OWASP 2025 Global AppSec EU

OWASP 2025 Global AppSec EU

8:15am CEST

Coffee/Tea Registration

9:00am CEST

3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training Room 119Sebastien Deleersnyder 3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access Room 118Dawid Czagan 3-Day Training: The Mobile Playbook - A guide for iOS and Android App Security Room 120Sven Schleier

10:30am CEST

12:30pm CEST

3:00pm CEST

8:15am CEST

Coffee/Tea Registration

9:00am CEST

2-Day Training: Adam Shostack's Threat Modeling Intensive Room 121Adam Shostack 2-Day Training: Application Security Training with Jim Manico Room 122Jim Manico 2-Day Training: AppSec Automation Masterclass Room 124Abhay Bhargav 2-Day Training: Building a High-Value App Scanning Programme (2025 Update) Room 123Josh Grossman 2-Day Training: Hacking Modern Web Apps: Master the Future of Attack Vectors Room 127Abraham Aranguren 2-Day Training: Practical Privacy by Design - Going Beyond Security in your SDLC Room 125Avi Douglen • Dr. Kim Wuyts 3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training Room 119Sebastien Deleersnyder 3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access Room 118Dawid Czagan 3-Day Training: The Mobile Playbook - A guide for iOS and Android App Security Room 120Sven Schleier Global Board of Directors Private/Closed Face to Face Meeting

10:30am CEST

12:30pm CEST

3:00pm CEST

8:15am CEST

Coffee/Tea - Registration

9:00am CEST

1-Day Training: Master AI security Room 129Rob van der Veer 1-Day Training:How to build a Successful Security Champions Program Room 130Marisa Fagan • Juliane Reimann 2-Day Training: Adam Shostack's Threat Modeling Intensive Room 121Adam Shostack 2-Day Training: Application Security Training with Jim Manico Room 122Jim Manico 2-Day Training: AppSec Automation Masterclass Room 124Abhay Bhargav 2-Day Training: Building a High-Value App Scanning Programme (2025 Update) Room 123Josh Grossman 2-Day Training: Hacking Modern Web Apps: Master the Future of Attack Vectors Room 127Abraham Aranguren 2-Day Training: Practical Privacy by Design - Going Beyond Security in your SDLC Room 125Dr. Kim Wuyts • Avi Douglen 3-Day Training: AI Whiteboard Hacking aka Hands-on Threat Modeling Training Room 119Sebastien Deleersnyder 3-Day Training: Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access Room 118Dawid Czagan 3-Day Training: The Mobile Playbook - A guide for iOS and Android App Security Room 120Sven Schleier Global Board of Directors Private/Closed Face to Face Meeting SAMM User Day Room M211-212Sebastien Deleersnyder OWASP CycloneDX Hackathon with Transparency Exchange API Room M215 - M216 Open WAF Day | CRS & ModSecurity & Coraza Room M213-M214

10:30am CEST

12:30pm CEST

3:00pm CEST

5:30pm CEST

Global Board of Directors Public Board Meeting Room 127

7:30pm CEST

Women in AppSec Reception (registration required) Room 212

8:15am CEST

Coffee/Tea Area 1 Registration

8:30am CEST

Speaker Ready Room Room 119

9:00am CEST

Keynote:Nemo Resideo: Managing application security through rapid change Room 116+117Sarah-Jane Madden OWASP Member Lounge Room 111

10:00am CEST

AM Break with Exhibitors Area 1

10:30am CEST

OWASP LCNC Securing the Future: AI Meets Low-Code, the New Security Frontier! Room 131-132Ziv Hagbi CfP/CfTs for the Newcomer: How To Write A Good Submission Room 118Izar Tarandach • Avi Douglen Demystifying & remystifying embedded systems security Room 113Jarmo Lahtiranta The Edge Strikes Back: Challenging OWASP's Take on Edge-Level Authorization Room 116+117Dimitrij Drus False Positives, Begone! Harnessing AI for Efficient SAST Triage Room 114Elliot Ward Human Buffer Overflow: How to Deal with Cognitive Load in High-Performing Teams Room 115Juliane Reimann

