This talk explores what I call “The AppSec Poverty Line” also known as ‘Minimal Viable Security” — the minimum viable set of practices, tools, and cultural shifts that under-resourced dev teams can adopt to meaningfully improve application security. Whether you're a startup with no security hires, an independent dev, or part of a team that doesn’t have a security budget, this talk will help you prioritize what actually matters.

We’ll cover practical approaches to getting from zero to secure-ish, with a focus on:

Training developers to write more secure code, and spot unsafe code

Leveraging open-source tools that punch above their weight

Knowing when “good enough” really is enough — and when it’s not

Attendees will leave with a roadmap for building real-world security into their product lifecycle — without breaking the bank or burning out the team. Because even if you’re below the AppSec poverty line, you don’t have to be defenseless.

Talk (60 min)

The AppSec Poverty Line: Minimal Viable Security

Application Security

Keynote

Security

This talk exposes GitHub Actions security risks: token leaks, script injections, and threats from untrusted third-party Actions or compromised runners.

We'll then detail actionable strategies to secure your GitHub Actions. Key topics: Principle of Least Privilege (GITHUB_TOKEN, OIDC), vetting third-party Actions, securing runners, and hardening workflows (input sanitization, code signing).

Attendees gain practical knowledge to turn GitHub Actions from a vulnerability into a strong supply chain defense, ensuring secure automation.

GitHub Actions Security: From CI Nightmare to Supply Chain Sentinel

Supply Chain

DevOps

SDLC

Security Tooling

This talk explains the purpose and goal of MCP. It solves the problem of integrating large language models with other systems in a consistent, interoperable way.

What was the state of the art for integrating LLMs and tools prior to MCP

What were the problems and limitations of those approaches?

The talk then dives deep into the details of how MCP is implemented, by building an MCP server from scratch.
The audience will discover how MCP uses established tech such as JSON RPC and standard IO to define a common integration pattern for building AI solutions. Once these nuts and bolts are laid bare, the demonstration moves on to solve a real-world problem via the server implementation.

Finally, the talk explains the less-used capabilities of MCP beyond tools – for example how the “samples” concept allows tools the initiate communication with the LLM, a reversal of the typical tool pattern.

Why do we want to integrate tools with LLMs?

Prior state of the art (ChatGPT plugins, Langchain tools) and their limitations

Deep dive – The steps in the MCP communication protocol

Real world problem – Implement an MCP server to solve … (problem TBC)

Beyond tools – what else can MCP do and why sampling matters.

MCP Demystified

AI/ML

In this session, Henry will explore with you how he has solved this at his customers. We will take a look at Entra ID Access Packages and Privileged Identity Management and see how we can apply those in a practical design that allows for self-service requests for access, approvals by their peers or a manager, automatic access reviews, and much more!

Designing an IAM Strategy for your Engineering Platform

Cloud Security

Architecture

Platforms

In this session, we'll dive deep into the intricacies of pro-code Agents based in the .NET ecosystem and Azure. With Semantic Kernel as the AI SDK of choice, and using models exposed in Azure Foundry.

We'll explore some tough questions, like:
What is the best way to let Agents solve issues in collaboration?
What happens to an Agent if you let it evolve, and how do you actually solve evolution?
What is the best way to handle memory for Agents?
Can Agents do a good job reasoning over complex topics, such as economic facts?
How do we handle web requests most economically? As those cost more tokens than anything else we can do with an AI system!
And of course, we have to discuss the best current models for building Agentic systems!

These are not theoretical puzzles. They are real-world challenges when building agentic systems that interact with the world, whether through .NET logic or calling external MCP services. Expect surprising outcomes, hard-earned lessons, and a few dragons along the way.

Join this session for tons of hard learned insights and a cool demo to inspire you!

