security Champions Program. You'll explore key concepts, including how to:
- Develop a foundational understanding of what a Security Champions Programs is
- Plan and navigate the phases of program development, from launch to long-term growth.
- Learn about strategies to engage and motivate diverse personality types within the organization
- Acquire practical tools and a structured approach to establish a scalable and trackable Security Champions Program

Whether you're a security engineer, architect, or manager, this training will provide you with the tools and frameworks to collaborate effectively with your engineering teams and establish a thriving Security Champions Program.

The session is highly interactive, featuring hands-on exercises and team-based activities to encourage collaboration and networking with fellow professionals. Join us to gain the confidence and strategies you need to kickstart your journey toward a more secure organization.
Speakers
MF

Marisa Fagan

Head of Product, Katilyst
avatar for Juliane Reimann

Juliane Reimann

Founder & Security Community Expert, Full Circle Security
Juliane Reimann works as cyber security consultant for large companies since 2019 with focus on DevSecOps and Community Building. Her expertise includes building security communities of software developers and establishing developer centric communication about secure software development... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 130
  1-Day Training

9:00am CEST

2-Day Training: Adam Shostack's Threat Modeling Intensive
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 121
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This hands-on, interactive class will focus on learning to threat model by executing each of the steps. Students will start with a guided threat modeling exercise, and we'll then iterate and break down the skills they're learning in more depth. We'll progressing through the Four Questions of Threat Modeling: what are we working on, what can go wrong, what are we going to do about it and did we do a good job. This is capped off with an end-to-end exercise that brings the skills together.
Speakers
avatar for Adam Shostack

Adam Shostack

Founder, Shostack & Associates
Adam Shostack is a leading expert on threat modeling. He has decades of experience delivering security. His experience ranges across the business world from founding startups to nearly a decade at Microsoft. His accomplishments include:  Helped create the CVE. Now an Emeritus member... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 121
  2-Day Training

9:00am CEST

2-Day Training: Application Security Training with Jim Manico
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 122
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Core Modules
00-00 Intro to App Security
00-01 Input Validation Basics
00-02 HTTP Security Basics
00-03 SOP and CORS
00-04 API and REST Security
00-05 Microservice Security
00-06 JSON Web Tokens
00-07 SQL and Other Injections
00-08 Cross-Site Request Forgery - CSRF Defenses for Various Architectures
00-09 File Upload and File I/O Security - Secure File Upload, File I/O Security
00-10 Deserialization Security - Safe Deserialization Practices
00-11 Artificial Intelligence Security - Securing AI Implementations, Full Course
00-12 Third-Party Library Security Management - Ensuring Third-Party Library Security
00-13 Introduction to Cloud Security - Basics of Cloud Security Management
00-14 Intro to iOS and Android Security - Mobile Security Fundamentals

Standards
01-00 OWASP Top Ten - Top Ten Web Security Risks
01-01 Intro to GDPR - European Data Privacy Law
01-02 OWASP ASVS - Comprehensive Secure Coding Standard
01-03 OWASP Top Ten Proactive Controls - Web Security Defense Categories
01-04 PCI Secure SDLC Standard - Credit Card SDLC Requirements

User Interface Security
02-00 XSS Defense - Client-Side Web Security
02-01 Content Security Policy - Advanced Client-Side Web Security
02-02 Content Spoofing and HTML Hacking - HTML Client-Side Injection Attacks
02-03 React Security - Secure React Application Development
02-04 Vue.js Security - Secure Vue.js Application Development
02-05 Angular and AngularJS Security - Secure Angular App Development
02-06 Clickjacking - UI Redress Attack Defense

Identity & Access Management
03-01 Authentication Best Practices - Web Authentication Practices
03-02 Session Management Best Practices - Web Session Management Practices
03-03 Multi-Factor Authentication - NIST SP-800-63 Compliant MFA Implementation
03-04 Secure Password Policy and Storage - Secure User Password Policy and Storage
03-05 Access Control Design - ABAC/Capabilities-Based Access Control
03-06 OAuth2 Security - OAuth2 Authorization Protocol
03-07 OpenID Connect Security - OpenID Connect Federation Protocol

Crypto Modules
04-00 Secrets Management - Key and Credential Storage Strategies
04-01 HTTPS/TLS Best Practices - Transport Security Introduction
04-02 Cryptography Fundamentals - Part 1 - Terminology, Steganography, Attacks, Kerchoff's Principle, PFC
04-03 Cryptography Fundamentals - Part 2 - Hash Functions, Symmetric Cryptography, Randomness, Digital Signatures

Process
05-00 DevOps Best Practices - DevOps and DevSecOps with a CD/CI Focus
05-01 Secure SDLC and AppSec Management - Managing Secure Software Processes

Additional Topics
06-00 User and Helpdesk Awareness Training - Security Awareness for Non-Technical Staff
06-01 Social Engineering for Developers - Developer Protection Against Social Engineering
06-02 App Layer Intrusion Detection - Detecting App Layer Attacks
06-03 Threat Modeling Fundamentals - Security Design via Threat Modeling
06-04 Forms and Workflows Security - Secure Handling of Complex Forms
06-05 Java 8/9/10/11/12/13+ Security Controls - Java Security Advances
06-06 Logging and Monitoring Security - Security-Focused Logging
06-07 Subdomain Takeover - Preventing Subdomain Takeover Scenarios
06-08 Laravel and PHP Security - Focus on PHP Security

Lab Options
07-00 Competitive Web Hacking LABS - Hands-on Web Hacking Labs
07-01 Competitive API Hacking LABS - Hands-on API Hacking Labs
07-02 Secure Coding Knowledge LABS - Hands-on Secure Coding Labs
Speakers
avatar for Jim Manico

Jim Manico

Founder, Manicode Security
Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. He is also an investor/advisor for 10Security, Aiya, MergeBase, Nucleus Security, KSOC, and Inspectiv. Jim is a frequent speaker on secure software practices... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 122
  2-Day Training

9:00am CEST

2-Day Training: AppSec Automation Masterclass
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 124
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This training takes a comprehensive, focused and practical approach at implementing DevSecOps Practices with a focus on Application Security Automation. The training is a glued-to-your-keyboard hands-on journey with labs that are backed by practical examples of DevSecOps and AppSec Automation.

The Training starts with a view of DevSecOps and AppSec Automation, specifically in terms of embedding security activities in multiple stages of the Software Development Lifecycle. Subsequently, the training delves into specific Application Security Automation approaches for SAST, SCA and Supply-Chain Security, DAST and Integration of these tools into CI/CD tools and Automation Pipelines.
Speakers
avatar for Abhay Bhargav

Abhay Bhargav

Founder of the Chief Research Officer of AppSecEngineer and we45, we45
Abhay Bhargav is the Founder of the Chief Research Officer of AppSecEngineer, an elite, hands-on online training platform and we45 a specialized AppSec Company. Abhay started his career as a breaker of apps, in pentesting and red-teaming, but today is more involved in scaling AppSec... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 124
  2-Day Training

9:00am CEST

2-Day Training: Building a High-Value App Scanning Programme (2025 Update)
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 123
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

You bought the application security tools, you have the findings, but now what? Many organisations find themselves drowning in "possible vulnerabilities", struggling to streamline their processes and not sure how to measure their progress.

If you are involved in using SAST, DAST or SCA tools in your organisation, these may be familiar feelings to you.

In this course, which is being refreshed and updated for 2025, you will learn how to address these problems and more (in a vendor-neutral way)

For 2025, we are putting a particular emphasis on practicality and activities which bring value with topics including the following:

• Customising the tools to focus on your needs
• Building tool processes which fit your business
• Automating workflows using CI/CD without slowing it down
• Showing the value and improvements you are making
• Finding ways to scale triage to cut down noise
• Focusing on fixing what matters in your situation
• Advantages and disadvantages of alternative forms of remediation
• Comparison of the different tool types covered and which you may want to use in different situations.
• The use of Vulnerability Aggregation and ASPMs

To bring the course to life and let you apply what you learn, you will work in teams on table-top exercises where you design processes to cover specific scenarios, explain and justify your decisions to simulated stakeholders and practice prioritising your remediation efforts.

For these exercises, you will work based on specially designed process templates (which we will provide) which you can use afterwards to apply these improvements within your own organisation.

Be ready to work in a group, take part in discussions and present your findings and leave the course with clear strategies and ideas on how to get less stress and more value from these tools.
Speakers
avatar for Josh Grossman

Josh Grossman

CTO, Bounce Security
Josh Grossman has worked as a consultant in IT and Application Security and Risk for 15 years now, as well as a Software Developer. This has given him an in-depth understanding of how to manage the balance between business needs, developer needs and security needs which goes into... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 123
  2-Day Training

9:00am CEST

2-Day Training: Hacking Modern Web Apps: Master the Future of Attack Vectors
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 127
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This course is a 100% hands-on deep dive into the OWASP Security Testing Guide and relevant items of the OWASP Application Security Verification Standard (ASVS), so this course covers and goes beyond the OWASP Top Ten.

Long are the days since web servers were run by perl scripts apps written in Delphi. What is common between Walmart, eBay, PayPal, Microsoft, LinkedIn, Google and Netflix? They all use Node.js: JavaScript on the server.

Modern Web apps share traditional attack vectors and also introduce new opportunities to threat actors. This course will teach you how to review modern web apps, showcasing Node.js but using techniques that will also work against any other web app platform. Ideal for Penetration Testers, Web app Developers as well as everybody interested in JavaScript/Node.js and Modern app stack security.

Get a FREE taste for this training, including access to video recording, slides and vulnerable apps to play with:
1 hour workshop - https://7asecurity.com/free-workshop-web-apps

All action, no fluff, improve your security analysis workflow and immediately apply these gained skills in your workplace, packed with exercises, extra mile challenges and CTF, self-paced and suitable for all skill levels, with continued education via unlimited email support, lifetime access, step-by-step video recordings and interesting apps to practice, including all future updates for free.
Speakers
avatar for Abraham Aranguren

Abraham Aranguren

CEO, 7aSecurity
After 17 years in itsec and 24 in IT Abraham is now the CEO of 7ASecurity (7asecurity.com), a company specializing in penetration testing of web/mobile apps, infrastructure, code reviews and training. Co-Author of the Mobile, Web and Desktop (Electron) app 7ASecurity courses. Security... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 127
  2-Day Training

9:00am CEST

2-Day Training: Practical Privacy by Design - Going Beyond Security in your SDLC
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 125
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Privacy is hot! This course will teach you this in-demand skillset and give you hands-on experience with privacy challenges, guiding you to combine Privacy by Design with your security practice.

Our lives are becoming more and more digitized, resulting in a lot of personal data floating around in the cloud. Now, many organizations are keen to use personal data for marketing, personalization or monetization, however, all this personal data comes with increased risk and surprising impact. Noone wants to find out that their daughter is pregnant from the department store ads…

Moreover, data protection legislation is forcing companies to integrate a technical approach for privacy into system design. With ever higher demands for privacy-respecting products, security teams have implicitly gained additional responsibilities and are hard pressed to keep up with these emerging requirements and often feel like there is a substantial and growing skills gap. Incorporating privacy into security with a proactive approach is essential to addressing this!

Traditional security approaches have historically not focused on this aspect of data protection, leaving individuals at risk. While common compliance and governance aspects of privacy are important, the technical aspects of privacy engineering are substantially more challenging - and that is the primary focus of this course.

This interactive technical course will teach you privacy analysis skills that are valuable to security teams. You can leverage your existing security skills with just a shift of mindset, since privacy largely shares the same foundation as security. We will teach you how common security techniques, such as architecture specification, threat modeling, and mitigation design, can be adapted for privacy. You will learn to capture how sensitive data flows through the system, and identify and mitigate high impact privacy issues in the software system. This will enable you to build privacy into the core of the product design and development process, while aligning it efficiently with security practices.

The course will cover these main topics:
- Privacy engineering essentials
- Privacy architecture & feature analysis
- Data inventory, mapping, and tagging
- Privacy threats (e.g. LINDDUN)
- Privacy controls, mitigations, and technologies
- Full privacy process

Each of these topics will be taught in an engaging, interactive format, with plenty of hands-on, collaborative exercises. We will teach you both the technical skills and social aspects essential for successful privacy engineering. This will include an assortment of relevant scenarios for each module, realistic simulations of popular upcoming features, diagramming tasks, and open debates. You will gain confidence using proven design techniques in order to improve the privacy posture of your system. In each module, you'll gain hands-on privacy experience through a set of exercises and class discussions.

We received rave reviews on our previous delivery of this course, for example:
- "If you're looking for a challenging, in-depth Privacy course which focuses on the technical aspects, look no further. Yes, it's only a 2-day course, but during that time, you'll take a deep dive into threat modelling, architecture, and other aspects required for ensuring Privacy is included in the SDLC."
Speakers
avatar for Dr. Kim Wuyts

Dr. Kim Wuyts

Manager Cyber & Privacy, PwC
Dr. Kim Wuyts is a leading privacy engineering expert with over 15 years of experience in security and privacy. Before joining PwC Belgium as Manager Cyber & Privacy, Kim was a senior researcher at KU Leuven where she led the development and extension of LINDDUN, a popular privacy... Read More →
avatar for Avi Douglen

Avi Douglen

Founder and CEO, Bounce Security
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 125
  2-Day Training

9:00am CEST

3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 119
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Download the complete training outline: AI Whiteboard Hacking Training Details

Testimonial: "After years evaluating security trainings at Black Hat, including Toreon's Whiteboard Hacking sessions, I can say this AI threat modeling course stands out. The hands-on approach and flow are exceptional - it's a must-attend."
- Daniel Cuthbert, Global Head of Cyber Security Research, Black Hat Review Board Member

In today's rapidly evolving AI landscape, security threats like prompt injection and data poisoning pose significant risks to AI systems. Our 3-day AI Whiteboard Hacking training equips you with practical skills to identify, assess, and mitigate AI-specific security threats using our proven DICE methodology. Through hands-on exercises and real-world scenarios, you'll learn to build secure AI systems while ensuring compliance with regulations like the EU AI Act.

The training concludes with an engaging red team/blue team wargame where you'll put theory into practice by attacking and defending a rogue AI research assistant. Upon completion, you'll earn the AI Threat Modeling Practitioner Certificate and gain access to a year-long subscription featuring quarterly masterclasses, expert Q&A sessions, and continuously updated resources.

Led by Sebastien Deleersnyder, co-founder and CTO of Toreon, and Black Hat trainer, this training combines technical expertise with practical insights gained from real-world projects across government, finance, healthcare, and technology sectors.

Quick Overview:
·       Target Audience: AI Engineers, Software Engineers, Solution Architects, Security Professionals
·       Prerequisites: Basic understanding of AI concepts (pre-training materials provided)
·       Certification: AI Threat Modeling Practitioner Certificate
·       Bonus: 1-year AI Threat Modeling Subscription included

Our lineup of the hands-on exercises from the training that let you put AI security concepts into practice:
Day 1: Foundations & Methodology
· "AI Security Headlines from the Future" - Explore potential security scenarios
· "Diagramming the AI Assistant Infrastructure" - Map out real AI system components
· "Identification of STRIDE-AI threats for UrbanFlow" - Apply threat modeling to urban systems
· "Autonomous Vehicle System Attack Tree Analysis" - Build attack scenarios

Day 2: Implementation & Defense
· "The Curious Chatbot Challenge (Injection)" - Hands-on prompt injection threats
· "Applying OWASP AI Exchange on a RAG-powered CareBot" - Real-world threat library application
· "AI Security Architecture Building Blocks Workshop" - Design secure AI systems
· "AI Risk Assessment: Autonomous Healthcare Robots" - Evaluate real-world AI risks

Day 3: Advanced Concepts & Practical Application
· "Ethics in Action - The FairCredit AI Incident" - Navigate ethical AI challenges
· "Data minimization and secure data handling for AI agents" - Implement privacy-by-design
· "Mapping attacks and controls in an MLOps pipeline" - Secure the AI development lifecycle
· "Project Prometheus: The Rogue AI Research Assistant" - Red Team/Blue Team wargame finale

Download the complete training outline: AI Whiteboard Hacking Training Details
Speakers
avatar for Sebastien Deleersnyder

Sebastien Deleersnyder

CTO, Toreon
Sebastien Deleersnyder, also known as Seba, is a highly accomplished individual in the field of cybersecurity. He is the CTO and co-founder of Toreon, as well as the COO and lead threat modeling trainer of Data Protection Institute. Seba holds a Master's degree in Software Engineering... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 119 CCIB
  3-Day Training

9:00am CEST

3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 118
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Modern IT systems are increasingly complex, making full-stack expertise more essential than ever. That's why diving into full-stack pentesting is crucial—you will gain the skills needed to master modern attack vectors and implement effective defensive countermeasures.

For each attack, vulnerability and technique presented in this training, there is a lab exercise to help you develop your skills step by step. What's more, when the training is over, you can take the complete lab environment home to hack again at your own pace.

I found security bugs in many companies including Google, Yahoo, Mozilla, Twitter and in this training I'll share my experience with you.

Key Learning Objectives
After completing this training, you will have learned about:

- Hacking cloud applications
- API hacking tips & tricks
- Data exfiltration techniques
- OSINT asset discovery tools
- Tricky user impersonation
- Bypassing protection mechanisms
- CLI hacking scripts
- Interesting XSS attacks
- Server-side template injection
- Hacking with Google & GitHub search engines
- Automated SQL injection detection and exploitation
- File read & file upload attacks
- Password cracking in a smart way
- Hacking Git repos
- XML attacks
- NoSQL injection
- HTTP parameter pollution
- Web cache deception attack
- Hacking with wrappers
- Finding metadata with sensitive information
- Hijacking NTLM hashes
- Automated detection of JavaScript libraries with known vulnerabilities
- Extracting passwords
- Hacking Electron applications
- Establishing reverse shell connections
- RCE attacks
- XSS polyglot
- and more …

What Students Will Receive
Students will be handed in a VMware image with a specially prepared lab environment to play with all attacks, vulnerabilities and techniques presented in this training. When the training is over, students can take the complete lab environment home (after signing a non-disclosure agreement) to hack again at their own pace.