10:45am CEST

OWASP Certified Secure Developer Open Call Room 133-134Shruti Kulkarni OWASP Web Application Honeypot Project - Creating Comprehensive Threat Intelligence Dataset Room 133-134Kartik Adak • Mukunthan Nagarajan • Adrian Winckles

11:00am CEST

OWASP ModSecurity in Motion: Evolving the Open Source WAF Room 131-132Ervin Hegedus OWASP Juice Shop Demo: Your vitamin shot for security awareness & education Room 133-134Björn Kimminich OWASP KubeFIM Securing Kubernetes from the Inside Out: File Integrity Monitoring with eBPF Room 133-134Abhijit Chatterjee

11:30am CEST

OWASP Threat Library Room 131-132Petra Vukmirovic Hacking Your Enterprise Copilot: A Direct Guide to Indirect Prompt Injections Room 113Tamir Ishay Sharbat Securing cross-platform mobile applications Room 116+117Jeroen Beckers Emerging Frontiers: Ransomware Attacks in AI Systems Room 114Behnaz Karimi • Yuvaraj Govindarajulu Your Security Dashboard Is Lying to You: The Science of Metrics Room 115Aram Hovsepyan

1:15pm CEST

Introducing Sunshine, the all new SBOM visualization tool by OWASP CycloneDX Room 131-132Luca Capacci • Mattia Fierro Beyond the Surface: Exploring Attacker Persistence Strategies in Kubernetes Room 113Rory McCune Mastering Security through Simple Machines: How Consistency, Not Complexity, Drives Innovation Room 116+117Ken Toler From Prompt to Protect: LLMs as Next-Gen WAF's Room 114Juan Berner Against all odds: Kickstarting your Product Security Program when things are not in your favour Room 115Michael Helwig OWASP Cornucopia Room 133-134Johan Sydseter - The guy with the long hair, not the long beard OWASP DefectDojo Demo Room 133-134Matt Tesauro Meet the Mentor Room 118

1:45pm CEST

OWASP Mobile Application Security (MAS) Project Updates Room 131-132Sven Schleier • Carlos Holguera

2:15pm CEST

OWASP Cumulus: Threat Modeling the Ops of DevOps Room 131-132Christoph Niehoff Builders and Breakers: A Collaborative Look at Securing LLM-Integrated Apps Room 113Javan Rasokat • Rico Komenda Friend or Foe? TypeScript Security Fallacies Room 116+117Liran Tal Living the SBOM life - the good, the bad and the evil parts Room 114Olle E. Johansson • Anthony Harrison Beyond Best Practices: Uncovering the Organizational Roots of Software Security Vulnerabilities Room 115Tomer Gershoni OWASP Demo Lab: See CycloneDX SBOMs Come to Life with Sunshine Room 133-134Luca Capacci • Mattia Fierro OWASP GenAI Security Project Room 133-134Scott Clinton

2:45pm CEST

OWASP Coraza in 2025: What next for the WAF you want to use? Room 131-132Soujanya Namburi

3:00pm CEST

PM Break with Exhibitors Area 1

3:30pm CEST

To BI or Not to BI? Data Leakage Tragedies with Power BI Reports Room 113Uriya Elkayam Policy as Code for Applications at Scale Room 116+117Magnus Jungsbluth Current challenges of GraphQL security Room 114Maxence Lecanu • Antoine Carossio Kaizen for your appsec program: Turning big problems into small steps Room 115Dag Flachet Automating OWASP ASVS with OWASP Nuclei: A Hands-On Walkthrough Room 133-134AmirHossein Raeisi • Hamed Salimian Level Up Your AppSec Game: OWASP SAMM's Roadmap to Security Excellence Room 133-134Sebastien Deleersnyder

3:35pm CEST

OWASP Domain Protect Project Room 131-132Paul Schwarzenberger

4:30pm CEST

Networking Reception in Expo Hall Area 1

8:15am CEST

Coffee/Tea Area 1 Registration

8:30am CEST

Speaker Ready Room Room 119

9:00am CEST

Keynote: Outside the Ivory Tower: Connecting Practice and Science Room 116+117Kate Labunets OWASP Member Lounge Room 111

10:00am CEST

AM Break with Exhibitors Area 1 Bob the Breaker CTF - The Reunion. The No-code/Low-code Hacking Saga Continues. Room 118NoKod Security • NoKod Security

