OWASP 2025 Global AppSec EU

OWASP 2025 Global AppSec EU

8:00am CEST

9:00am CEST

3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training Room 119Sebastien Deleersnyder 3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access Room 118Dawid Czagan 3-Day Training: The Mobile Playbook - A guide for iOS and Android App SecuritySven Schleier

10:30am CEST

12:30pm CEST

3:00pm CEST

8:00am CEST

Coffee/Tea Area 1

9:00am CEST

2-Day Training: Adam Shostack's Threat Modeling IntensiveAdam Shostack 2-Day Training: Application Security Training with Jim ManicoJim Manico 2-Day Training: AppSec Automation MasterclassAbhay Bhargav 2-Day Training: Building a High-Value App Scanning Programme (2025 Update)Josh Grossman 2-Day Training: Hacking Modern Web Apps: Master the Future of Attack VectorsAbraham Aranguren 2-Day Training: Practical Privacy by Design - Going Beyond Security in your SDLCAvi Douglen • Dr. Kim Wuyts 3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training Room 119Sebastien Deleersnyder 3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access Room 118Dawid Czagan 3-Day Training: The Mobile Playbook - A guide for iOS and Android App SecuritySven Schleier Global Board of Directors Private/Closed Face to Face Meeting

10:30am CEST

12:30pm CEST

3:00pm CEST

8:00am CEST

Coffee/Tea Area 1

9:00am CEST

1-Day Training: Master AI securityRob van der Veer 1-Day Training:How to build a Successful Security Champions ProgramMarisa Fagan • Juliane Reimann 2-Day Training: Adam Shostack's Threat Modeling IntensiveAdam Shostack 2-Day Training: Application Security Training with Jim ManicoJim Manico 2-Day Training: AppSec Automation MasterclassAbhay Bhargav 2-Day Training: Building a High-Value App Scanning Programme (2025 Update)Josh Grossman 2-Day Training: Hacking Modern Web Apps: Master the Future of Attack VectorsAbraham Aranguren 2-Day Training: Practical Privacy by Design - Going Beyond Security in your SDLCDr. Kim Wuyts • Avi Douglen 3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training Room 119Sebastien Deleersnyder 3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access Room 118Dawid Czagan 3-Day Training: The Mobile Playbook - A guide for iOS and Android App SecuritySven Schleier 1-Day: SAMM User DaySebastien Deleersnyder Global Board of Directors Private/Closed Face to Face Meeting

10:30am CEST

12:30pm CEST

3:00pm CEST

5:30pm CEST

Global Board of Directors Public Board Meeting

7:30pm CEST

Women in AppSec Reception (registration required)

9:00am CEST

Keynote:Nemo Resideo: Managing application security through rapid change Room 116+117Sarah-Jane Madden

10:00am CEST

AM Break with Exhibitors Area 1 Career Fair

10:30am CEST

OWASP LCNC Securing the Future: AI Meets Low-Code, the New Security Frontier! Room 131-132Ziv Hagbi CfP/CfTs for the Newcomer: How To Write A Good Submission Room 118Izar Tarandach • Avi Douglen Demystifying & remystifying embedded systems securityJarmo Lahtiranta The Edge Strikes Back: Challenging OWASP's Take on Edge-Level Authorization Room 116+117Dimitrij Drus False Positives, Begone! Harnessing AI for Efficient SAST TriageElliot Ward Human Buffer Overflow: How to Deal with Cognitive Load in High-Performing Teams TBAJuliane Reimann

10:45am CEST

OWASP Honeypot Hands-On Demo Room 133-134

11:00am CEST

Introducing Sunshine, the all new SBOM visualization tool by OWASP CycloneDX Room 131-132Luca Capacci • Mattia Fierro OWASP Juice Shop Demo: Your vitamin shot for security awareness & education Room 133-134 OWASP Sunshine for CycloneDX Visualization Demo Room 133-134

11:30am CEST

OWASP Threat Library Room 131-132 Hacking Your Enterprise Copilot: A Direct Guide to Indirect Prompt InjectionsTamir Ishay Sharbat Securing cross-platform mobile applications Room 116+117Jeroen Beckers Emerging Frontiers: Ransomware Attacks in AI SystemsBehnaz Karimi • Yuvaraj Govindarajulu Your Security Dashboard Is Lying to You: The Science of Metrics TBAAram Hovsepyan

1:15pm CEST

OWASP Nettacker Room 131-132 Beyond the Surface: Exploring Attacker Persistence Strategies in KubernetesRory McCune Mastering Security through Simple Machines: How Consistency, Not Complexity, Drives Innovation Room 116+117Ken Toler From Prompt to Protect: LLMs as Next-Gen WAF'sJuan Berner Against all odds: Kickstarting your Product Security Program when things are not in your favour TBAMichael Helwig OWASP Cornucopia Room 133-134 OWASP DefectDojo Demo Room 133-134 Meet the Mentor Room 118