Special Bonus
The ticket price includes FREE access to my 6 online courses:

- Fuzzing with Burp Suite Intruder
- Exploiting Race Conditions with OWASP ZAP
- Case Studies of Award-Winning XSS Attacks: Part 1
- Case Studies of Award-Winning XSS Attacks: Part 2
- How Hackers Find SQL Injections in Minutes with Sqlmap
- Web Application Security Testing with Google Hacking

What Students Say About My Trainings
References are attached to my LinkedIn profile (https://www.linkedin.com/in/dawid-czagan-85ba3666/). They can also be found here: https://silesiasecuritylab.com/services/training/#opinions – training participants from companies such as Oracle, Adobe, ESET, ING, …

What Students Should Know
To get the most of this training intermediate knowledge of web application security is needed. Students should have experience in using a proxy, such as Burp Suite Proxy or Zed Attack Proxy (ZAP), to analyze or modify the traffic.

What Students Should Bring
Students will need a laptop with 64-bit operating system, at least 8 GB RAM, 35 GB free hard drive space, administrative access, ability to turn off AV/firewall and VMware Player/Fusion installed (64-bit version). Prior to the training, make sure there are no problems with running x86_64 VMs.

Additional notes
This new 3-day training was sold out at top security conferences e.g. DEF CON 2024 (Las Vegas), Hack In Paris (Paris).

This is a 100% hands-on training: for each attack, vulnerability and technique presented in this training, there is a lab exercise to help students develop their skills step by step.
Speakers
avatar for Dawid Czagan

Dawid Czagan

Founder and CEO, Silesia Security Lab
Dawid Czagan is an internationally recognized security researcher and trainer. He is listed among top hackers at HackerOne. Dawid Czagan has found security bugs in Apple, Google, Mozilla, Microsoft and many others. Due to the severity of many bugs, he received numerous awards for... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 118 CCIB
  3-Day Training

9:00am CEST

3-Day Training: The Mobile Playbook - A guide for iOS and Android App Security
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 120
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

This three-day hands-on course, available in person or via remote access, teaches penetration testers, developers and engineers how to analyse Android and iOS applications for security vulnerabilities by going through the different phases of testing, including dynamic testing, static analysis, reverse engineering and Software Composition Analysis (SCA). The foundation for this will be the OWASP Mobile Application Security Testing Guide (MASTG). The OWASP MASTG is a comprehensive and open source mobile security testing book that covers both, iOS and Android and provides a methodology and very detailed technical test cases to ensure completeness and use the latest attack techniques against mobile applications. This course will give you hands-on experience with open source tools and advanced methodologies by guiding you through real-world scenarios.

Detailed outline

Day 1: We'll start the first day with an introduction to the OWASP MASVS and MASTG and the latest updates to it and then dive into the Android platform and its security architecture. Students will no longer be required to bring their own Android device, instead each student will be provided with a cloud-based virtualised Android device from Corellium.

Topics include:

- Intercepting network traffic from apps written in mobile app frameworks such as Google's Flutter
- Reverse engineering a Kotlin app and identifying and exploiting a real-world deep link vulnerability through manual source code review.
- Explore the differences and effectiveness of reverse engineering Android apps using Smali patching, Magisk and Dynamic Instrumentation with Frida
- Frida crash course to get started with dynamic instrumentation on Android apps
- Bypass different implementations of SSL pinning using Frida
- Use dynamic instrumentation with Frida to
- Bypass multiple root detection mechanisms
- Bypass Frida detection mechanisms
- Day 1 will be closed with a Capture the Flag (CTF)

On day 2 we start with applying our new skills to a real world app and wrap up the Android part and start with iOS. We will use a Github repo that will allow us to execute static scanning, SCA and secret scanning on Kotlin and Swift:

Android:

- Attacking a real world app and overcome it's protection mechanisms.
- Analyse the storage of an Android app and understand the various options on how and where files can be stored (app-specific, shared storage etc.)
- Using Brida (Frida and Burp) to bypass End2End encryption in an Android App
- Static Scanning of Kotlin source code, identifying vulnerabilities and eliminating false positives
- Scanning for secrets in an APK

iOS:

- Introduction into iOS Security fundamentals
- Scanning for secrets in a Swift repository and identifying ways to handle them securely.
- Software Composition Analysis (SCA) for iOS - Scanning 3rd party libraries and SDKs in mobile package managers for known vulnerabilities and mitigation strategies.
- Demonstration on how to test watchOS apps and it's limitations
- Statically scanning Swift source code, identifying vulnerabilities and eliminating false positives.

Day 3 focuses on iOS. We will begin the day by creating an iOS test environment using Corellium and dive into several topics, including:

- Intercepting network traffic of an iOS App in various scenarios, including intercepting traffic that is not HTTP
- Examining stateless authentication (JWT) in a mobile app
- A Frida crash course to get started with dynamic instrumentation for iOS applications
- Analyse the storage of an iOS app and understand the various options on how (Realm databases etc.) and where files can be stored.
- Testing methodology with a non-jailbroken (jailed) device by repackaging an IPA with the Frida gadget
- Using Frida to bypass runtime instrumentation of iOS applications
- Anti-Jailbreaking Mechanisms
- Frida's detection mechanism

We'll wrap up the final day with a CTF and participants can win a prize!

Whether you are a beginner who wants to learn mobile app testing from the ground up, or an experienced pentester or developer who wants to improve your existing skills to perform more advanced attack techniques, or just for fun, this training will help you achieve your goals.

The course consists of many different labs developed by the instructor and is approximately 65% hands-on and 35% lecture.

Upon successful completion of this course, students will have a better understanding of how to test for vulnerabilities in mobile applications, how to suggest the right mitigation techniques to developers, and how to perform tests consistently.

What students should bring

The following requirements must be met by students in order to be able to follow all exercises and participate fully:

- Laptop (Windows/Linux/macOS) with at least 8GB of RAM and 40GB of free disk space.
- Full administrative access in case of problems with the laptop environment (e.g. ability to disable VPN or AV/EDR)
- Virtualisation software (e.g. VMware, VirtualBox, UTM); a virtual machine will be provided for X86 and ARM architecture (for M1/M2/M3/M4 MacBooks) with all tools required for the training.
- Ideally a tablet to have a second screen for the practical lab slides when doing the hands-on sessions.

An iOS and Android device is NOT required as an emulated instance is provided for each student hosted at Corellium. This is a cloud-based environment that allows each student access to a jailbroken iOS device and a rooted Android device during the training.

What students will receive

- Slide deck and labs for the iOS and Android training as PDF and all videos for all demonstrations shared in class.
- All vulnerable apps used during the training, either as APK or IPA.
- Docker Containers with the APIs the apps were communicating with.
- Detailed write-ups for all labs so you can review them at your own pace after the course.
- Dedicated Slack channel used to help students prepare before the course, communicate during the course and stay in touch after the course for any questions.
- Printed hand-out of the Labs

What prerequisites should students have before attending this training?

- This course is for Beginners and Intermediate
- Basic understanding of mobile apps
- Able to use Linux command line



Speakers
avatar for Sven Schleier

Sven Schleier

Principal Security Consultant, Crayon
Sven is a Principal Security Consultant at Crayon, Austria and leads the professional services for cloud security. He also has extensive experience in offensive security engagements (penetration testing) and application security, specifically in guiding software development teams... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room 120
  3-Day Training

9:00am CEST

Global Board of Directors Private/Closed Face to Face Meeting
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Wednesday May 28, 2025 9:00am - 5:00pm CEST
  Closed Meeting

9:00am CEST

SAMM User Day
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room M211-212
To register, please purchase your training ticket here. Training and conference are two separate ticket purchases.

Join us May 28th for  the OWASP SAMM User Day, where we'll shed light on its essence, the benchmark, and our future roadmap of OWASP SAMM. There will be lots of room for discussions  and we organize SAMM round tables. More details on  https://owaspsamm.org/user-day/
Speakers
avatar for Sebastien Deleersnyder

Sebastien Deleersnyder

CTO, Toreon
Sebastien Deleersnyder, also known as Seba, is a highly accomplished individual in the field of cybersecurity. He is the CTO and co-founder of Toreon, as well as the COO and lead threat modeling trainer of Data Protection Institute. Seba holds a Master's degree in Software Engineering... Read More →
Wednesday May 28, 2025 9:00am - 5:00pm CEST
Room M211-212
  User Day

9:00am CEST

OWASP CycloneDX Hackathon with Transparency Exchange API
Wednesday May 28, 2025 9:00am - 6:00pm CEST
Room M215 - M216
Sponsored by ECMA
Wednesday May 28, 2025 9:00am - 6:00pm CEST
Room M215 - M216
  Hackathon

9:00am CEST

Open WAF Day | CRS & ModSecurity & Coraza
Wednesday May 28, 2025 9:00am - 6:00pm CEST
Room M213-M214
We’re excited to invite you to the Open WAF Day in Barcelona, a unique event dedicated to Web Application Firewalls and cutting-edge open-source security projects. Whether you're a cybersecurity professional, developer, or simply passionate about web security, this is an opportunity to dive deep into OWASP Core Rule Set (CRS), OWASP Coraza, and OWASP ModSecurity with experts and fellow enthusiasts.
📅 Date: May 28th
📍 Location:  CCIB
 ⏰ Time: 09:00 - 18:00
Expect engaging talks, live demos, and networking with industry leaders. We also welcome sponsors looking to connect with the security community and showcase their contributions.
🔹 Why Attend?
✔ Learn best practices and new developments in WAF security
✔ Meet and collaborate with key contributors to OWASP projects
 ✔ Gain insights into practical implementations and real-world use cases
👉 Reserve Your Spot Now: https://docs.google.com/forms/d/1eRsWPiCD1r6GjG8UH7xwfcxvkZx3BniUTXWrViTJ1V8/edit
For sponsorship opportunities or questions, feel free to reach out at open-waf-day@coreruleset.org.

Wednesday May 28, 2025 9:00am - 6:00pm CEST
Room M213-M214
  User Day

10:30am CEST

AM Break
Wednesday May 28, 2025 10:30am - 11:00am CEST
Meals provided by OWASP
Wednesday May 28, 2025 10:30am - 11:00am CEST
  Meals provided by OWASP

12:30pm CEST

Lunch
Wednesday May 28, 2025 12:30pm - 1:30pm CEST
Meals provided by OWASP
Wednesday May 28, 2025 12:30pm - 1:30pm CEST
  Meals provided by OWASP

3:00pm CEST

PM Break
Wednesday May 28, 2025 3:00pm - 3:30pm CEST
Meals provided by OWASP
Wednesday May 28, 2025 3:00pm - 3:30pm CEST
  Meals provided by OWASP

5:30pm CEST

Global Board of Directors Public Board Meeting
Wednesday May 28, 2025 5:30pm - 7:30pm CEST
Room 127
Come have a drink with the board! Open meeting to all who would like to attend and discuss topics that are pertinent to the OWASP Foundation
Wednesday May 28, 2025 5:30pm - 7:30pm CEST
Room 127
  Meeting

7:30pm CEST

Women in AppSec Reception (registration required)
Wednesday May 28, 2025 7:30pm - 8:30pm CEST
Room 212
*Separate ticket purchase required. Purchase your tickets here.

Come build your community and network with other Women in AppSec!
Wednesday May 28, 2025 7:30pm - 8:30pm CEST
Room 212
 
Thursday, May 29
 

8:15am CEST

Coffee/Tea
Thursday May 29, 2025 8:15am - 8:45am CEST
Area 1
Thursday May 29, 2025 8:15am - 8:45am CEST
Area 1
  Meals provided by OWASP

8:15am CEST

Registration
Thursday May 29, 2025 8:15am - 6:00pm CEST
Thursday May 29, 2025 8:15am - 6:00pm CEST

8:30am CEST

Speaker Ready Room
Thursday May 29, 2025 8:30am - 5:00pm CEST
Room 119
Open to all of our Global AppSec Speakers to prepare for their presentation.
Thursday May 29, 2025 8:30am - 5:00pm CEST
Room 119 CCIB
  Speakers Only

9:00am CEST

Keynote:Nemo Resideo: Managing application security through rapid change
Thursday May 29, 2025 9:00am - 10:00am CEST
Room 116+117
In today's fast-paced technology landscape, the mantra "Nemo resideo" – "Leave no one behind" – takes on a critical new meaning.   As organizations race to deliver software faster than ever, engineering teams often face immense pressure to prioritize speed over security. In fact, the 2024 CrowdStrike State of Application Security Report found that 60% of security professionals still struggle with prioritizing application vulnerabilities.

This keynote, "Nemo resideo: Managing application security through rapid change," will delve into the strategies and best practices that can help businesses maintain robust application security without compromising on delivery timelines.
Speakers
avatar for Sarah-Jane Madden

Sarah-Jane Madden

Director of Cyber Defense, Fortive
Sarah-Jane, the Director of Cyber Defense at Fortive, brings over 25 years of experience in the technology industry. With a robust background in technical operations and software engineering, she has held roles ranging from developer to CISO. Sarah-Jane is a passionate advocate for... Read More →
Thursday May 29, 2025 9:00am - 10:00am CEST
Room 116+117 CCIB
  Keynote

9:00am CEST

OWASP Member Lounge
Thursday May 29, 2025 9:00am - 5:00pm CEST
Room 111
Come one OWASP member, come all!  This room is open to all OWASP members and offers networking tables, working stations, and a gaming area!
Thursday May 29, 2025 9:00am - 5:00pm CEST
Room 111
  BONUS TRACK

10:00am CEST

AM Break with Exhibitors
Thursday May 29, 2025 10:00am - 10:30am CEST
Area 1
Meals provided by OWASP
Thursday May 29, 2025 10:00am - 10:30am CEST
Area 1
  Meals provided by OWASP

10:30am CEST

OWASP LCNC Securing the Future: AI Meets Low-Code, the New Security Frontier!
Thursday May 29, 2025 10:30am - 11:00am CEST
Room 131-132
Low-code and no-code (LCNC) development has transformed the way organizations build applications, enabling business users—often with little security expertise—to create powerful workflows, automations, and even AI-driven solutions. As these platforms increasingly integrate AI-powered copilots and automation tools, their adoption is skyrocketing, but so are security risks that traditional AppSec frameworks fail to address.

Recognizing this urgent gap, we established the OWASP Low-Code/No-Code Security Top 10 project to clarify the unique risks in these environments. In this session, we will share our journey—how we classified the Top 10 security risks in LCNC, what we have accomplished since the project’s inception, and how AI-driven low-code development introduces new attack vectors that security teams must prepare for.

Attendees will gain insights into:

* How LCNC security challenges have evolved, especially with the rise of AI-powered platforms.
* The OWASP Low-Code/No-Code Security Top 10, providing a much-needed framework for both citizen developers and security professionals.
* Real-world exploit scenarios, from insecure workflows and data exposure to AI-powered automation risks.
* The current state of low-code security and AI governance, key findings from our research, and what’s next for securing this fast-growing space.

As AI and low-code become inseparable in modern development, security teams must adapt quickly to prevent misuse, misconfigurations, and data exposure. This session is ideal for AppSec professionals, developers, security leaders, and platform owners looking to secure LCNC applications while enabling innovation.

Join us to explore the evolving threat landscape and gain actionable strategies to safeguard the next wave of AI-driven enterprise applications.
Speakers
avatar for Ziv Hagbi

Ziv Hagbi

Director of Product Management, Zenity
Ziv Daniel Hagbi, is a seasoned Security Expert with deep expertise in Low-Code/No-Code Security and AI-driven business development. As the co-leader of the OWASP Low-Code/No-Code Security Top 10 project, Ziv is dedicated to raising awareness and addressing the unique security risks... Read More →
Thursday May 29, 2025 10:30am - 11:00am CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

10:30am CEST

CfP/CfTs for the Newcomer: How To Write A Good Submission
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 118
Ready to showcase your expertise? Don’t miss the chance to submit for a Call for Trainers or Call for Papers! Join the dynamic Izar Tarandach and Avi Douglen as they take you through the submission process and reveal insider tips on what the review team is looking for when selecting papers. This is your opportunity to shine and make a lasting impact—let’s make it happen!
Speakers
avatar for Izar Tarandach

Izar Tarandach

Sr. Staff Engineer, Datadog
Izar Tarandach is a Sr. Staff Engineer at Datadog, formerly the Principal Security Architect at Squarespace. Before this, he was a Sr. Security Architect at a leading financial institution, Lead Product Security Architect at Autodesk, Inc., Security Architect for Enterprise Hybrid... Read More →
avatar for Avi Douglen

Avi Douglen

Founder and CEO, Bounce Security
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 118 CCIB
  BONUS TRACK

10:30am CEST

Leveraging AI for Secure React Development with Effective Prompt Engineering
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 113
Practical and usable advice on how to harness the power of AI to create secure React applications by using prompt engineering best practices. We will discuss practical methods for guiding AI models to produce safe, high-quality React code that reduces common vulnerabilities, such as cross-site scripting (XSS) and injection flaws.

Attendees will learn foundational techniques for crafting precise prompts, incorporating secure coding patterns, and validating AI-generated outputs.

By the end of this session, you will be equipped with actionable steps to integrate AI-driven development into your workflow and strengthen the overall security of your React and other software projects.
Speakers
avatar for Jim Manico

Jim Manico

Founder, Manicode Security
Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. He is also an investor/advisor for 10Security, Aiya, MergeBase, Nucleus Security, KSOC, and Inspectiv. Jim is a frequent speaker on secure software practices... Read More →
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 113
  Breakout: Builder Track

10:30am CEST

The Edge Strikes Back: Challenging OWASP's Take on Edge-Level Authorization
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 116+117
The OWASP Microservice Cheat Sheet makes a bold statement about the limitations of edge-level authorization architectures - implying that they cannot handle the complexities of modern microservices. But what if that’s no longer true?

Enter heimdall, an identity-aware proxy that redefines edge-level authentication and authorization. By integrating fine-grained access control with modern Zero Trust principles, heimdall overcomes the supposed weaknesses, providing scalability, flexibility, and performance without sacrificing security and team agility.

In this talk, I will challenge the OWASP Cheat Sheet’s view and demonstrate how heimdall addresses its concerns head-on. You’ll learn how edge-level authorization can scale to meet the demands of large, distributed systems while maintaining granular control over access. Through real-world examples and architecture insights, we’ll explore why the edge-level might just be the most effective place for secure access control.