10:30am CEST

Beyond the Rules: The Past, Present, and Future of OWASP CRS Room 131-132Felipe Zipitria Doors of (AI)pportunity: The Front and Backdoors of LLMs Room 113Kasimir Schulz • Kenneth Yeung A completely pluggable DevSecOps programme, for free, using community resources Room 116+117Spyros Gasteratos Think Before You Prompt: Securing Large Language Models from a Code Perspective Room 114Yaron Avital • Tomer Segev LLMs vs. SAST: How AI Delivers Accurate Vulnerability Detection and Reduces False Positives Room 115Jonathan Santilli • Kirill Efimov

10:45am CEST

GenAI Security Project Getting down to business: practical & tactical Project Management Room 133-134 OWASP KubeFIM Advanced Threat Detection & Security Automation Room 133-134Abhijit Chatterjee

11:00am CEST

OWASP Nettacker Room 131-132Sam Stepanyan Level Up Your AppSec Game: OWASP SAMM's Roadmap to Security Excellence Room 133-134Sebastien Deleersnyder OWASP Certified Secure Developer Open Call Room 133-134Shruti Kulkarni

11:30am CEST

Navigating Agentic AI Security Risks: OWASP’s GenAI Guidance for Securing Autonomous AI Agents Room 131-132John Sotiropoulos Restless Guests: From Subscription to Backdoor Intruder Room 113Simon Maxwell-Stewart Introducing the 5.0 release of the ASVS Room 116+117Elar Lang Surviving prioritisation when CVE stands for “Customer Very Enthusiastic" Room 114Irene Michlin Security Champion Worst Practices Room 115Tanya Janca

1:15pm CEST

OWASP Cornucopia: Scaling secure design & requirement gathering activities Room 131-132Johan Sydseter - The guy with the long hair, not the long beard Abusing misconfigurations in CI/CD to hijack apps and clouds Room 113Håkon Nikolai Stange Sørum • Karim El-Melhaoui Scaling Threat Modeling with a Developer-Centric Approach Room 116+117Andrew Hainault • Andrea Scaduto Signing is Sassy, but CI/CD Security Pays the Bills Room 114Patricia R. • Chris Snowden Scale Security Programs with Scorecarding Room 115Rami McCarthy OWASP ASVS Nuclei Room 133-134AmirHossein Raeisi • Hamed Salimian OWASP DefectDojo Room 133-134Matt Tesauro

1:45pm CEST

OWASP Top 10 for Business Logic Abuse Room 131-132Ivan Novikov

2:15pm CEST

OWASP Security Champions Guide Project Room 131-132Aleksandra Kornecka Compromised at the Source: Supply Chain Risks in Open-Source AI Room 113Tal Folkman Transaction authorization pitfalls – How to improve current financial, payment, and e-commerce apps? Room 116+117Wojciech Dworakowski GenAI Security - Insights and Current Gaps in OS LLM Vulnerability scanners and Guardrails Room 114Roman Vainshtein Metrics That Matter: Driving AppSec Success with Data-Driven Insights Room 115David Andersson Let's Play! OWASP Cumulus Room 133-134Christoph Niehoff OWASP Juice Shop Demo: Your vitamin shot for security awareness & education Room 133-134Björn Kimminich

2:45pm CEST

OWASP Top 10 for CI/CD Security: Evolution Since the Top 10 Project’s Inception Room 131-132Omer Gil

3:00pm CEST

PM Break with Exhibitors Area 1

3:30pm CEST

When Regulation Backfires: How a Vulnerable Plugin Led to an XSS Pandemic Room 113Eilon Cohen • Ori Ron LLM-Powered private Threat Modeling Room 116+117Murat Zhumagali Know Thy Judge: Uncovering Vulnerabilities of AI Evaluators Room 114Francisco Girbal Eiras • Eliott Zemour • Dan Ross An AppSec Tale: From Zero to Champions Room 115Even Tillerli • Nicole Silva

3:35pm CEST

OWASP DefectDojo - What's next? Room 131-132Matt Tesauro

4:30pm CEST

Closing Ceremony and Raffle Room 116+117