1:45pm CEST

OWASP MAS/MASTG/MASWE Room 131-132

2:15pm CEST

OWASP Cumulus Room 131-132 Builders and Breakers: A Collaborative Look at Securing LLM-Integrated AppsJavan Rasokat • Rico Komenda Friend or Foe? TypeScript Security Fallacies Room 116+117Liran Tal Living the SBOM life - the good, the bad and the evil partsOlle E. Johansson • Anthony Harrison Beyond Best Practices: Uncovering the Organizational Roots of Software Security Vulnerabilities TBATomer Gershoni OWASP GenAI Security Project Room 133-134

2:45pm CEST

OWASP Coraza Room 131-132

3:00pm CEST

PM Break with Exhibitors Area 1

3:30pm CEST

To BI or Not to BI? Data Leakage Tragedies with Power BI ReportsUriya Elkayam Policy as Code for Applications at Scale Room 116+117Magnus Jungsbluth Current challenges of GraphQL securityAntoine Carossio • Tristan Kalos Kaizen for your appsec program: Turning big problems into small steps TBADag Flachet OWASP SAMM Demo Room 133-134

3:35pm CEST

OWASP Domain Project Room 131-132

4:30pm CEST

Networking Reception Area 1

8:00am CEST

Coffee/Tea Area 1

9:00am CEST

Keynote: Outside the Ivory Tower: Connecting Practice and Science Room 116+117Kate Labunets

10:00am CEST

AM Break with Exhibitors Area 1 Bob the Breaker CTF - The Reunion. The No-code/Low-code Hacking Saga Continues. Room 118NoKod Security • NoKod Security

10:30am CEST

OWASP Core Rule Set Room 131-132 Doors of (AI)pportunity: The Front and Backdoors of LLMs TBAKasimir Schulz • Kenneth Yeung A completely pluggable DevSecOps programme, for free, using community resources Room 116+117Spyros Gasteratos Think Before You Prompt: Securing Large Language Models from a Code PerspectiveYaron Avital • Tomer Segev LLMs vs. SAST: How AI Delivers Accurate Vulnerability Detection and Reduces False PositivesJonathan Santilli • Kirill Efimov

11:00am CEST

OWASP ModSecurity Room 131-132

11:30am CEST

Navigating Agentic AI Security Risks: OWASP’s GenAI Guidance for Securing Autonomous AI Agents Room 131-132John Sotiropoulos OWASP GenAI Agentic Initative Room 131-132 Restless Guests: From Subscription to Backdoor Intruder TBASimon Maxwell-Stewart Introducing the 5.0 release of the ASVS Room 116+117Elar Lang Surviving prioritisation when CVE stands for “Customer Very Enthusiastic"Irene Michlin Security Champion Worst PracticesTanya Janca

1:15pm CEST

OWASP Cornucopia Room 131-132 Abusing misconfigurations in CI/CD to hijack apps and clouds TBAHåkon Nikolai Stange Sørum • Karim El-Melhaoui Scaling Threat Modeling with a Developer-Centric Approach Room 116+117Andrew Hainault • Andrea Scaduto Signing is Sassy, but CI/CD Security Pays the BillsPatricia R. • Chris Snowden Scale Security Programs with ScorecardingRami McCarthy

1:45pm CEST

OWASP Top 10 for Business Logic Abuse Room 131-132

2:15pm CEST

OWASP Top 10 for non-Human Identities Room 131-132 Compromised at the Source: Supply Chain Risks in Open-Source AI TBATal Folkman Transaction authorization pitfalls – How to improve current financial, payment, and e-commerce apps? Room 116+117Wojciech Dworakowski GenAI Security - Insights and Current Gaps in OS LLM Vulnerability scanners and GuardrailsRoman Vainshtein Metrics That Matter: Driving AppSec Success with Data-Driven InsightsDavid Andersson

2:45pm CEST

OWASP Top 10 for CI/CD Room 131-132

3:00pm CEST

PM Break with Exhibitors Area 1

3:30pm CEST

When Regulation Backfires: How a Vulnerable Plugin Led to an XSS Pandemic TBAEilon Cohen • Ori Ron LLM-Powered private Threat Modeling Room 116+117Murat Zhumagali An AppSec Tale: From Zero to ChampionsEven Tillerli • Nicole Silva

4:30pm CEST

Closing Ceremony and Raffle Room 116+117