Join me to see how heimdall blows away the perceived limitations of edge-level authorization and why it’s time to rethink this critical piece of microservice security.
Speakers
avatar for Dimitrij Drus

Dimitrij Drus

Senior Consultant, INNOQ Germany GmbH
I work as a Senior Consultant at INNOQ Germany GmbH, focusing on security architecture and the design of secure distributed systems. With a strong passion for security, I regularly lead training sessions to help others address modern (web) security challenges. de.linkedin.com/in... Read More →
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 116+117 CCIB
  Breakout: Builder Track

10:30am CEST

False Positives, Begone! Harnessing AI for Efficient SAST Triage
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 114
False positives are one of the biggest pain points in running a Static Application Security Testing (SAST) program. While SAST tools are valuable for identifying security issues in a codebase—flagging critical vulnerabilities like Remote Code Execution and SQL Injection—they often generate significant noise due to their lack of contextual awareness. SAST testing is relatively easy to set up, requires no accounts or credentials, and can uncover issues in multi-step processes that would be difficult to detect with dynamic security testing. However, the high volume of false positives leads to alert fatigue and demands considerable effort to triage, making it challenging to identify the relatively small number of true vulnerabilities.

This research addresses that challenge by combining Program Analysis with Large Language Models (LLMs) to simulate the manual triage process for SAST findings. Our approach leverages a carefully designed LLM agent that enhances context around vulnerable code, identifies conditions that make exploitation infeasible, and determines whether a clear execution path exists from a user-controlled input to the vulnerable line flagged by SAST.

We will demonstrate this novel approach in action, showcasing how it can be integrated with any SAST tooling to streamline triage. By reducing false positives and prioritizing actionable findings, this method allows security engineers and developers to focus on the vulnerabilities that truly matter.
Speakers
avatar for Elliot Ward

Elliot Ward

Staff Security Researcher, Snyk Security Labs
Elliot is a Staff security researcher at software security company Snyk. He has a background in software engineering and application security. securitylabs.snyk.io (blog)securitylabs.snyk.io (company... Read More →
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 114
  Breakout: Defender Track

10:30am CEST

Human Buffer Overflow: How to Deal with Cognitive Load in High-Performing Teams
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 115
High performing teams are a treasure for every organization. But what if cognitive load gets too high and creates a buffer overflow in a team’s working memory? Security adds an additional layer of complexity to the work of development teams and endangers their quality of work and solution finding capabilities as a team. We will show actionable remediation strategies like a Security Champions Program, automation for security scans and secure scrum with a real-life example.
Speakers
avatar for Juliane Reimann

Juliane Reimann

Founder & Security Community Expert, Full Circle Security
Juliane Reimann works as cyber security consultant for large companies since 2019 with focus on DevSecOps and Community Building. Her expertise includes building security communities of software developers and establishing developer centric communication about secure software development... Read More →
Thursday May 29, 2025 10:30am - 11:15am CEST
Room 115
  Breakout: Manager/Culture Track

10:45am CEST

OWASP Certified Secure Developer Open Call
Thursday May 29, 2025 10:45am - 11:45am CEST
Room 133-134
Join Us in Shaping the Future of Secure Software Development

The OWASP Education and Training Committee is developing a certification program designed specifically for developers—and we need your expertise.

For the first time, this initiative will be showcased at OWASP Global AppSec EU 2025, and we’re inviting the community to help build the body of knowledge that will form the foundation of the certification curriculum.

If you're passionate about secure coding and developer education, this is your chance to contribute meaningfully to a global effort. Let’s build something that lasts—together.
Speakers
avatar for Shruti Kulkarni

Shruti Kulkarni

Information Security Architect, 6point6
Shruti is an information security / enterprise security architect with experience in ISO27001, PCI-DSS, policies, standards, security tools, threat modelling, risk assessments. Shruti works on security strategies and collaborates with cross-functional groups to implement information... Read More →
Thursday May 29, 2025 10:45am - 11:45am CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Call for Contributors

10:45am CEST

OWASP Web Application Honeypot Project - Creating Comprehensive Threat Intelligence Dataset
Thursday May 29, 2025 10:45am - 11:45pm CEST
Room 133-134
The OWASP Web Honeypot Project is an open-source (Proof of Concept PoC) initiative designed to deploy deceptive security mechanisms that lure, detect, and analyze cyber threats targeting web applications. It aims to provide security professionals with actionable intelligence on attack patterns, tools, and techniques used by adversaries.

The goal of the project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. Within this project, we are leading the collection, storage and analysis of threat intelligence data.

The purpose of this part of the project is to capture intelligence on attacker activity against web applications and utilise this intelligence as ways to protect software against attacks. Honeypots are an established industry technique to provide a realistic target to entice a criminal, whilst encouraging them to divulge the tools and techniques they use during an attack. Like bees to a honeypot. These honeypots are safely designed to contain no information of monetary use to an attacker, and hence provide no risk to the businesses implementing them.

Originally the honeypots were VM, Docker or small computing profile based like Raspberry Pi, employed ModSecurity based Web Application Firewall (WAF) technology using OWASP’s Core Rule Set (CRS) pushing intelligence data back to a console to be converted to STIX/TAXII format for threat intelligence or pushed into ELK for visualisation.

Further enhancement and research-based work has been undertaken this year to enhance the container based approach (Docker) to introduce key features which include 

• Capability of dynamically switching web server profiles to mimic popular platforms like WordPress and Drupal for example.

• Utilise an alternative approach to using mlogc log output pushed into Logstash/ELK for visualisation and threat intelligence formats with MiSP via JSON format.

• Creation of a publicly available dataset within an AWS S3 bucket of JSON to store web threat intelligence in. a searchable JSON format feed, allowing the use of tools like JSON Crack for pattern recognition.

The intention is to be able to deploy these enhanced honeypots within key locations in the Internet community can distribute within their own networks. With enough honeypots globally distributed, we will be in a position to aggregate attack techniques to better understand and protect against the techniques used by attackers. With this information, we will be in a position to create educational information, such as rules and strategies, that application writers can use to ensure that any detected bugs and vulnerabilities are closed.
Overall having an open rich standard format-based quality dataset with real threat intelligence-based information based on the lure for scanning detected “fake” vulnerabilities by industry standard tools (which can easily be dynamically changed or updated) available to the global security community, allows for better web application security and to be able predict evolving cyber threats.
Speakers
avatar for Kartik Adak

Kartik Adak

Cyber Security Graduate, University of Warwick
Kartik Adak is an experienced cybersecurity professional with over three years of expertise in information security, incident response, and penetration testing. Having obtained a Master’s in Cyber Security Management from the University of Warwick, he specializes in penetration... Read More →
avatar for Mukunthan Nagarajan

Mukunthan Nagarajan

Cyber Security Graduate, University of Warwick
As a cybersecurity master's student at Warwick, I am passionate about learning and applying the latest techniques and tools to protect and secure information systems and networks. I have a strong background in information technology, with a bachelor's degree in computer applications... Read More →
avatar for Adrian Winckles

Adrian Winckles

Cyber Security Academic, Security Researcher, Anglia Ruskin University
Adrian Winckles is an independent Cyber Security Academic, Security Researcher and IT Professional with over 32 years of experience in developing and implementing cyber security strategies and robust, resilient IT infrastructure solutions. A proven leader in driving digital transformation... Read More →
Thursday May 29, 2025 10:45am - 11:45pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

11:00am CEST

OWASP ModSecurity in Motion: Evolving the Open Source WAF
Thursday May 29, 2025 11:00am - 11:30am CEST
Room 131-132
OWASP ModSecurity has long served as a foundational engine for web application firewalls, quietly defending thousands of applications in production environments worldwide.

This talk offers a technical and practical overview of where ModSecurity stands today. We'll cover the major updates and architectural improvements introduced over the past two years, including performance optimizations, expanded language bindings, improved logging and debugging tools, and better containerization support.

We’ll also address the community’s role in ModSecurity's ongoing maintenance and what the current roadmap looks like for key integrations and use cases—from NGINX and Apache to reverse proxies and API gateways.

Whether you're a seasoned user, a contributor, or just exploring WAFs for the first time, this session will help you better understand ModSecurity’s role in the modern security stack—and how to leverage its most recent improvements to meet the demands of today’s web.

What You’ll Learn:
  • A recap of ModSecurity’s core capabilities and architecture
  • Key improvements made since 2023, including performance and compatibility upgrades
  • New tooling and deployment patterns
  • Current challenges and open areas for contribution
  • How ModSecurity is being used today
Speakers
avatar for Ervin Hegedus

Ervin Hegedus

Project Co-Lead, OWASP ModSecurity
Ervin Hegedus is a system and software engineer. His open source contributions include ModSecurity since 2017, Coreruleset developer since 2019, OWASP member since 2021 and Ervin became the ModSecurity project co-lead in 2024.
Thursday May 29, 2025 11:00am - 11:30am CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

11:00am CEST

OWASP Juice Shop Demo: Your vitamin shot for security awareness & education
Thursday May 29, 2025 11:00am - 11:45am CEST
Room 133-134
In this 100% slide-free demo session you will embark on a journey through the popular OWASP Juice Shop vulnerable web application!

You will experience firsthand how easy it is to set up, get started, and solve your first hacking & coding challenges. In a quick mob-hacking session, you will gain your first points on Juice Shop's extensive score board!

The demo also includes a glimpse into Juice Shop's CTF tool and its multi-user hosting environment MultiJuicer! You will witness how fast a CTF event can be launched with OWASP Juice Shop, how great documentation really makes a difference, and even how to make
the application look like an in-house app of your own company.

Due to the nature of this small group demo session, you are welcome to ask questions during and between the different topics - ad libitum! There is time for clarification and dipping into special topics.

If time permits, this session can also cover interesting behind-the-scenes topics, such as cheat detection, start-up validations, webhook integrations, and a pro-level Grafana dashboard for observability!

Even if you know and have used OWASP Juice Shop yourself already, there's no chance you've already seen everything that will be covered in this session!
Speakers
avatar for Björn Kimminich

Björn Kimminich

Product Group Lead, Kuehne+Nagel
Bjoern Kimminich works as Product Group Lead Application Ecosystem at Kuehne + Nagel, responsible – among other things – for the Application Security program in the corporate IT. He is an OWASP Lifetime Member, the project leader of the OWASP Juice Shop, and a co-chapter leader... Read More →
Thursday May 29, 2025 11:00am - 11:45am CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

11:00am CEST

OWASP KubeFIM Securing Kubernetes from the Inside Out: File Integrity Monitoring with eBPF
Thursday May 29, 2025 11:00am - 11:45am CEST
Room 133-134
OWASP KubeFIM
Securing Kubernetes from the Inside Out: File Integrity Monitoring with eBPF

1. Introduction to Kubernetes Security & File Integrity Monitoring - The growing security challenges in Kubernetes.
- Why malicious containers inside clusters pose a huge risk.
- Real-world security incidents where attackers modified critical files (e.g., cryptojacking, rootkits).
- Why do traditional security tools fail in Kubernetes? (e.g., host-based FIM doesn’t work well).

2. What is OWASP KubeFIM & Why It Matters? - Overview of OWASP KubeFIM as an eBPF-based File Integrity Monitoring (FIM) solution.
- How eBPF helps detect file changes inside Kubernetes clusters without performance overhead.
- Use cases: Detecting malware, unauthorized file modifications, rootkit infections.

3. How OWASP KubeFIM WorksThe key components of KubeFIM:
- Kernel-level hooks
- Alerting system
- Policy-based file integrity monitoring

4. Setting Up KubeFIM in Your Cluster - Quick installation guide using Helm & Kubernetes YAML manifests.
- Configuring policies to monitor specific files (e.g., /bin, /etc, /var)
- Live demo of KubeFIM detecting unauthorized file changes.

5. Q&A + Discussion
Speakers
avatar for Abhijit Chatterjee

Abhijit Chatterjee

Co-Founder, Cyber Secure India
Abhijit is the Co-Founder of Cyber Secure India (CSI), a cybersecurity think tank focused on driving cybersecurity awareness, building a strong community through free education, sharing knowledge, and empowering young individuals to strengthen the digital infrastructure.
Thursday May 29, 2025 11:00am - 11:45am CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

11:30am CEST

OWASP Threat Library
Thursday May 29, 2025 11:30am - 12:00pm CEST
Room 131-132
Threat modeling is a cornerstone of cybersecurity, yet it remains manual, complex, and inaccessible to many teams. While AI-powered threat modeling holds immense promise, it faces challenges such as hallucinations, lack of structured outputs, low accuracy, and limited trustworthiness.

The critical gap lies in the availability of specialized datasets. We aim to enhance LLMs’ ability to identify threats and recommend effective controls by generating open-source curated datasets of real-world threat models with the OWASP Threat Library. This session explores the transformative potential of crowdsourced data to fine-tune LLMs, driving a significant leap forward for the cybersecurity community and industry - all under the wings of an OWASP Project.
Speakers
avatar for Petra Vukmirovic

Petra Vukmirovic

Head of Information Security / Fractional Head of Product, Numan / Devarmor
Petra is a technology enthusiast, leader and public speaker. A former emergency medicine doctor and competitive volleyball athlete, she thrives in challenging environments and loves creating order from chaos. Initially pursuing a medical career, Petra's passion for technology led... Read More →
Thursday May 29, 2025 11:30am - 12:00pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

11:30am CEST

Hacking Your Enterprise Copilot: A Direct Guide to Indirect Prompt Injections
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 113
Enterprise copilots, from Microsoft Copilot to Salesforce’s Einstein, are adopted by every major enterprise. Grounded into your personal enterprise data they offer major productivity gains. But what happens when they get compromised? And how exactly can that happen?

In this talk we will see how we can turn these trusted enterprise AI assistants into our own malicious insiders within the victim organization. Spreading misinformation, tricking innocent employees into making fatal mistakes, routing users to our phishing sites, and even directly exfiltrating sensitive data!

We’ll go through the process of building these attack techniques from scratch, presenting a mental framework for how to hack any enterprise copilot, no prior experience needed. Starting from system prompt extraction techniques to crafting reliable and robust indirect prompt injections (IPIs) using our extracted system prompt. Showing a step by step process of how we arrived at each of the results we’ve mentioned above, and how you can replicate them to any enterprise copilot of your choosing.

To demonstrate the efficacy of our methods, we will use Microsoft Copilot as our guinea pig for the session, seeing how our newly found techniques manage to circumvent Microsoft’s responsible AI security layer.

Join us to explore the unique attack surface of enterprise copilots, and learn how to harden your own enterprise copilot to protect against the vulnerabilities we were able to discover.
Speakers
avatar for Tamir Ishay Sharbat

Tamir Ishay Sharbat

Software Engineer and Security Researcher, Zenity
Tamir Ishay Sharbat is a software engineer and security researcher with a particular passion for AI security. His current focus is on identifying vulnerabilities in enterprise AI products such as Microsoft Copilot, Microsoft Copilot Studio, Salesforce Einstein, Google Gemini and more... Read More →
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 113
  Breakout: Breaker Track

11:30am CEST

Securing cross-platform mobile applications
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 116+117
Mobile applications are often developed in a cross-platform framework such as Flutter, React Native or Maui. These frameworks allow developers to design and implement the application once and then deploy to both Android and iOS.

While these frameworks save time during the development cycle, they pose unique challenges when securing them. In this talk, I will show you how mobile application security is a shared responsibility between the developer, the cross-platform framework and the native OS on which the application is running. Security needs to be addressed during the entire SDLC, so we will examine the impact on SAST, DAST and even manual penetration testing.
Speakers
avatar for Jeroen Beckers

Jeroen Beckers

Mobile Solution Lead, NVISO
I am the mobile solution lead at NVISO, where I am responsible for quality delivery, innovation and methodology for all mobile assessments. I am actively involved in the mobile security community, and I try to share my knowledge through open-source tools, blogposts, trainings and... Read More →
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

11:30am CEST

Emerging Frontiers: Ransomware Attacks in AI Systems
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 114
This session will delve into the convergence of ransomware and Artificial Intelligence/Machine Learning (AI/ML) systems, providing attendees with a comprehensive understanding of the evolving ransomware landscape in AI environments. The presentation will cover:

The progression of ransomware from traditional attacks to AI-driven variants.
Vulnerabilities in AI/ML systems, such as supply chains, models, and training pipelines, that adversaries can exploit for ransomware attacks.
Real-world examples of potential ransomware exploits in predictive AI (e.g., OWASP ML06: 2023 ML Supply Chain Attacks) and generative AI (e.g., OWASP LLM06: Excessive Agency).
Practical strategies and AI-driven solutions to detect, protect against, and mitigate ransomware threats.

Attendees will gain actionable insights into adapting traditional ransomware defenses to safeguard modern AI infrastructures and explore open challenges in standardizing defenses for AI/ML systems. The session will also provide references to OWASP frameworks and insights from the OWASP AI Exchange.
Speakers
avatar for Behnaz Karimi

Behnaz Karimi

Senior Cyber Security Analyst, Accenture
Behnaz Karimi is a Senior Cyber Security Analyst at Accenture and a Co-Author and Co-Lead of OWASP AI Exchange, where she also serves as the Lead for AI Red Teaming. She has actively contributed to OWASP initiatives, including participating in the development of the GenAI Red Teaming... Read More →
avatar for Yuvaraj Govindarajulu

Yuvaraj Govindarajulu

Head of Research, AIShield (Powered by Bosch)
Yuvaraj Govindarajulu is a dynamic technical leader with over a decade of experience in AI, Cybersecurity and Embedded Systems R&D. He is the Head of Research at AIShield, a startup of Bosch with a mission to secure AI systems of the world, from development to deployment. His key... Read More →
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 114
  Breakout: Defender Track

11:30am CEST

Your Security Dashboard Is Lying to You: The Science of Metrics
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 115
Security teams love metrics - dashboards filled with vulnerability counts, alert volumes, and training hours logged. But do any of these actually make organizations more secure? The uncomfortable truth is that most security metrics are just vanity numbers—impressive in reports but meaningless in practice.

In this talk, I will focus on the science behind meaningful security metrics—the ones that actually reduce risk instead of just filling reports. I will introduce a framework that helps define metrics based on real security goals, rather than setting goals around whatever data happens to be available. From there, I will break down what constitutes a good metric, examining its structure and the common pitfalls that undermine its validity.

If your security strategy is built on unreliable metrics, it’s time for a reality check. This talk challenges industry assumptions and provides scientific backing to the fact that many widely used security metrics in the industry only weakly correlate with actual risk.
Speakers
avatar for Aram Hovsepyan

Aram Hovsepyan

CEO, Codific
Aram is the founder and the CEO of Codific. With over 15 years of application security experience, he has a proven track record in building complex software systems by explicitly focusing on quality.Aram has a PhD in cybersecurity from DistriNet KU Leuven. His contributions to the... Read More →
Thursday May 29, 2025 11:30am - 12:15pm CEST
Room 115
  Breakout: Manager/Culture Track

1:15pm CEST

Introducing Sunshine, the all new SBOM visualization tool by OWASP CycloneDX
Thursday May 29, 2025 1:15pm - 1:30pm CEST
Room 131-132
Introducing Sunshine, a first-of-its-kind visualization tool for CycloneDX files that can facilitate the adoption of CycloneDX by making SBOMs easily readable and more understandable by a broader audience.

Agenda

1. INTRODUCTION:
1.1 What is an SBOM and why it’s important
1.2 What is the OWASP CycloneDX project
1.3 Brief introduction to the CycloneDX JSON/XML format
1.4 The missing piece: an actionable visualization tool for CycloneDX files

2. OWASP CYCLONEDX SUNSHINE: MAIN BENEFITS AND MAIN FEATURES
2.1 Main benefits: visualize a CycloneDX file in an interactive and human-friendly way
2.2 Main feature #1: sunburst chart with dependencies, licenses and vulnerabilities (with live demo)
2.3 Main feature #2: table with dependencies, licenses and vulnerabilities (with live demo)

3. OWASP CYCLONEDX SUNSHINE: ADVANCED FEATURES
3.1 Advanced feature #1: chart refocus to see only dependencies and vulnerabilities of a single component (with live demo)
3.2 Advanced feature #2: automatic recovery of missing bom-refs (with live demo)
3.3 Advanced feature #3: automatic recovery of broken dependency references (with live demo)
3.4 Advanced feature #4: circular dependencies detection (with live demo)

4. OWASP CYCLONEDX SUNSHINE: HOW TO USE AND A BIT OF IMPLEMENTATION DETAILS
4.1 CLI version: pure python with no additional requirements (with live demo)
4.2 Web-based version: also the same python script, but it runs entirely inside the browser! (with live demo)

5. Q&A

Note: A longer Q&A session will be held in the Project Demo Lab, room 133-134 - check the schedule for details!

GitHub repo: https://github.com/CycloneDX/Sunshine/

Sunshine announcement: https://www.linkedin.com/posts/owasp-cyclonedx_github-cyclonedxsunshine-sunshine-sbom-activity-7277371020246663168-5WNx

Speakers
avatar for Luca Capacci

Luca Capacci

Senior security engineer / Maintainer CycloneDX, CryptoNet Labs / OWASP
Luca received his master's degree in Computer Engineering from the University of Bologna in 2014 and has been working in the cybersecurity field since then. He is a senior security engineer and R&D manager at CryptoNet Labs and has been a maintainer at OWASP CycloneDX since December... Read More →
avatar for Mattia Fierro

Mattia Fierro

Head of Security Operations Center, Altermaind
He holds a degree in Computer Systems and Network Security and has developed a strong passion for vulnerability management and software security. Over the years, he has built his career in these areas and is currently working in the finance industry in Italy.
Thursday May 29, 2025 1:15pm - 1:30pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

1:15pm CEST

Beyond the Surface: Exploring Attacker Persistence Strategies in Kubernetes
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 113
Kubernetes has been put to great use by a wide variety of organizations to manage their workloads, as it hides away a lot of the complexity of managing and scheduling containers. But with each added layer of abstraction, there can be new places for attackers to hide in darkened corners.

This talk will examine how attackers can (ab)use little known features of Kubernetes and the components that are commonly deployed as part of cloud-native containerized workloads to persist in compromised systems, sometimes for years at a time. We'll also pinpoint places where, if you don't detect the initial attack, it might be very difficult to spot the attacker lurking in your cluster.

  rorym@mccune.org.uk
 linkedin.com/in/rorym/
 raesene.github.io (blog)
 datadoghq.com (company)
 infosec.exchange/@raesene (Mastodon)
 bsky.app/profile/m... (Bluesky )
Speakers
avatar for Rory McCune

Rory McCune

Senior Advocate, Datadog
Rory is a senior advocate for Datadog who has extensive experience with Cyber security and Cloud native computing. In addition to his work as a security reviewer and architect on containerization technologies like Kubernetes and Docker he has presented at Kubecon EU and NA, as well... Read More →
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 113
  Breakout: Breaker Track

1:15pm CEST

Mastering Security through Simple Machines: How Consistency, Not Complexity, Drives Innovation
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 116+117
In the security industry, we often take well-established development practices, such as the DevOps infinity loop, add a layer of security, and label it "DevSecOps." However, this approach frequently overlooks a critical issue: layering complex security processes onto efficient development processes can create inefficiency. In this talk, I argue that true innovation in security comes not from tooling or automation alone, but from mastering the underlying process first. By drawing an analogy to simple machines — where incremental improvements led to the evolution of tools like levers, wheels, and pulleys — I will illustrate how optimizing foundational processes leads to scalable, effective security practices. Attendees will leave with practical insights on reducing inefficiencies and fostering consistent improvement in their security workflows.
Speakers
avatar for Ken Toler

Ken Toler

President, Asgard Security
Ken is a security professional that focuses on software security from applications, to cloud and web3 technologies. He is also the host and producer of Relating to DevSecOps, a podcast focused on cultivating security relationships in organizations. With 15+ years of experience in... Read More →
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

1:15pm CEST

From Prompt to Protect: LLMs as Next-Gen WAF's
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 114
When exploring the use of Large Language Models (LLMs) in application security, a new frontier emerges for Web Application Firewalls (WAFs). Traditionally, WAFs operate on structured rules to detect and block application attacks, but what if we could leverage the unique capabilities of an LLM? In this talk, we will delve into the potential of using LLMs as WAFs, evaluating their strengths, challenges, and implications.

During this talk attendees will learn how existing applications may need to evolve to align with LLM capabilities, as well as discussing how LLMs can not only help detect threats and reduce false positives but also adapt better to zero-day vulnerabilities.

Through live demonstrations and a practical breakdown of potential architectures, this talk will equip attendees with actionable insights into how LLMs can transform application security while addressing the challenges they bring to the table.
Speakers
avatar for Juan Berner

Juan Berner

Principal Security Engineer, Booking.com
Juan Berner is a security researcher with over 13 years of experience in the field, currently working as a Principal Security Engineer at Booking.com, as SME for Application Security and Architect for security solutions.He has given talks in the past on how to build an open source... Read More →
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 114
  Breakout: Defender Track

1:15pm CEST

Against all odds: Kickstarting your Product Security Program when things are not in your favour
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 115
Have you ever been in a situation where you are looking at a map, but your surroundings look nothing like the map? And you are not even sure which direction you are facing? This is where many security teams find themselves when they begin their journey to build a product security program. Worse, like most startups, many security programs fail and never find their way to their stakeholders. While helpful roadmaps like OWASP SAMM, DSOMM, and other frameworks provide a good map, they cannot answer the question of how we actually get from A to B, or if it is even possible given the current state of our organization. We know we should have security gates, we know we should have threat modeling, we know we should have an active community of security champions, we know we should have a culture of security - but it doesn't exist, and hardly anyone supports our initiatives in the beginning. We know what needs to be done, we just don't know how to make it happen.

This talk is not about the technical challenges of building a product security program, but about the strategic, tactical, and organizational challenges. How do you build a security program when resources are limited and the organization around you does not provide an environment in which you can easily thrive? We will take a look at various challenges, our mission and understanding as a security team, possible solutions, and techniques to succeed even when the odds are stacked against us.
Speakers
avatar for Michael Helwig

Michael Helwig

Security Consultant and Founder, secureIO GmbH,
I am security consultant and founder of secureIO GmbH, a consulting company that focuses on building application security programs and consulting clients from different industries on secure software development. I am interested in DevSecOps, security testing, exploiting, vulnerability... Read More →
Thursday May 29, 2025 1:15pm - 2:00pm CEST
Room 115
  Breakout: Manager/Culture Track

1:15pm CEST

OWASP Cornucopia
Thursday May 29, 2025 1:15pm - 2:15pm CEST
Room 133-134
OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams identify security requirements in Agile, conventional and formal development processes. It is language, platform and technology-agnostic.

In this demo room session, we will learn to play the game in an all-new way as the gamemaster presents you with an interesting scenario...

Confronted with a grumpy old senior developer who refuses to shift-left due to too many hours working overtime on his incredibly sophisticated pet project, what will you do? Will you be able to teach him a lesson about why security is important, or will he be laughing all the way to his developer cave? Only skilled and passionate application security engineers will succeed!

Expect confetti, swag, (yes, you read right, swag, valued just below the corruption limit) and illegal bribes as you venture into the dark side of OWASP Cornucopia.

Speakers
avatar for Johan Sydseter - The guy with the long hair, not the long beard

Johan Sydseter - The guy with the long hair, not the long beard

Application Security Engineer, Admincontrol AS
Johan Sydseter is one of the co-leaders of OWASP Cornucopia and the co-creator of the OWASP Cornucopia Mobile App Edition. He is an Application Security engineer, developer, architect, and DevOps practitioner with 16 years of experience building and designing backend and frontend... Read More →
Thursday May 29, 2025 1:15pm - 2:15pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

1:15pm CEST

OWASP DefectDojo Demo
Thursday May 29, 2025 1:15pm - 2:15pm CEST
Room 133-134
Speakers
avatar for Matt Tesauro

Matt Tesauro

Distinguished Engineer, Founder and AppSec guru, Noname Security
Matt Tesauro is a DevSecOps and AppSec guru with specialization in creating security programs, leveraging automation to maximize team velocity and training emerging and senior professionals. When not writing automation code in Go, Matt is pushing for DevSecOps everywhere via his involvement... Read More →
Thursday May 29, 2025 1:15pm - 2:15pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

1:15pm CEST

Meet the Mentor
Thursday May 29, 2025 1:15pm - 3:00pm CEST
Room 118
One more Global AppSec event.
You’re taking training, you’re running between sessions, you’re connecting with people over coffee or when talking to a vendor.

What if you could use the event to also meet a potential mentor, or mentee?
What if you could connect face to face with someone who may help take your career to the next level, or that you can help and make a difference with?

We are inviting you to an OWASP Lisbon Global AppSec activity, first of its kind in an OWASP event: Meet The Mentor! A speed-dating activity between potential mentors and mentees where you can come face to face and see if it “clicks”, start a conversation, and see if it is a match.
Thursday May 29, 2025 1:15pm - 3:00pm CEST
Room 118 CCIB
  BONUS TRACK

1:45pm CEST

OWASP Mobile Application Security (MAS) Project Updates
Thursday May 29, 2025 1:45pm - 2:15pm CEST
Room 131-132
In this talk, Carlos Holguera and Sven Schleier, the OWASP Mobile Application Security (MAS) Project Leaders, will take a hands-on look at some of the latest OWASP MAS developments.

This session will provide key updates on the latest advancements in the Mobile Application Security (MAS) project, including the MASWE (Mobile Application Security Weakness Enumeration) and the MASTG v2 Beta. We’ll introduce new weaknesses, atomic tests, and demos designed to help developers and security researchers enhance their testing methodologies. Additionally, we’ll showcase the newly developed MAS test apps for Android and iOS, designed to streamline security research and improve the development of robust MAS tests.

A major highlight will be the MASTG demos, now available as APK and IPA files directly from the MAS website, which allow security professionals to learn and practice real-world vulnerability detection. We'll also cover critical updates to iOS 17+ testing for non-jailbroken devices, and demonstrate new techniques and methodologies using one of the latest MASTG demos. Whether you're a security researcher, developer, or just doing it for fun, this talk will equip you with the latest tools and insights to boost your mobile application security skills.

https://mas.owasp.org/
Speakers
avatar for Sven Schleier

Sven Schleier

Principal Security Consultant, Crayon
Sven is a Principal Security Consultant at Crayon, Austria and leads the professional services for cloud security. He also has extensive experience in offensive security engagements (penetration testing) and application security, specifically in guiding software development teams... Read More →
avatar for Carlos Holguera

Carlos Holguera

Principal Mobile Security Research Engineer, NowSecure
Carlos is a principal mobile security research engineer working with NowSecure and one of the core project leaders and authors of the OWASP Mobile Security Testing Guide (MASTG) and OWASP Mobile Application Security Verification Standard (MASVS), the industry standard for mobile app... Read More →

Thursday May 29, 2025 1:45pm - 2:15pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

2:15pm CEST

OWASP Cumulus: Threat Modeling the Ops of DevOps
Thursday May 29, 2025 2:15pm - 2:45pm CEST
Room 131-132
In this presentation, we will highlight how threat modeling, as a proactive measure, can increase security in DevOps projects.

We will introduce OWASP Cumulus, a threat modeling card game designed for threat modeling the Ops part of DevOps processes. This game (in combination with similar games like Elevation of Privilege or OWASP Cornucopia) enables DevOps teams to take the security responsibility for their project in a lightweight and engaging way.
Speakers
avatar for Christoph Niehoff

Christoph Niehoff

Senior Consultant, TNG Technology Consulting
In his role as a Senior Consultant at TNG Technology Consulting, Christoph Niehoff develops software products for his clients on a daily basis. As a full-stack developer, he lives and breathes DevOps, overseeing all steps of the development cycle. The security of the products is particularly... Read More →
Thursday May 29, 2025 2:15pm - 2:45pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

2:15pm CEST

Builders and Breakers: A Collaborative Look at Securing LLM-Integrated Apps
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 113
As Large Language Models (LLMs) become an integral part of modern applications, they not only enable new functionalities but also introduce unique security vulnerabilities. In this collaborative talk, we bring together two perspectives: a builder who has experience developing and defending LLM-integrated apps, and a penetration tester who specialises in AI red teaming. Together, we’ll dissect the evolving landscape of AI security.

On the defensive side, we’ll explore strategies like prompt injection prevention, input validation frameworks, and continuous testing to protect AI systems from adversarial attacks. From the offensive perspective, we’ll showcase how techniques like data poisoning and prompt manipulation are used to exploit vulnerabilities, as well as the risks tied to generative misuse that can lead to data leaks or unauthorised actions.

Through live demonstrations and real-world case studies, participants will witness both the attack and defence in action, gaining practical insights into securing AI-driven applications. Whether you’re developing AI apps or testing them for weaknesses, you’ll leave this session equipped with actionable knowledge on the latest methods for protecting LLM systems. This collaborative session offers a comprehensive look into AI security, combining the expertise of two professionals with distinct backgrounds - builder and breaker.
Speakers
avatar for Javan Rasokat

Javan Rasokat

Senior Application Security Specialist, Sage
Javan is a Senior Application Security Specialist at Sage, helping product teams enhance security throughout the software development lifecycle. On the side, he lectures Secure Coding at DHBW University in Germany. His journey as an ethical hacker began young, where he began to automate... Read More →
avatar for Rico Komenda

Rico Komenda

Senior Security Consultant, adesso SE
Rico is a senior security consultant at adesso SE. His main security areas are in application security, cloud security, offensive security and AI security.For him, general security intelligence in various aspects is a top priority. Today’s security world is constantly changing and... Read More →
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 113
  Breakout: Breaker Track

2:15pm CEST

Friend or Foe? TypeScript Security Fallacies
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 116+117
So TypeScript has become the de facto industry standard for developing web applications these days and promising type security, but do developers properly understand the role it plays in securing applications and does the type safety promise hold true in face of real-world security threats?

Developers often mistake dev-time vs runtime security as well as confuse test cases for security guard rails. Can TypeScript actually provide you with code security benefits? In this session we will explore insecure TypeScript patterns, learn how HTTP parameter pollution vulnerabilities impact TypeScript code bases and witness first-hand how attackers employ prototype pollution attacks that cripple codebases even when developers use schema validation libraries like Zod. Through hands-on coding we’ll hack a TypeScript application and learn security best practices.
Speakers
avatar for Liran Tal

Liran Tal

GitHub Star | Director of Developer Advocacy, Snyk
Liran Tal is a software developer, and a GitHub Star, world-recognized for his activism in open source communities and advancing web and Node.js security. He engages in security research through his work in the OpenJS Foundation and the Node.js ecosystem security working group, and... Read More →
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

2:15pm CEST

Living the SBOM life - the good, the bad and the evil parts
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 114
The Software Bill of Materials (SBOM) are in the limelight as the silver bullet for many things - open source license compliance, vulnerability management, copyright management, identifying technical debt and the path towards a healthy, secure and legislation-certified happy state of a binary life. But behind all this marketing and makeup is a fairly simple syntax and a lot of missing pieces in the puzzle. Let’s dive into the SBOM lifestyle together and look at the current status, the hopes and the vision for a toolset with less hype, but more real benefits for compliance, developers, product managers, with a chance of being a workhorse in risk management as well as the automatic vulnerability management toolchain. Help us make the SBOM dream come true, listen to the talk and then walk the SBOM walk!
Speakers
avatar for Olle E. Johansson

Olle E. Johansson

Leader OWASP Project Koala, Edvina AB
Olle E. Johansson is an experienced and appreciated speaker, teacher as well as an Open Source developer and consultant. He is currently project lead for OWASP Project Koala - developing the Transparency Exchange API (TEA), member of the CycloneDX industry working group, the OWASP... Read More →
avatar for Anthony Harrison

Anthony Harrison

Founder and Director, APH10
I am the Founder and Director of APH10 which helps organisations more efficiently manage software risks in their applications, in particular risks from vulnerabilities in 3rd party components and compliance with open-source licences.Has been an active member of the open source community... Read More →
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 114
  Breakout: Defender Track

2:15pm CEST

Beyond Best Practices: Uncovering the Organizational Roots of Software Security Vulnerabilities
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 115
The exponentially growing number of software security vulnerabilities and data breaches highlights a persistent gap between the implementation of the secure development lifecycle and particularly secure coding practices and their intended outcomes. Despite significant financial investments in application security and the advancements in secure software development methodologies, the effectiveness of these practices remains inconsistent. Our session is based on a multi-phase and multi-year research, conducted in two global enterprise software companies and explores how a combination of developers' security education, organizational security climate, and metrics can enhance secure coding performance and reduce software vulnerabilities.

In December 2004, Steve Lipner introduced to the world the trustworthy computing security development lifecycle. A framework which included three main pillars: Requirements for repeatable secure development processes, requirements for engineers secure coding education and requirements for measurements and accountability for software security. Guided by this three-pillar framework , our research emphasizes the under-addressed areas of developer education and organizational accountability and measurements.

Through a series of three studies, conducted in two global software companies and led by the University of Haifa in Israel, this session will present the results of an academic research that made an attempt to identify the root cause for the ever increasing number of software security vulnerabilities and investigates the effectiveness of secure coding training, the impact of organizational security climate interventions, and the correlation between security climate and secure coding performance in order to evaluate whether the later two, which were prominently left in the shades, could provide a solution to the problem.

The first study evaluates the efficacy of secure coding training programs, revealing that while training improves knowledge, it fails to significantly to reduce newly introduced vulnerabilities. The second study demonstrates that targeted organizational interventions, including leadership communication and process improvements, significantly enhance organizational security climate. The final study found significant correlation between positive security climate and secure coding performance improvement, evidenced by a higher ratio of mitigated vulnerabilities.

This research provides actionable insights for both academia and industry. It underscores the importance of integrating secure coding education with organizational climate improvements to achieve measurable security outcomes. The findings offer a comprehensive approach to reducing cyber security risks while advocating for a dual focus on technical skills and cultural transformation within software development environments.
Speakers
avatar for Tomer Gershoni

Tomer Gershoni

Ex-CSO, ZoomInfo
Tomer Gershoni is a long-time Cybersecurity executive.Most recently, Mr. Gershoni led ZoomInfo’s information security team, as its Senior Vice President and Chief Security Officer. Overseeing physical and digital security and privacy efforts and leading ZoomInfo’s work to safeguard... Read More →
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 115
  Breakout: Manager/Culture Track

2:15pm CEST

OWASP Demo Lab: See CycloneDX SBOMs Come to Life with Sunshine
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 133-134
Ever looked at a CycloneDX file and thought, there’s gotta be a better way to read this? You're not alone. Introducing Sunshine — a first-of-its-kind visualization tool that transforms static CycloneDX SBOM files into intuitive, interactive experiences.
Join us for a hands-on walkthrough of Sunshine, where you’ll get to see it in action — not just slides. This live demo will show how Sunshine helps developers, security pros, and even less-technical stakeholders actually understand what's in a software bill of materials.
GitHub repo: https://github.com/CycloneDX/Sunshine/

Sunshine announcement: https://www.linkedin.com/posts/owasp-cyclonedx_github-cyclonedxsunshine-sunshine-sbom-activity-7277371020246663168-5WNx
Speakers
avatar for Luca Capacci

Luca Capacci

Senior security engineer / Maintainer CycloneDX, CryptoNet Labs / OWASP
Luca received his master's degree in Computer Engineering from the University of Bologna in 2014 and has been working in the cybersecurity field since then. He is a senior security engineer and R&D manager at CryptoNet Labs and has been a maintainer at OWASP CycloneDX since December... Read More →
avatar for Mattia Fierro

Mattia Fierro

Head of Security Operations Center, Altermaind
He holds a degree in Computer Systems and Network Security and has developed a strong passion for vulnerability management and software security. Over the years, he has built his career in these areas and is currently working in the finance industry in Italy.
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

2:15pm CEST

OWASP GenAI Security Project
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 133-134
The OWASP Top 10 for LLM and Generative AI Security Project, has rapidly expanded from its initial scope, of providing the Top 10 list of Risks and Mitigations, now to address the lifecycle of Generative AI Security through initiatives producing key industry guidance spanning, Secure AI adoption, Red Teaming, Agentic App security, Gen AI Security Solution Landscape, Gen AI Incident response guidance and more. The project's value in providing practical guidance was recognized by the UK Government's recent publication of the UK, AI Security Code of Practice and implementation guides which include multiple resources, and will be submitted as part of the UK's European Telecommunications Standards Institute ETSI standardization efforts.

In this session we will review recent publications, discuss key project findings, review the upcoming roadmap of guidance being delivered by the initiative working groups, provide an outlook on what best practices may influence and support upcoming standards of practice and outline how you too can participate in the project and contribute your expertise.

This is a great opportunity to meet the project board and lead contributors.
Speakers
avatar for Scott Clinton

Scott Clinton

OWASP
Scott, is a Board Member and the Co-chair of the OWASP GenAI Security Project (inc. the Top 10 for LLM and Gen AI) and leads strategy, operations, and growth. Scott has more than 20 years of industry executive leadership with 18 years of commercializing open-source technologies. An... Read More →
Thursday May 29, 2025 2:15pm - 3:00pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Call for Contributors

2:45pm CEST

OWASP Coraza in 2025: What next for the WAF you want to use?
Thursday May 29, 2025 2:45pm - 3:15pm CEST
Room 131-132
Discover OWASP Coraza, an open-source WAF written in Golang making it fast, secure, memory safe, and highly extensible. Built to integrate seamlessly with the CRS v4 ruleset, Coraza solves key issues like performance bottlenecks and limited customization in traditional WAFs.

This talk will explore how Coraza addresses modern web security challenges and preview upcoming features on its roadmap, including better rule management and DevOps integrations.

Key Takeaways:
- Why Coraza is ideal for developers and security teams
- How it improves WAF performance, memory safety, and flexibility
- What's next on the roadmap

If you're seeking a lightweight, scalable, and memory-safe WAF solution, Coraza is worth your attention!
Speakers
avatar for Soujanya Namburi

Soujanya Namburi

Security Research Engineer, Traceable Ai
I’m Soujanya Namburi, a Developer and Security Research Engineer. I specialize in WAF (Web Application Firewalls), anomaly detection, external surface scanners, and active security testing. I have extensive experience with open source security projects like OWASP Coraza and OWASP... Read More →
Thursday May 29, 2025 2:45pm - 3:15pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

3:00pm CEST

PM Break with Exhibitors
Thursday May 29, 2025 3:00pm - 3:30pm CEST
Area 1
Meals provided by OWASP
Thursday May 29, 2025 3:00pm - 3:30pm CEST
Area 1
  Meals provided by OWASP

3:30pm CEST

To BI or Not to BI? Data Leakage Tragedies with Power BI Reports
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 113
In this session, we will expose a major data leakage vulnerability in Microsoft Fabric (Power BI) that has already affected tens of thousands of reports, putting thousands of enterprises and organizations at risk. We’ll demonstrate how a Power BI report viewer, especially for reports published to the web, can access unintended data by manipulating API requests to reveal the underlying data model.

We will also showcase PBAnalyzer, an open-source tool to help organizations identify their exposure, and unveil a new attack vector: DAX Injection. This vulnerability stems from improper handling of variables in DAX queries, which we will demonstrate using a Power Automate flow that leaks sensitive data to an external anonymous user.

The session will conclude with actionable steps to secure Power BI reports and prevent unnecessary data exposure.
Speakers
avatar for Uriya Elkayam

Uriya Elkayam

Senior Security Researcher, Nokod Security
Uriya Elkayam is a senior security researcher at Nokod Security. His research focuses on application security aspects of low-code/ No-code platforms such as MS Power Platform, UiPath, and OutSystems. He has a passion for both finding vulnerabilities and new mitigation techniques... Read More →
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 113
  Breakout: Breaker Track

3:30pm CEST

Policy as Code for Applications at Scale
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 116+117
You have probably heard of success stories using Open Policy Agent for all kinds of authorization problems that focus on the technical merits and challenges. While it is relatively easy to get started when you look at single applications, the game changes as soon as you want to introduce authorization as a platform capability for thousands of applications maintained by hundreds of teams.

We will talk about how Zalando adopted Open Policy Agent and Styra DAS to provide this capability and will shed some light on how we enable enough governance to stay compliant, how to use organisational scale in our favour and how to balance central platform concerns with decentral application concerns.

We’ll touch on the technical integration points in our Platform via OSS Skipper, observability via OpenTelemetry and Styra DAS. We will also talk about the developer experience, the leverage we gain as security teams and how we structure our policies to enable complex business cases across multiple applications.
Speakers
avatar for Magnus Jungsbluth

Magnus Jungsbluth

Senior Principal Software Engineer, Zalando SE
Magnus has been working for two decades in software engineering with a strong focus on security and cryptography. At Bundesdruckerei he led a platform team for trust center applications and worked on Public Key Infrastructures for eID applications. Since joining Zalando he leads initiatives... Read More →
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

3:30pm CEST

Current challenges of GraphQL security
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 114
GraphQL’s capability to fetch precisely what’s needed and nothing more, its efficient handling of real-time data, and its ease of integration with modern architectures make it a compelling choice for modern web and mobile applications. As developers seek more efficiency and better performance from their applications, GraphQL is increasingly becoming the go-to technology for API development. However, building and maintaining GraphQL applications requires careful consideration of security.

In this talk, security engineers will strengthen their GraphQL security skills by learning key techniques such as complexity management, batching, aliasing, sanitization, and depth limit enforcement. They will also learn to implement customizable middleware with their development team, like GraphQL Armor, for various GraphQL server engines.

Participants will explore different techniques and packages, and apply them to enhance the safety of their GraphQL applications. By the end of the talk, attendees will be equipped with practical knowledge to build secure and efficient GraphQL APIs.
Speakers
avatar for Maxence Lecanu

Maxence Lecanu

Technical Lead, Escape
Maxence is Technical Lead at Escape, where, as a founding engineer, he played a key role in shaping the platform from the ground up—helping security teams detect and mitigate business logic vulnerabilities at scale. With over 6 years of experience across software engineering and... Read More →
avatar for Antoine Carossio

Antoine Carossio

Cofounder & CTO, Escape.tech
Former pentester for the French Intelligence Services.Former Machine Learning Research @ Apple. linkedin.com/in/acarossio/ escape.tech (company) @iCarossio escape.tech (blog... Read More →
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 114
  Breakout: Defender Track

3:30pm CEST

Kaizen for your appsec program: Turning big problems into small steps
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 115
Organizations are transitioning in their use of OWASP SAMM. The use case evolves from an assessment model to a quality control program. Kaizen is an iterative improvement methodology popularized in the Japanese industry. As an operational philosophy it has influenced quality control systems worldwide. This talk highlights how Kaizen principles are applied in the industry by separating different streams from the OWASP SAMM model and managing each stream in a continuous improvement cycle. The talk is based on practical experience and 27 interviews with appsec program managers at a wide range of corporations on this journey. There are some recurring pitfalls in the implementation of OWASP that relate to the human aspect of change management, the pitfalls of gamification and challenges around fitting the generic framework to diverse contexts. Finally we distill from the successes and the failures of the industry the potential for Kaizen principles and OWASP SAMM to leverage participatory leadership, empowerment and intrinsic motivation. The conclusion is an optimistic picture of the future, where security is everyone's problem, jobs are meaningful and applications a little bit more secure.
Speakers
avatar for Dag Flachet

Dag Flachet

Co-Founder, Professor and Board Member, Codific
Dag Flachet has a doctorate degree in business administration specialized in organizational psychology. He is a co-founder of Codific, and a professor and board member at the Geneva Business School. Dag is an active member of the OWASP Barcelona Chapter.   linkedin.com/in/dagf... Read More →
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 115
  Breakout: Manager/Culture Track

3:30pm CEST

Automating OWASP ASVS with OWASP Nuclei: A Hands-On Walkthrough
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 133-134
Tired of the slow, manual grind of ASVS assessments? This live demo introduces the OWASP ASVS Security Evaluation Templates—an open-source toolkit built on Nuclei to streamline and scale your web application security testing. Designed for security practitioners, this session walks through real-world use cases, showing how to plug these templates into your existing workflows for faster, more accurate ASVS evaluations.
We’ll cover customization, integration, and key considerations for operationalizing the templates—plus, how you can contribute back to the project. Whether you're looking to boost testing efficiency or reduce human error, this session gives you the tools to level up your appsec approach in a fraction of the time.
Speakers
avatar for AmirHossein Raeisi

AmirHossein Raeisi

Application Security Engineer
avatar for Hamed Salimian

Hamed Salimian

Cybersecurity Auditor, OWASP Project Lead
Experienced cybersecurity auditor and penetration tester with a proven track record in securing systems for banking and industrial organizations. Adept at identifying vulnerabilities, ensuring compliance, and implementing robust security solutions. Proficient programmer with expertise... Read More →

Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

3:30pm CEST

Level Up Your AppSec Game: OWASP SAMM's Roadmap to Security Excellence
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 133-134
Join OWASP project leader Sebastien for an engaging and interactive introduction and update on the OWASP Software Assurance Maturity Model (SAMM). We will cover SAMM's purpose and application in jumpstarting and accelerating your software assurance roadmap.

This session will provide valuable insights and practical knowledge on leveraging SAMM as secure development framework:

Tools and Assessment Guidance: Discover the range of SAMM tools available to support your software assurance efforts. We will explain the latest assessment guidance, providing you with the knowledge to utilize these tools to their fullest potential.

Mapping to Other Frameworks: Learn how SAMM maps to other frameworks, such as the NIST Secure Software Development Framework (SSDF) and OpenCRE. This will enable you to leverage SAMM for demonstrating compliance and enhancing your software security posture for any compliance requirement.

Benchmark yourself against peers: The OWASP SAMM Benchmark enables organizations to anonymously compare their software security practices against industry peers, providing insights to identify improvement areas, prioritize security efforts, and track progress over time.
Speakers
avatar for Sebastien Deleersnyder

Sebastien Deleersnyder

CTO, Toreon
Sebastien Deleersnyder, also known as Seba, is a highly accomplished individual in the field of cybersecurity. He is the CTO and co-founder of Toreon, as well as the COO and lead threat modeling trainer of Data Protection Institute. Seba holds a Master's degree in Software Engineering... Read More →
Thursday May 29, 2025 3:30pm - 4:15pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

3:35pm CEST

OWASP Domain Protect Project
Thursday May 29, 2025 3:35pm - 4:05pm CEST
Room 131-132
In 2022 we launched OWASP Domain Protect, a tool using serverless functions to automate scans of an enterprise’s DNS environments in AWS, GCP and Cloudflare, test for subdomains vulnerable to takeover, and create Slack and email alerts.

Since then, new features have been added, including a migration of OWASP Domain Protect to a public Terraform Module hosted on the Terraform and OpenTofu Registries. This approach makes it very straightforward for users to incorporate OWASP Domain Protect to their own cloud infrastructure, and easy to keep it updated.

In this presentation, I’ll review the basics of subdomain takeover, describe the system architecture of Domain Protect, detail recent improvements, and give a live demonstration of vulnerable domain detection followed by automated takeover.

Speakers
avatar for Paul Schwarzenberger

Paul Schwarzenberger

Cloud Security Engineer, Celidor
Paul Schwarzenberger is a cloud security architect and engineer, leading security engagements and cloud migration projects for customers across sectors including financial services and Government. He has in-depth enterprise experience and certifications across all three major cloud... Read More →
Thursday May 29, 2025 3:35pm - 4:05pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

4:30pm CEST

Networking Reception in Expo Hall
Thursday May 29, 2025 4:30pm - 6:30pm CEST
Area 1
Come network with drinks and appetizers in the expo hall!
Thursday May 29, 2025 4:30pm - 6:30pm CEST
Area 1
  Meals provided by OWASP

6:45pm CEST

Endor Lab's After Party
Thursday May 29, 2025 6:45pm - 7:00pm CEST
Purobeach Barcelona Rooftop Bar - Located in the Hilton
Rooftop Brews & AppSec Views 
May 29th
6.30pm until 8.30pm
Purobeach Barcelona Rooftop Bar - Located in the Hilton (4 min walk from the OWASP Global AppSec)

Join Endor Labs after Day 1 of OWASP Global AppSec Europe for a free evening of cold beers, local bites, and chill conversations with fellow AppSec minds — all set against a stunning rooftop backdrop in Barcelona.

Spaces are limited, and you must register to attend here.
Thursday May 29, 2025 6:45pm - 7:00pm CEST
Purobeach Barcelona Rooftop Bar - Located in the Hilton Passeig del Taulat, 262 - 264 08019 Barcelona Spain
  Exhibitor Networking Events & Receptions
 
Friday, May 30
 

8:15am CEST

Coffee/Tea
Friday May 30, 2025 8:15am - 9:00am CEST
Area 1
Meals provided by OWASP. Come join us in the Expo Hall
Friday May 30, 2025 8:15am - 9:00am CEST
Area 1
  Meals provided by OWASP

8:15am CEST

Registration
Friday May 30, 2025 8:15am - 6:00pm CEST
Friday May 30, 2025 8:15am - 6:00pm CEST

8:30am CEST

Speaker Ready Room
Friday May 30, 2025 8:30am - 5:00pm CEST
Room 119
Open to all of our Global AppSec Speakers to prepare for their presentation.
Friday May 30, 2025 8:30am - 5:00pm CEST
Room 119 CCIB
  Speakers Only

9:00am CEST

Keynote: Outside the Ivory Tower: Connecting Practice and Science
Friday May 30, 2025 9:00am - 10:00am CEST
Room 116+117
Speakers
KL

Kate Labunets

Assistant Professor in the Department of Information and Computing Sciences, Utrecht University in the Netherlands
Dr. Kate Labunets is an Assistant Professor in the Department of Information and Computing Sciences at Utrecht University in the Netherlands. Before joining Utrecht University, she was a cyber security postdoc for the VSNU Digital Society track on Safety and Security and H2020 CYBECO... Read More →
Friday May 30, 2025 9:00am - 10:00am CEST
Room 116+117 CCIB
  Keynote

9:00am CEST

OWASP Member Lounge
Friday May 30, 2025 9:00am - 5:00pm CEST
Room 111
Come one OWASP member, come all!  This room is open to all OWASP members and offers networking tables, working stations, and a gaming area!
Friday May 30, 2025 9:00am - 5:00pm CEST
Room 111
  BONUS TRACK

10:00am CEST

AM Break with Exhibitors
Friday May 30, 2025 10:00am - 10:30am CEST
Area 1
Meals provided by OWASP
Friday May 30, 2025 10:00am - 10:30am CEST
Area 1
  Meals provided by OWASP

10:00am CEST

Bob the Breaker CTF - The Reunion. The No-code/Low-code Hacking Saga Continues.
Friday May 30, 2025 10:00am - 2:00pm CEST
Room 118
At a reunion, Bob's fame for hacking into corporate secrets spreads quickly.  
Soon, his pals seek a "little help from a friend."
Join forces with Bob and make sure his buddies get hold of the data they need.
Sponsors
NS
avatar for NoKod Security
Friday May 30, 2025 10:00am - 2:00pm CEST
Room 118 CCIB
  BONUS TRACK

10:30am CEST

Beyond the Rules: The Past, Present, and Future of OWASP CRS
Friday May 30, 2025 10:30am - 11:00am CEST
Room 131-132
The OWASP Core Rule Set (CRS) is one of the Foundation’s flagship projects—quietly powering Web Application Firewalls (WAFs) across the world, safeguarding applications large and small. But it’s been a while since CRS has shared a full update with the community. This talk changes that.
We’ll explore the full lifecycle of CRS—from its origins under Trustwave, through the pivotal leap to version 3, and into the challenges we’re addressing as we build toward version 4. Along the way, we’ll reflect on what it takes to maintain and evolve a high-impact open source project within a constantly shifting security landscape.
Attendees will get a clear picture of what CRS is today: a sophisticated, extensible, community-driven detection framework. You’ll hear how we’re doubling down on quality assurance, introducing a plugin architecture, and transitioning from traditional SecLang rules to a YAML-based format designed to make contributions easier and tooling more powerful.
This session is for anyone who works with WAFs, contributes to open source, or is curious about the future of web application defense. You’ll walk away with a deeper understanding of the CRS roadmap—and how you can be part of shaping what comes next.
Key Takeaways:
  • What OWASP CRS is—and why it matters more than ever
  • Lessons learned from building and maintaining a global ruleset
  • The roadmap to CRS 4.0 and what’s next for the project
  • How the community can get involved and contribute meaningfully
Speakers
avatar for Felipe Zipitria

Felipe Zipitria

Senior Engineer II, Security, Life360
Felipe Zipitria is an expert in computer security, graduated with an MSc from the Universidad de la República in Uruguay. With over 20 years of experience in SRE, DevOps, and SysAdmin roles, Felipe has transitioned into specialized areas, dedicating the past 5 years to AppSec and... Read More →
Friday May 30, 2025 10:30am - 11:00am CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

10:30am CEST

Doors of (AI)pportunity: The Front and Backdoors of LLMs
Friday May 30, 2025 10:30am - 11:15am CEST
Room 113
The question “What is AI security?” followed by “No, not image classification, LLMs!” has become a frequent conversation for us at conferences around the world. So, we decided to answer the real question.

Having spent the last year actively trying to break LLMs as attackers and defenders, as external entities, and as insider threats, we have gathered and created many techniques to jailbreak, trick, and control LLMs, and have distilled previously complex techniques in a way everyone can understand. We will teach you how to exploit control tokens, much like when we hacked Google’s Gemini for Workspace. You will see how to get an LLM to pop a shell with an image of a seashell, and we’ll even provide the tools to automatically extract pop-culture exploits for your very own KROP gadgets. We will reveal how an insider threat could implant hidden logic or backdoors into your LLM, enabling an attacker to control outputs, change inputs, or even make the LLM refuse to say the word “OWASP”. We will enable you to take full control over their local LLMs, even demonstrating how an LLM can be fully and permanently jailbroken in minutes with a CPU rather than with dozens of hours on multiple GPUs. By the end, our audience will be able to make any LLM say whatever they want.
Speakers
avatar for Kasimir Schulz

Kasimir Schulz

Principal Security Researcher, HiddenLayer,
Kasimir Schulz, Principal Security Researcher at HiddenLayer, is a leading expert in uncovering zero-day exploits and supply chain vulnerabilities in AI. His work has been featured in BleepingComputer and Dark Reading, and he has spoken at conferences such as FS-ISAC and Black Hat... Read More →
avatar for Kenneth Yeung

Kenneth Yeung

AI Threat Researcher, HiddenLayer
Kenneth Yeung is an AI Threat Researcher at HiddenLayer, specializing in adversarial machine learning and AI security. He is known for identifying LLM vulnerabilities in AI systems like Google Gemini, and his work has been featured in publications like Forbes and DarkReading. Kenneth... Read More →
Friday May 30, 2025 10:30am - 11:15am CEST
Room 113
  Breakout: Breaker Track

10:30am CEST

A completely pluggable DevSecOps programme, for free, using community resources
Friday May 30, 2025 10:30am - 11:15am CEST
Room 116+117
Despite our collective efforts, we haven’t managed to harmonize tools and processes. Several projects like ASVS, SAMM and others have attempted information harmony but only the now defunct Glue has attempted tool orchestration harmonization and for good reason, it is a hard problem to solve, almost impossible by volunteers alone.

This session introduces Smithy, the only open-source workflow engine for security tools. Smithy stands as a unifying force for building robust, scalable DevSecOps, and beyond, pipelines. Leveraging Smithy’s support for OCSF-native data formats, we centralized the outputs of disparate security tools into a cohesive data lake, unlocking actionable insights that improved vulnerability prioritization and resource allocation.

The talk will showcase real-world applications, including integrating OpenCRE, Cartography, AI-driven solutions and open-source resources to enhance vulnerability detection accuracy and reprioritization, for free, using ready made community resources.

Whether you're a tech lead, security engineer, or CISO, this presentation offers practical guidance for creating adaptable, data-driven security workflows without breaking the bank.
Speakers
avatar for Spyros Gasteratos

Spyros Gasteratos

Security Engineer & Architect, OWASP
Spyros has over 15 years of experience in the security world. Since the beginning of his career he has been an avid supporter and contributor of open source software and an OWASP volunteer. Currently he is interested in the harmonization of security tools and information and is currently... Read More →
Friday May 30, 2025 10:30am - 11:15am CEST
Room 116+117 CCIB
  Breakout: Builder Track

10:30am CEST

Think Before You Prompt: Securing Large Language Models from a Code Perspective
Friday May 30, 2025 10:30am - 11:15am CEST
Room 114
As Large Language Models (LLMs) become integral to modern applications, securing them at the code level is critical to preventing prompt injection attacks, poisoned models, unauthorized modifications, and other vulnerabilities. This talk delves into common pitfalls and effective mitigations when integrating LLMs into software systems, whether working with cloud vendors or hosting your own models. By focusing on LLM security from a developer's perspective rather than runtime defenses, we emphasize a shift-left approach—embedding security early in the software development lifecycle to proactively mitigate threats and minimize risks before deployment.

We'll examine practical security challenges faced during LLM integration, including input sanitization, output validation, and model pinning. Through detailed code examples and a live demonstration of model tampering, attendees will witness firsthand how attackers can exploit inadequate security controls to compromise LLM systems. The demonstration will showcase a real-world scenario where a legitimate model is swapped with a malicious one, highlighting the critical importance of robust model integrity verification and secure deployment practices.

Participants will learn concrete implementation patterns and security controls that can prevent such attacks, with practical code samples they can apply to their own projects. The session will cover essential defensive techniques including proper API key management, secure model loading and validation, and safe handling of sensitive data in prompts. Whether you're building applications using cloud-based LLM services or deploying your own models, you'll leave with actionable code-level strategies to enhance your application's security posture and protect against emerging AI-specific threats.
Speakers
avatar for Yaron Avital

Yaron Avital

Security Researcher, Palo Alto Networks
Yaron Avital is a seasoned professional with a diverse background in the technology and cybersecurity fields. Yaron's career has spanned over 15 years in the private sector as a software engineer and team lead at global companies and startups.Driven by a passion for cybersecurity... Read More →
avatar for Tomer Segev

Tomer Segev

Security Researcher, Palo Alto Networks
 Tomer Segev is a cybersecurity professional with a strong background in software development and security research. He began his career at 17 as a developer before serving as a cyber researcher in the top cyber unit of the IDF, where he gained hands-on experience in the most advanced... Read More →
Friday May 30, 2025 10:30am - 11:15am CEST
Room 114
  Breakout: Defender Track

10:30am CEST

LLMs vs. SAST: How AI Delivers Accurate Vulnerability Detection and Reduces False Positives
Friday May 30, 2025 10:30am - 11:15am CEST
Room 115
The exponentially growing number of software security vulnerabilities and data breaches highlights a persistent gap between the implementation of the secure development lifecycle and particularly secure coding practices and their intended outcomes. Despite significant financial investments in application security and the advancements in secure software development methodologies, the effectiveness of these practices remains inconsistent. Our session is based on a multi-phase and multi-year research, conducted in two global enterprise software companies and explores how a combination of developers' security education, organizational security climate, and metrics can enhance secure coding performance and reduce software vulnerabilities.

In December 2004, Steve Lipner introduced to the world the trustworthy computing security development lifecycle. A framework which included three main pillars: Requirements for repeatable secure development processes, requirements for engineers secure coding education and requirements for measurements and accountability for software security. Guided by this three-pillar framework , our research emphasizes the under-addressed areas of developer education and organizational accountability and measurements.

Through a series of three studies, conducted in two global software companies and led by the University of Haifa in Israel, this session will present the results of an academic research that made an attempt to identify the root cause for the ever increasing number of software security vulnerabilities and investigates the effectiveness of secure coding training, the impact of organizational security climate interventions, and the correlation between security climate and secure coding performance in order to evaluate whether the later two, which were prominently left in the shades, could provide a solution to the problem.

The first study evaluates the efficacy of secure coding training programs, revealing that while training improves knowledge, it fails to significantly to reduce newly introduced vulnerabilities. The second study demonstrates that targeted organizational interventions, including leadership communication and process improvements, significantly enhance organizational security climate. The final study found significant correlation between positive security climate and secure coding performance improvement, evidenced by a higher ratio of mitigated vulnerabilities.

This research provides actionable insights for both academia and industry. It underscores the importance of integrating secure coding education with organizational climate improvements to achieve measurable security outcomes. The findings offer a comprehensive approach to reducing cyber security risks while advocating for a dual focus on technical skills and cultural transformation within software development environments.
Speakers
avatar for Jonathan Santilli

Jonathan Santilli

Software Engineer and AI practitioner, Snyk
Jonathan Santilli defines himself as a problem solver, or at least he tries. With over 20 years of experience working for various tech companies, Jonathan has played different roles, from Team lead developer to Product manager and, of course, problem solver. Jonathan is mainly interested... Read More →
avatar for Kirill Efimov

Kirill Efimov

Security R&D Team Lead, Mobb.ai
 As a seasoned security researcher, I've led teams at Snyk and now helm security research at Mobb. With a wealth of publications and speaking engagements, I've delved deep into the intricacies of cybersecurity, unraveling vulnerabilities and crafting solutions. From pioneering research... Read More →
Friday May 30, 2025 10:30am - 11:15am CEST
Room 115
  Breakout: Manager/Culture Track

10:45am CEST

GenAI Security Project Getting down to business: practical & tactical Project Management
Friday May 30, 2025 10:45am - 11:45am CEST
Room 133-134
Friday May 30, 2025 10:45am - 11:45am CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

10:45am CEST

OWASP KubeFIM Advanced Threat Detection & Security Automation
Friday May 30, 2025 10:45am - 11:45am CEST
Room 133-134
1. Recap of Day 1 + What’s Next?  
- Quick summary of how KubeFIM detects file changes in Kubernetes.
- Why KubeFIM is unique compared to traditional FIM solutions.

2. Advanced Use Cases: Detecting Real-World Threats - Detecting tampered application binaries & unauthorized config changes.
- Show how KubeFIM detects & alerts security teams in real time.

3. Integrating KubeFIM into Security Workflows - How to forward alerts to SIEM tools (Splunk, ELK Stack, OpenSearch)
  - Using KubeFIM with SOAR platforms (automating threat response).
- Best practices for using KubeFIM in production Kubernetes clusters.

4. Roadmap & Future Improvements - What’s next for KubeFIM?

5. Closing Remarks & Q&A
Speakers
avatar for Abhijit Chatterjee

Abhijit Chatterjee

Co-Founder, Cyber Secure India
Abhijit is the Co-Founder of Cyber Secure India (CSI), a cybersecurity think tank focused on driving cybersecurity awareness, building a strong community through free education, sharing knowledge, and empowering young individuals to strengthen the digital infrastructure.
Friday May 30, 2025 10:45am - 11:45am CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

11:00am CEST

OWASP Nettacker
Friday May 30, 2025 11:00am - 11:30am CEST
Room 131-132
OWASP Nettacker project (a portmanteau of "Network Attacker") is a relatively new yet awesome and powerful 'swiss-army-knife' automated penetration testing framework fully written in Python. Nettacker recently gained a lot of interest from the penetration testing community and was even included in the specialist Linux distribution for penetration testers and security researchers.

Nettacker can run various scans using a variety of methods and generate scan reports for applications and networks, including services, bugs, vulnerabilities, misconfigurations, default credentials and many other cool features - for example an ability to chain different scan methods. This talk will feature a live demo and several practical usage examples of how organisations can benefit from this OWASP project for automated security testing
Speakers
avatar for Sam Stepanyan

Sam Stepanyan

OWASP Nettacker Project Leader, OWASP
Sam Stepanyan is an OWASP Global Board member and an OWASP London Chapter Leader, and an Independent Application Security Consultant and Security Architect with over 20 years of experience in the IT industry with a background in software engineering and web application development... Read More →
Friday May 30, 2025 11:00am - 11:30am CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

11:00am CEST

Level Up Your AppSec Game: OWASP SAMM's Roadmap to Security Excellence
Friday May 30, 2025 11:00am - 11:45am CEST
Room 133-134
Join OWASP project leader Sebastien for an engaging and interactive introduction and update on the OWASP Software Assurance Maturity Model (SAMM). We will cover SAMM's purpose and application in jumpstarting and accelerating your software assurance roadmap.

This session will provide valuable insights and practical knowledge on leveraging SAMM as secure development framework:

Tools and Assessment Guidance: Discover the range of SAMM tools available to support your software assurance efforts. We will explain the latest assessment guidance, providing you with the knowledge to utilize these tools to their fullest potential.

Mapping to Other Frameworks: Learn how SAMM maps to other frameworks, such as the NIST Secure Software Development Framework (SSDF) and OpenCRE. This will enable you to leverage SAMM for demonstrating compliance and enhancing your software security posture for any compliance requirement.

Benchmark yourself against peers: The OWASP SAMM Benchmark enables organizations to anonymously compare their software security practices against industry peers, providing insights to identify improvement areas, prioritize security efforts, and track progress over time.
Speakers
avatar for Sebastien Deleersnyder

Sebastien Deleersnyder

CTO, Toreon
Sebastien Deleersnyder, also known as Seba, is a highly accomplished individual in the field of cybersecurity. He is the CTO and co-founder of Toreon, as well as the COO and lead threat modeling trainer of Data Protection Institute. Seba holds a Master's degree in Software Engineering... Read More →
Friday May 30, 2025 11:00am - 11:45am CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

11:00am CEST

OWASP Certified Secure Developer Open Call
Friday May 30, 2025 11:00am - 11:45am CEST
Room 133-134
Join Us in Shaping the Future of Secure Software Development

The OWASP Education and Training Committee is developing a certification program designed specifically for developers—and we need your expertise.

For the first time, this initiative will be showcased at OWASP Global AppSec EU 2025, and we’re inviting the community to help build the body of knowledge that will form the foundation of the certification curriculum.

If you're passionate about secure coding and developer education, this is your chance to contribute meaningfully to a global effort. Let’s build something that lasts—together.
Speakers
avatar for Shruti Kulkarni

Shruti Kulkarni

Information Security Architect, 6point6
Shruti is an information security / enterprise security architect with experience in ISO27001, PCI-DSS, policies, standards, security tools, threat modelling, risk assessments. Shruti works on security strategies and collaborates with cross-functional groups to implement information... Read More →
Friday May 30, 2025 11:00am - 11:45am CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Call for Contributors

11:30am CEST

Navigating Agentic AI Security Risks: OWASP’s GenAI Guidance for Securing Autonomous AI Agents
Friday May 30, 2025 11:30am - 12:00pm CEST
Room 131-132
As artificial intelligence advances, autonomous AI agents are becoming integral to modern applications, automating decision-making, problem-solving, and even interacting dynamically with users. However, this evolution brings new security challenges that traditional cybersecurity frameworks struggle to address. OWASP’s GenAI Security Project has identified Agentic Security Risks as a critical category of threats that can compromise AI-driven systems, leading to unintended actions, data leaks, model manipulation, and adversarial exploits.

This session will explore Agentic Security Risks—a unique class of vulnerabilities stemming from AI agents’ autonomy, adaptability, and ability to interact with complex environments. We’ll dissect how malicious actors can exploit these systems by influencing their decision-making processes, injecting harmful instructions, or leveraging prompt-based attacks to bypass safety constraints.

Through a deep dive into OWASP’s latest findings, attendees will gain practical insights into risk identification and mitigation strategies tailored for AI-driven agents. The talk will cover:

Understanding Agentic Security Risks: How autonomous AI agents process, reason, and act—and where vulnerabilities emerge.
Threat Modeling for AI Agents: Key security considerations when deploying AI-driven agents in enterprise and consumer applications.
Exploitable Weaknesses in AI Agents: Case studies on prompt injection, adversarial manipulation, data poisoning, and model exfiltration.
OWASP’s Mitigation Framework: Best practices for securing agentic AI systems, including robust validation, policy enforcement, access control, and behavioral monitoring.
Security by Design: How to integrate GenAI security principles into the development lifecycle to preemptively mitigate risks.
By the end of the session, attendees will have a structured approach to assessing and mitigating security risks in agentic AI systems. Whether you’re a developer, security professional, or AI architect, this session will equip you with actionable strategies to secure your AI-powered applications against emerging threats.

Join us to explore the cutting edge of AI security and ensure that autonomous agents work for us—not against us.
Speakers
avatar for John Sotiropoulos

John Sotiropoulos

Head of AI Security / OWASP GenAI Security Project (Top 10 for LLM & Agentic Security Co-Lead), Kainos
John Sotiropoulos is the head of AI Security at Kainos where he is responsible for AI security and securing national-scale systems in government, regulators, and healthcare.  John has gained extensive experience in building and securing systems in previous roles as developer, CTO... Read More →
Friday May 30, 2025 11:30am - 12:00pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

11:30am CEST

Restless Guests: From Subscription to Backdoor Intruder
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 113
Through novel research our team uncovered a critical vulnerability in Azure's guest user model, revealing that guest users can create and own subscriptions in external tenants they've joined—even without explicit privileges. This capability, which is often overlooked by Azure administrators, allows attackers to exploit these subscriptions to expand their access, move laterally within resource tenants, and create stealthy backdoor identities in the Entra directory. Alarmingly, Microsoft has confirmed real-world attacks using this method, highlighting a significant gap in many Azure threat models. This talk will share the findings from this first of its kind research into this exploit found in the wild.

We'll dive into how subscriptions, intended to act as security boundaries, make it possible for any guest to create and control a subscription undermines this premise. We'll provide examples of attackers leveraging this pathway to exploit known attack vectors to escalate privileges and establish persistent access, a threat most Azure admins do not anticipate when inviting guest users. While Microsoft plans to introduce preventative options in the future, this gap leaves organizations exposed to risks they may not even realize exist––but should definitely know about!
Speakers
avatar for Simon Maxwell-Stewart

Simon Maxwell-Stewart

Security Researcher and Data Scientist, BeyondTrust
Simon Maxwell-Stewart is a seasoned data scientist with over a decade of experience in big data environments and a passion for pushing the boundaries of analytics. A Physics graduate from the University of Oxford, Simon began his career tackling complex data challenges and has since... Read More →
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 113
  Breakout: Breaker Track

11:30am CEST

Introducing the 5.0 release of the ASVS
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 116+117
Formally announcing v5.0 of the Application Security Verification Standard (ASVS), the first major release in five years of one of OWASP’s flagship projects. But the project has not been sitting idle for years, it has been under development the entire time.

This talk will cover the big changes and improvements in this recently released version.

This includes:
- Defining and clarifying the scope of the ASVS, and expectations for requirements.
- Mandating documented security decisions to provide some flexibility on implementing and verifying security requirements, to match the differences between organizations and applications.
- Adding several new chapters and making important changes to existing chapters.
- Providing a two-way mapping to make it easier to migrate from v4.x to v5.
- Balancing the levels and reducing the barrier to entry into Level 1.

We will also talk about how you can use the standard more effectively in your organizations, the future plans for ASVS now that version 5.0 is out, and how you can be involved.

It’s time to move forward - start using ASVS v5.0 and come on board to develop it further.
Speakers
avatar for Elar Lang

Elar Lang

OWASP ASVS co-lead, Pentester/researcher/lecturer at Clarified Security, Clarified Security
Elar Lang is a web application security specialist and enthusiast who has been working for more than 13 years in different aspects of web application security. A full-time security tester, training architect, and web application security developer educator (close to 3000 hours of... Read More →
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

11:30am CEST

Surviving prioritisation when CVE stands for “Customer Very Enthusiastic"
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 114
Everybody talks about problems with the width of CVE space - too many, coming too fast, how to prioritise them. This talk takes the problem into 3D - let’s talk about the depth of the space!

How a single medium risk CVE can consume crazy amounts of time of an AppSec team?

We will look into couple of examples of CVEs in a product that my team protects and trace their journey through the ecosystem. On the journey we will meet various dragons, hydras, and other dangerous creatures:

- LLM-empowered scanners hallucinating CVSS scores, packages, versions, anything;
- Good research teams making mistakes translating between different versions of CVSS
- Glory-chasing “research teams” writing their own advisories for no apparent reason
- Consensus based approach in CVE ecosystem guarantees security team cannot sleep until EVERY scanner has calmed down;
- And my favourite troll under the bridge: customers saying “I don’t care it’s not reachable in your context, I can’t deploy your product until my scanner is happy”.

The soundtrack for the quest is provided by the vendors continuously messaging you with fantastic promises to solve everything.

Can your character survive the quest and what loot do you need?
Speakers
avatar for Irene Michlin

Irene Michlin

Application Security Lead, Neo4j
Irene Michlin is an application security lead at Neo4j. Before going into application security, Irene worked as software engineer, architect, and technical lead at companies ranging from startups to corporate giants. Her professional interests include securing development life-cycles... Read More →
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 114
  Breakout: Defender Track

11:30am CEST

Security Champion Worst Practices
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 115
Security champion programs are all the rage right now, but they aren’t a magic bullet; they are a lot of work and more than half of them fail. We want to scale our security programs and improve security culture and communication, but what happens when are champions are less-than-enthused? There’s no support from management? We can’t get enough buy in? Let’s look at when things go WRONG with security champions programs, with this list of WORST practices, and how to avoid each one.
Speakers
avatar for Tanya Janca

Tanya Janca

Staff DevRel, Semgrep
Tanya Janca, aka SheHacksPurple, is the best-selling author of 'Alice and Bob Learn Secure Coding', 'Alice and Bob Learn Application Security’ and the ‘AppSec Antics’ card game. Over her 28-year IT career she has won countless awards (including OWASP Lifetime Distinguished Member... Read More →
Friday May 30, 2025 11:30am - 12:15pm CEST
Room 115
  Breakout: Manager/Culture Track

1:15pm CEST

OWASP Cornucopia: Scaling secure design & requirement gathering activities
Friday May 30, 2025 1:15pm - 1:45pm CEST
Room 131-132
We are launching a brand-new version of OWASP Cornucopia with QR codes that will make threat modeling, security requirement gathering, and security design much easier! Each QR code will take you to a brand-new OWASP Cornucopia website, where you can explore each card and the security requirements and controls connected to them (see https://owaspcornucopia.org/ ). This will help scale secure design and requirement gathering activities for your development teams and empower them to do application security in a more agile way.

Coming soon!
Web store for you to buy OWASP Cornucopia card decks.

Call for contributors
We are looking for volunteers that would like to help us improve the new website and those who would like to help translate Cornucopia into various languages to ensure that developers who don't have English as their mother tongue, understand the requirements and controls presented to them. We are also looking for ideas and help in maintaining and improving the new website to ensure it becomes a valuable tool for everyone looking at solving application security challenges.
Speakers
avatar for Johan Sydseter - The guy with the long hair, not the long beard

Johan Sydseter - The guy with the long hair, not the long beard

Application Security Engineer, Admincontrol AS
Johan Sydseter is one of the co-leaders of OWASP Cornucopia and the co-creator of the OWASP Cornucopia Mobile App Edition. He is an Application Security engineer, developer, architect, and DevOps practitioner with 16 years of experience building and designing backend and frontend... Read More →
Friday May 30, 2025 1:15pm - 1:45pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

1:15pm CEST

Abusing misconfigurations in CI/CD to hijack apps and clouds
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 113
Writing and maintaining secure applications is hard enough, and in today's paradigm with DevOps and CI/CD developers are often tasked with integrating and automating a full code-to-cloud pipeline. This introduces new control plane to application risks. Some of these instances can lead to full compromise if exploited by a threat actor.

In this talk we will break down the core components of a modern CI/CD-workflow such as OIDC, GitHub Actions and Workload Identities. Then we will describe the security properties of these components, and present a threat model for the code-to-cloud flow. Based on this we will showcase and demonstrate common flaws that could lead to full application and cloud compromise.

To increase the capacity of organizations to detect such flaws we will release an open source tool, developed by the presenters, to discover and triage these issues. In the session the tool will be demonstrated and discussed. Attendees will get actionable knowledge and tooling that can be applied when leaving the room. The talk and tool is based on findings and experiences from cloud and application security assessment conducted by the presenters.
Speakers
avatar for Håkon Nikolai Stange Sørum

Håkon Nikolai Stange Sørum

Principal Security Architect and Partner, O3 Cyber
Håkon has extensive knowledge on implementing secure software development practices for modern DevOps teams, designing and implementing cloud security architectures, and securely operating cloud infrastructure. Håkon offers industry insights into the implementation of secure design... Read More →
avatar for Karim El-Melhaoui

Karim El-Melhaoui

Principal Security Architect at O3 Cyber, Microsoft Security MVP, O3 Cyber
Karim is a seasoned and renowned thought leader within cloud security. At O3 Cyber, he conducts research and development and works with our clients, primarily in Financial Industry. Karim has a background in building and operating platform services for security on private and public... Read More →
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 113
  Breakout: Breaker Track

1:15pm CEST

Scaling Threat Modeling with a Developer-Centric Approach
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 116+117
How can we make threat modeling scalable, actionable, and accessible for all stakeholders?

Traditional threat modeling methodologies struggle to scale in agile environments. They often result in over-scoped, resource-heavy processes that lack actionable insights and rely on scarce security expertise, limiting adoption in large organizations.

This talk introduces Rapid Developer-Driven Threat Modeling (RaD-TM), a lightweight, tool-agnostic approach designed for developers to embed threat modeling into the SDLC without relying on security experts. RaD-TM focuses on targeted assessments of specific functionalities rather than application-wide models, enabling iterative and efficient risk mitigation.
Using Risk Templates, which are predefined collections of relevant risks and controls tailored to specific contexts, RaD-TM fosters collaboration among stakeholders to build a scalable threat modeling process. This session will offer real-world examples and step-by-step guidance on integrating RaD-TM into the development workflow.
Speakers
avatar for Andrew Hainault

Andrew Hainault

Managing Director, Aon Cyber Solutions
Andrew has over 25 years’ experience working in Information Security, Information Technology and Software Engineering, for public and private sector organisations in many sectors - including financial services / fintech, energy utilities, media, entertainment and insurance. With... Read More →
avatar for Andrea Scaduto

Andrea Scaduto

Secure coding, threat modeling, and ethical hacking
With a strong foundation in cybersecurity, Andrea holds an MSc in Computer Engineering, multiple IT Security certifications, and more than a decade of industry experience. His expertise spans breaking, building, and securing web, mobile, and cloud applications, with extensive knowledge... Read More →
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

1:15pm CEST

Signing is Sassy, but CI/CD Security Pays the Bills
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 114
This talk is primarily aimed at AppSec practitioners, DevOps & SecOps Engineers as well as Makers and Breakers. If this is not you but you have a professional interest in CI/CD and Security then we’d love you to join us.

Modern software development practices rely entirely on CI/CD systems to deliver change at scale and speed. These systems are highly privileged environments with many actors and entities ( internal, external, human, machine ), and known attack vectors. The risk of compromise is severe because attacks can easily go undetected for extended dwell times resulting in an exponential blast radius. Just ask SolarWinds.

Now that we’ve set the scene it’s time to buckle up because we’re going to share what we’ve learnt, what can be done and what is the art of the possible. And what might the future look like.

This talk will focus on what good security looks like for CI/CD systems and lessons from the field. Spoiler: It’s challenging at scale because security solutions aren’t keeping pace. We will talk about our journey navigating complex CI/CD setups, where we recognise ways these systems can be exploited, and propose ways to tackle with some of the challenges. We’ll also see how signing could get us closer to securing the DevOps environment.

We’ll talk about the need to balance security with engineering imperatives. Enhancing your security posture is an investment that draws down on precious engineering resource, acting as a drag on productivity and cadence. Therefore, expect engineering functions to challenge it, hard and rightly so. Being able to influence key stakeholders so that they are onboard and committed is a must – we’ll show you how we approach this.

This talk will help you prepare for those tough conversations. At the end of the talk we want you to understand how to build a business case for CI/CD Security adoption in your organisation including how to implement in your workplace. The starting point is knowing how much risk your organisation’s build environment is exposed to and how much is tolerable.
Speakers
avatar for Patricia R.

Patricia R.

Root
Automation, innovation and correctness. Three principles constantly on my mind.Working in security consultancy and engineering, endeavoring in exciting projects. Strive to deliver impact and change in the realms of cloud (security), identity and architecture. @ytimyno linkedin.co... Read More →
avatar for Chris Snowden

Chris Snowden

Enterprise Security Architect
Accidental Application Security Architect! Software Engineer by trade. linkedin.com/in/csn0wden/
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 114
  Breakout: Defender Track

1:15pm CEST

Scale Security Programs with Scorecarding
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 115
Security teams increasingly take a collaborative, partnership-based approach to securing their applications and organizations. Scaling these efforts requires thoughtfully distributing awareness and ownership of security risk. Scorecarding is used at leading companies to make security posture visible, actionable, and engaging across the entire organization.

In this session, we’ll dive into how companies like Netflix, Chime, GitHub, and DigitalOcean use scorecarding to distribute security ownership, drive continuous improvement, and align risk management with business goals. You’ll walk away with practical, tool-agnostic strategies for implementing your own scorecarding program that not only enhances security posture but fosters a culture of shared responsibility and proactive risk management.
Speakers
avatar for Rami McCarthy

Rami McCarthy

Principal Security Researcher, Wiz
Rami is a practitioner with expertise in cloud security and building impactful security programs for startups and high-growth companies. In past roles, he helped build the Infrastructure Security program at Figma and scale security at Cedar, a health-tech unicorn. Rami regularly blogs... Read More →
Friday May 30, 2025 1:15pm - 2:00pm CEST
Room 115
  Breakout: Manager/Culture Track

1:15pm CEST

OWASP ASVS Nuclei
Friday May 30, 2025 1:15pm - 2:15pm CEST
Room 133-134
Tired of the slow, manual grind of ASVS assessments? This live demo introduces the OWASP ASVS Security Evaluation Templates—an open-source toolkit built on Nuclei to streamline and scale your web application security testing.

Designed for security practitioners, this session walks through real-world use cases, showing how to plug these templates into your existing workflows for faster, more accurate ASVS evaluations. We’ll cover customization, integration, and key considerations for operationalizing the templates—plus, how you can contribute back to the project.

Whether you’re looking to boost testing efficiency or reduce human error, this session gives you the tools to level up your appsec approach in a fraction of the time.
Speakers
avatar for AmirHossein Raeisi

AmirHossein Raeisi

Application Security Engineer
avatar for Hamed Salimian

Hamed Salimian

Cybersecurity Auditor, OWASP Project Lead
Experienced cybersecurity auditor and penetration tester with a proven track record in securing systems for banking and industrial organizations. Adept at identifying vulnerabilities, ensuring compliance, and implementing robust security solutions. Proficient programmer with expertise... Read More →
Friday May 30, 2025 1:15pm - 2:15pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

1:15pm CEST

OWASP DefectDojo
Friday May 30, 2025 1:15pm - 2:15pm CEST
Room 133-134
Speakers
avatar for Matt Tesauro

Matt Tesauro

Distinguished Engineer, Founder and AppSec guru, Noname Security
Matt Tesauro is a DevSecOps and AppSec guru with specialization in creating security programs, leveraging automation to maximize team velocity and training emerging and senior professionals. When not writing automation code in Go, Matt is pushing for DevSecOps everywhere via his involvement... Read More →
Friday May 30, 2025 1:15pm - 2:15pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

1:45pm CEST

OWASP Top 10 for Business Logic Abuse
Friday May 30, 2025 1:45pm - 2:15pm CEST
Room 131-132
How often have you heard developers ask, "Where is Race Condition in OWASP?" or "Why aren’t business workflows part of the Top 10?"

These questions highlight a glaring gap: the OWASP lists often focus on technical implementation vulnerabilities while overlooking the fundamental flaws in business logic—the very backbone of applications. This is why we started the OWASP Business Logic Abuse Top 10 Project: to address the workflow bypasses, logic flaws, and design vulnerabilities that attackers exploit, regardless of whether you’re building a web app, API, firmware, or supply chain system.

This project's foundation in Turing machine principles makes it unique, where business logic is modeled as finite states, transitions, and memory operations. By breaking down vulnerabilities into their computational roots—data handling (tape), access mechanisms (head), workflows (states), and transitions—we not only classify these issues but also provide a clear framework for identifying and mitigating them. Whether it’s race conditions in financial systems or workflow skips in authentication processes, this approach brings business logic vulnerabilities to the forefront.

This Top 10 isn’t just another list; it’s a cross-domain framework that bridges gaps between OWASP categories and provides clarity for developers, architects, and security professionals. If you’ve ever wondered why logic abuse isn’t explicitly addressed in web apps, APIs, or mobile security, this project is your answer. Join us to explore real-world examples, understand the unique methodology, and discover how you can contribute to this open, repeatable framework that empowers teams to tame business logic abuse in any system.
Speakers
avatar for Ivan Novikov

Ivan Novikov

Wallarm
Ivan Novikov is the CEO and co-founder of Wallarm and an "ethical hacker" security professional with over 12 years of experience in security services and products. He is an inventor of memcached injection and SSRF exploit class (as well as author of the SSRF bible), and the recipient... Read More →
Friday May 30, 2025 1:45pm - 2:15pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

2:15pm CEST

OWASP Security Champions Guide Project
Friday May 30, 2025 2:15pm - 2:45pm CEST
Room 131-132
OWASP Security Champions Guide Project was started to create an open-source, vendor-neutral guidebook for Application Security professionals to help them build and improve their own successful Security Champion programs.

In this talk, Aleksandra will describe the main elements of the project and will guide you through the key principles of a successful Security Champions Program.

Regarding Security Champions programs, one size will not fit all – and as such our Project allows managers, security professionals or team leaders to pick and choose the elements their organization can adopt or leverage to create their own customized program.

Our Project team interviewed security leaders, program coordinators, and security champions to establish what makes a successful program. Participants represent a range of company sizes, industries, geographies, and also different levels of security program maturity. We want to know what works, what doesn’t work, what promotes success, and what leads to failure.

The principles have been drawn from an initial series of in-depth interviews with Application Security leaders from across the globe as part of our wider goal to provide a comprehensive Security Champions playbook.

The Ten Key Principles of a Successful Security Champions Program:
1. Be passionate about security
2. Start with a clear vision for your program
3. Secure management support
4. Nominate a dedicated captain
5. Trust your champions
6. Create a community
7. Promote knowledge sharing
8. Reward responsibility
9. Invest in your champions
10. Anticipate personnel changes

More about the Project:
- Existing Project webpage: https://owasp.org/www-project-security-champions-guidebook/
- New Project webpage: https://securitychampions.owasp.org/
Speakers
avatar for Aleksandra Kornecka

Aleksandra Kornecka

Security Engineer
Aleksandra is a security engineer with a global citizen mindset, unafraid to explore diverse destinations—both mentally and geographically. With a background in software testing and cognitive science, she brings a unique blend of technical and soft skills to the table.As a member... Read More →
Friday May 30, 2025 2:15pm - 2:45pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

2:15pm CEST

Compromised at the Source: Supply Chain Risks in Open-Source AI
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 113
Step into the shadowy world of AI tools and ask yourself: How secure are they? This session dives deep into the architecture of AI models, exposing their most vulnerable points. Moreover, you will learn how malicious actors can weaponize AI, turning powerful tools into threats based on an example of a ‘Malicious Copilot’ IDE plugin. It will reveal how a code-completion model can be trained to embed harmful behavior, target victims, and execute attacks. Finally, you will take home actionable strategies for organizations leveraging generative AI and LLMs, ensuring security isn’t left to chance.
Speakers
avatar for Tal Folkman

Tal Folkman

Security Research Team Lead, Checkmarx
Tal brings over 8 years of experience to her role as a supply chain security research team lead within Checkmarx Supply Chain Security group. She is in charge of detecting tracking and stopping Opensource attacks. linkedin.com/in/tal-folkman/ medium.com/@tal.folk... (blog... Read More →
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 113
  Breakout: Breaker Track

2:15pm CEST

Transaction authorization pitfalls – How to improve current financial, payment, and e-commerce apps?
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 116+117
During my career, I've had the opportunity to work with many financial institutions, payment processors, fintechs, and e-commerce operators. In recent years, the threat landscape for internet payments has changed significantly, since our smartphone has become the center of our digital life, financial transactions, and digital identity. Such concentration of power in a single asset has poor influence on overall security.

In my presentation, I will explore this dynamic threat landscape, show real-life vulnerabilities and threats, and discuss possible solutions to protect customers' funds. Additionally, I will examine the role of regulatory compliance in solving issues related to online payments.

My presentation will be divided into three parts.

In the first part of my presentation, I will show real-life threats and vulnerabilities affecting current transaction authorization processes, including technical and logical ones. I will present case studies of attacks that caused my relatives and friends to lose their money.

In the second part, I will discuss possible safeguards to raise the bar for attackers without compromising usability on many levels of user interaction:
- banking apps and systems, payments, fintechs
- e-commerce apps, social media apps, telecom operators
I will also demonstrate how developers, blue teams, and threat intelligence experts can cooperate to detect financial fraud at the application level and protect customers' funds.

In the third part, I will discuss whether current and upcoming financial sector regulations, such as DORA, PSD3, and PSR, address transaction authorization problems. I will also explore whether we as the IT security community can do more than just follow compliance rules.
Speakers
avatar for Wojciech Dworakowski

Wojciech Dworakowski

OWASP Poland Chapter Co-leader, Managing Partner, SecuRing
An IT Security Consultant with over 20 years of experience in the field. A Managing Partner at SecuRing. He has led multiple security assessments and penetration tests especially for financial services, payment systems, SaaS, and startups. A lecturer at many security conferences... Read More →
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

2:15pm CEST

GenAI Security - Insights and Current Gaps in OS LLM Vulnerability scanners and Guardrails
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 114
As Large Language Models (LLMs) become integral to various applications, securing them against evolving threats—such as **information leakage, jailbreak attacks, and prompt injection—**remains a critical challenge. This presentation provides a comparative analysis of open-source vulnerability scanners—Garak, Giskard, PyRIT, and CyberSecEval—that leverage red-teaming methodologies to uncover these risks. We explore their capabilities, limitations, and design principles, while conducting quantitative evaluations that expose key gaps in their ability to reliably detect attacks.

However, vulnerability detection alone is not enough. Proactive security measures, such as AI guardrails, are essential to mitigating real-world threats. We will discuss how guardrail mechanisms—including **input/output filtering, policy enforcement, and real-time anomaly detection—**can complement scanner-based assessments to create a holistic security approach for LLM deployments. Additionally, we present a preliminary labeled dataset, aimed at improving scanner effectiveness and enabling more robust guardrail implementations.

Beyond these tools, we will share our experience in developing a comprehensive GenAI security framework at Fujitsu, designed to integrate both scanning and guardrail solutions within an enterprise AI security strategy. This framework emphasizes multi-layered protection, balancing LLM risk assessments, red-teaming methodologies, and runtime defenses to proactively mitigate emerging threats.

Finally, based on our findings, we will provide strategic recommendations for organizations looking to enhance their LLM security posture, including:

Selecting the right scanners for red-teaming and vulnerability assessments
Implementing guardrails to ensure real-time policy enforcement and risk mitigation
Adopting a structured framework for securing GenAI systems at scale
This session aims to bridge theory and practice, equipping security professionals with actionable insights to fortify LLM deployments in real-world environments.
Speakers
avatar for Roman Vainshtein

Roman Vainshtein

Head of the GenAI Trust, Fujitsu Research of Europe
I am the Head of the Generative AI Trust and Security Research team at Fujitsu Research of Europe, where I lead efforts to enhance the security, trustworthiness, and resilience of Generative AI systems. My work focuses on bridging the gap between AI security, red-teaming methodologies... Read More →
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 114
  Breakout: Defender Track

2:15pm CEST

Metrics That Matter: Driving AppSec Success with Data-Driven Insights
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 115
“What gets measured, gets managed” is perhaps an over-simplification, but the quote has its merits. In terms of building an effective application security Program, measurement and metrics go a long way, and by collecting, observing, and presenting actionable AppSec metrics, you can bridge the gap between Security Engineering and leadership’s strategic priorities.

In this session, we will start by speaking about different types of metrics, both qualitative and quantitative, and how these metrics can be categorised to align better with frameworks defining application security Metrics as a required control.
From there, we will start to look at what metrics we should use and how they can be visualised. By visualising these metrics, we can come to conclusions around whether or not the application security program is effective and what we should do to drive improvement.

Last, but not least, we’ll talk about how the data and visualisations can support us in our communication with leadership by supporting our requests and recommendations based on data and looking at trends.

In many areas of life—application security included—what gets measured can be proven, and what gets proven can be improved.
Speakers
avatar for David Andersson

David Andersson

Senior Engineering Manager, Grafana Labs
David Andersson is an information security professional with 20 years experience from both private companies and government agencies. He is a senior engineering manager at Grafana Labs, responsible for the Security Engineering team and specialises in building a strong application... Read More →
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 115
  Breakout: Manager/Culture Track

2:15pm CEST

Let's Play! OWASP Cumulus
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 133-134
Join us for an engaging session where we'll demonstrate OWASP Cumulus, a card game tailored for threat modeling the Ops of DevOps. Dive into a cloud scenario with us and uncover potential threats while having fun.

Let's play and explore the intricacies of DevOps security together!
Speakers
avatar for Christoph Niehoff

Christoph Niehoff

Senior Consultant, TNG Technology Consulting
In his role as a Senior Consultant at TNG Technology Consulting, Christoph Niehoff develops software products for his clients on a daily basis. As a full-stack developer, he lives and breathes DevOps, overseeing all steps of the development cycle. The security of the products is particularly... Read More →
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

2:15pm CEST

OWASP Juice Shop Demo: Your vitamin shot for security awareness & education
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 133-134
In this 100% slide-free demo session you will embark on a journey through the popular OWASP Juice Shop vulnerable web application!

You will experience firsthand how easy it is to set up, get started, and solve your first hacking & coding challenges. In a quick mob-hacking session, you will gain your first points on Juice Shop's extensive score board!

The demo also includes a glimpse into Juice Shop's CTF tool and its multi-user hosting environment MultiJuicer! You will witness how fast a CTF event can be launched with OWASP Juice Shop, how great documentation really makes a difference, and even how to make
the application look like an in-house app of your own company.

Due to the nature of this small group demo session, you are welcome to ask questions during and between the different topics - ad libitum! There is time for clarification and dipping into special topics.

If time permits, this session can also cover interesting behind-the-scenes topics, such as cheat detection, start-up validations, webhook integrations, and a pro-level Grafana dashboard for observability!

Even if you know and have used OWASP Juice Shop yourself already,
there's no chance you've already seen everything that will be covered in this session!
Speakers
avatar for Björn Kimminich

Björn Kimminich

Product Group Lead, Kuehne+Nagel
Bjoern Kimminich works as Product Group Lead Application Ecosystem at Kuehne + Nagel, responsible – among other things – for the Application Security program in the corporate IT. He is an OWASP Lifetime Member, the project leader of the OWASP Juice Shop, and a co-chapter leader... Read More →
Friday May 30, 2025 2:15pm - 3:00pm CEST
Room 133-134
  Breakout: OWASP Project Demo Lab, Demo

2:45pm CEST

OWASP Top 10 for CI/CD Security: Evolution Since the Top 10 Project’s Inception
Friday May 30, 2025 2:45pm - 3:15pm CEST
Room 131-132
The OWASP Top 10 CI/CD Security Risks Project has been a cornerstone for securing CI/CD environments since its inception three years ago. This talk will explore how the CI/CD security landscape has evolved during this time, with a primary focus on the most significant developments over the past year. By revisiting the project’s original risks and comparing them to recent threats, including new breaches and innovative attack techniques, we will highlight how the field has adapted to a rapidly changing environment. Attendees will gain a comprehensive understanding of the progress made since the project’s release and actionable insights to fortify their pipelines against emerging risks.
Speakers
avatar for Omer Gil

Omer Gil

Senior Research Manager & Co-Author of the "OWASP Top 10 CI/CD Security Risks", Palo Alto Networks
Omer is an application and cloud security expert with 15 years of experience across multiple security disciplines. An experienced researcher and public speaker, Omer discovered the Web Cache Deception attack vector in 2017, co-authored the "OWASP Top 10 CI/CD Security Risks" project... Read More →
Friday May 30, 2025 2:45pm - 3:15pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

3:00pm CEST

PM Break with Exhibitors
Friday May 30, 2025 3:00pm - 3:30pm CEST
Area 1
Meals provided by OWASP
Friday May 30, 2025 3:00pm - 3:30pm CEST
Area 1
  Meals provided by OWASP

3:30pm CEST

When Regulation Backfires: How a Vulnerable Plugin Led to an XSS Pandemic
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 113
What began as a simple WAF bypass challenge on a single website turned into the discovery of a vulnerability affecting thousands of organizations. Join us in the journey of how an accessibility plugin, mandated by regulation, became the perfect vehicle for a widespread XSS vulnerability. We’ll explore the real-world impact of compromised sensitive systems, from government and military to healthcare and finance, showing how a single regulatory requirement led to an ecosystem-wide security breach.

We’ll also analyze the plugin’s source code to understand how and why this XSS vulnerability occurs, along with a behavior analysis that suggests the plugin may also be tracking users without consent, indicating potential malicious intent. Additionally, we’ll share the methodology and tools used to uncover and validate these vulnerabilities at scale.
Speakers
avatar for Eilon Cohen

Eilon Cohen

Security Analyst, Checkmarx Research
That kid who took apart all his toys to see how they worked.Currently breaking (and fixing) things in the Research group at Checkmarx. Educational spans from Mechanical Engineering and Robotics to Computer science, but a self-made security personnel. Ex-IBM as a security engineer... Read More →
avatar for Ori Ron

Ori Ron

Senior AppSec Researcher, Checkmarx
Ori Ron is a Senior Application Security Researcher at Checkmarx with over 8 years of experience. He works to find and help fix security vulnerabilities and enjoys sharing security knowledge through talks and write-ups. linkedin.com/in/ori-ron-40099912b/ checkmarx.com/author/or... Read More →
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 113
  Breakout: Breaker Track

3:30pm CEST

LLM-Powered private Threat Modeling
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 116+117
In this session, we'll explore the development of an in-house threat modeling assistant that leverages Large Language Models through AWS Bedrock and Anthropic Claude. Learn how we're building a private solution that automates and streamlines the threat modeling process while keeping sensitive security data within our control. We'll demonstrate how this proof-of-concept tool combines LangChain and Streamlit to create an interactive threat modeling experience. Join us to see how modern AI technologies can enhance security analysis while maintaining data privacy.
Speakers
avatar for Murat Zhumagali

Murat Zhumagali

Principal Security Engineer, Progress ShareFile
Master in CS from University of Southern California 2013 - 2016Security intern at IBM summer 2016Security engineer at IBM 2017 - 2021Senior Security engineer at Fiddler AI 2021 - 2023Lead Security engineer at Jukebox 2023 - 2024Principal Security engineer at Progress ShareFile 2024... Read More →
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 116+117 CCIB
  Breakout: Builder Track

3:30pm CEST

Know Thy Judge: Uncovering Vulnerabilities of AI Evaluators
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 114
Current methods for evaluating the safety of Large Language Models (LLMs) risk creating a false sense of security. Organizations deploying generative AI often rely on automated “judges” to detect safety violations like jailbreak attacks, as scaling evaluations with human experts is impractical. These judges—typically built with LLMs—underpin key safety processes such as offline benchmarking and automated red-teaming, as well as online guardrails designed to minimize risks from attacks. However, this raises a crucial question of meta-evaluation: can we trust the evaluations provided by these evaluators?

In this talk, we examine how popular LLM-as-judge systems were initially evaluated—typically using narrow datasets, constrained attack scenarios, and limited human validation—and why these approaches can fall short. We highlight two critical challenges: (i) evaluations in the wild, where factors like prompt sensitivity and distribution shifts can affect performance, and (ii) adversarial attacks that target the judges themselves. Through practical examples, we demonstrate how minor changes in data or attack strategies that do not affect the underlying safety nature of the model outputs can significantly reduce a judge’s ability to assess jailbreak success.

Our aim is to underscore the need for rigorous threat modeling and clearer applicability domains for LLM-as-judge systems. Without these measures, low attack success rates may not reliably indicate robust safety, leaving deployed models vulnerable to unseen risks.
Speakers
avatar for Francisco Girbal Eiras

Francisco Girbal Eiras

Machine Learning Research Scientist, DynamoAI
Francisco is an ML Research Scientist at Dynamo AI, a leading startup building enterprise solutions that enable private, secure, and compliant generative AI systems. He earned his PhD in trustworthy machine learning from the University of Oxford as part of the Autonomous Intelligent... Read More →
avatar for Eliott Zemour

Eliott Zemour

Senior ML Research Engineer, Dynamo AI
linkedin.com/in/eliott-zemour/
DR

Dan Ross

Head of AI Compliance Strategy, Dynamo AI
Dan Ross, Head of AI Compliance Strategy at Dynamo AI, focuses on aligning artificial intelligence, policy, risk and security management, and business application. Prior to Dynamo, Dan spent close to a decade at Promontory Financial Group, a premier risk and regulatory advisory firm... Read More →
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 114
  Breakout: Defender Track

3:30pm CEST

An AppSec Tale: From Zero to Champions
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 115
Listen in on how a big energy company from Norway runs a Security Champion Network with 250+ members! Ever wondered about the struggles of managing a 3-year-old network?

This light-hearted talk will give you context on:
- What the AppSec team does in Equinor.
- How our Security Champion program is structured.
- What we've learned so far.
- What challenges we've faced and how we have tried to solve them.
- Our gamification strategy.
- Key take-aways.

You will (hopefully) gain inspiration to bring home on how to run or improve your own Security Champion Network.
Speakers
avatar for Even Tillerli

Even Tillerli

Application Security, Equinor
Developer gone AppSec. He found security could be fun and went with it.no.linkedin.com/in/even-tillerli-b38bab8bonlydev.art (Development art... Read More →
avatar for Nicole Silva

Nicole Silva

Application Security Engineer, Equinor
Nicole comes from Portugal, she started out as a Full Stack Developer, but a growing interest for cybersecurity led her to Equinor where she is part of the AppSec team.   no.linkedin.com/in/nicole-silva-b614b41bb... Read More →
Friday May 30, 2025 3:30pm - 4:15pm CEST
Room 115
  Breakout: Manager/Culture Track

3:35pm CEST

OWASP DefectDojo - What's next?
Friday May 30, 2025 3:35pm - 4:05pm CEST
Room 131-132
As OWASP DefectDojo continues to grow and thrive, what are the most recent developments and what new challenges are ahead for the project. This project showcase talk will review the current state of the project highlighting some exciting developments including the new documentation site and documentation writer to make using DefectDojo even easier. Get caught up in the best DefectDojo has to offer and what to expect in the rest of 2025.
Speakers
avatar for Matt Tesauro

Matt Tesauro

Distinguished Engineer, Founder and AppSec guru, Noname Security
Matt Tesauro is a DevSecOps and AppSec guru with specialization in creating security programs, leveraging automation to maximize team velocity and training emerging and senior professionals. When not writing automation code in Go, Matt is pushing for DevSecOps everywhere via his involvement... Read More →
Friday May 30, 2025 3:35pm - 4:05pm CEST
Room 131-132
  Breakout: OWASP Project Showcase Track, Lightning Talk

4:30pm CEST

Closing Ceremony and Raffle
Friday May 30, 2025 4:30pm - 5:30pm CEST
Room 116+117
Come wrap up the conference with us, hear special annoucements, and win prizes!
Friday May 30, 2025 4:30pm - 5:30pm CEST
Room 116+117 CCIB
  BONUS TRACK
 
Share Modal

Share this link via

Or copy link

Filter sessions
Apply filters to sessions.
Monday, May 26
Tuesday, May 27
Wednesday, May 28
Thursday, May 29
Friday, May 30
-
Area 1
Purobeach Barcelona Rooftop Bar - Located in the Hilton
Room 111
Room 113
Room 114
Room 115
Room 116+117
Room 118
Room 119
Room 120
Room 121
Room 122
Room 123
Room 124
Room 125
Room 127
Room 129
Room 130
Room 131-132
Room 133-134
Room 212
Room M211-212
Room M213-M214
Room M215 - M216
  • 1-Day Training
  • 2-Day Training
  • 3-Day Training
  • BONUS TRACK
  • Breakout: Breaker Track
  • Breakout: Builder Track
  • Breakout: Defender Track
  • Breakout: Manager/Culture Track
  • Breakout: OWASP Project Demo Lab
  • Breakout: OWASP Project Showcase Track
  • Closed Meeting
  • Exhibitor Networking Events & Receptions
  • Hackathon
  • Keynote
  • Meals provided by OWASP
  • Meeting
  • Speakers Only
  • User Day
  • Company
  • Wallarm
  • Audience
  • Advanced
  • Beginner
  • Intermediate
  • Overview
  • Subject
  • CTF
  • OWASP Project