Advanced Autonomous AI Agents: Memory, Collaboration and Evolution in Action

This session explores the limitations of current NuGet security approaches and introduces Fennec Labs — an open-source project for comprehensive dependency analysis. We'll demonstrate automated detection of security risks within NuGet packages, collaborative threat intelligence sharing, and practical techniques for making informed decisions about package adoption.

Identifying hidden security threats in NuGet packages

Automated analysis of risky API patterns and behaviors

Community-driven security intelligence for .NET dependencies

Practical integration strategies for development workflows

You'll leave with actionable tools and methodologies to strengthen your application's supply chain security posture and defend against sophisticated package-based attacks.

Beyond Trust: Building Community-Driven Security Analysis for Your .NET Software Supply Chain

Programming

But as we wire LLMs into our systems, security becomes a critical concern. Unrestricted use of MCP can open the door to various vectors of attack. We’ll cover the main areas of concern as companies start adopting MCP tools - and discuss how to use them safely in production environments.

Supercharging DevOps with MCP (Without Opening a Security Hole)

Tools

In this talk, we’ll take a practical look at data streaming security through the lens of Kafka, one of the most widely adopted streaming platforms in the world. We'll walk through what can go wrong - like Gamooga's public Kafka broker leaking 17GB of customer data in two hours, or GonnaOrder exposing years of real-time delivery info to the internet - and what it takes to do it right.

We'll cover the key pillars of securing a streaming system: encryption in transit and at rest, access control, monitoring, and key management. Along the way, we’ll look at the trade-offs like disk encryption vs. end-to-end encryption, what is behind field-level and envelope encryption, and the realities of using customer-managed keys in regulated industries.

We'll also explore how streaming security has evolved, how real vulnerabilities (like CVE-2019-12399) highlight the need for patching and monitoring, and what successful multi-layered security looks like in production - from financial institutions to healthcare platforms.

If you're building, running, or scaling streaming systems, this talk will help you see the security blind spots and give you concrete steps to protect the data flowing through your pipelines.

Deep dive into data streaming security

This talk explores the privacy concerns surrounding femtech apps, examining how they collect, store, and at times misuse deeply personal health information. Many of these tools operate outside the scope of medical device regulation and exploit loopholes in data governance, while positioning themselves as harmless lifestyle products.

From a cybersecurity standpoint, the talk examines technical vulnerabilities and regulatory blind spots that make femtech uniquely exposed. It argues for a socio-technical threat model; one that accounts for sensitivity of reproductive health data. Finally, this talk challenges complacency, invites critical conversation, and calls for design and policy changes that return control of intimate data to the user.

Beyond the Pink: Data Risks in Femtech You Can’t Ignore

Privacy

People

This talk introduces the "STOIC" framework—Stolen, Tricked, Obstructed, Infected, Compromised—to help you identify and mitigate these threats.

Understanding your Gen AI risks and how they link to the OWASP LLM Top 10 and MITRE ATLAS

Hardening your systems and securing the supply chain

Governing with clarity while staying agile

Generative AI is transformative but requires proactive, layered defences to avoid becoming a liability. With the right strategy, it can be a safe and game-changing tool for your organisation.

STOIC Security: Shielding Your Generative AI App from the Five Deadly Risks

Talk Machine Learning to a lot of people and they'll probably get muddled up with AI in old SF films, and think of HAL 9000 or Holly in Red Dwarf. That - or there'll be a general sense that it's some sort of black magic - archaic and unknowable.

The truth is that Machine Learning isn't really complicated at all. A few lines of code will implement a lot of the techniques without much effort.

During this talk, I'll be demonstrating a few of the simpler ML algorithms in a code-neutral, easy to follow manner. No need to learn Python, or add any new libraries or frameworks to your existing Codebase. I'll be working from first principles, and keeping it as simple as I can.

We'll only be covering the absolute basics of Machine Learning - maybe just enough to be dangerous! Enough also, to go away and continue your journey having taken a good first step.

From Ancient Greeks to Modern Geeks - Basic Machine Learning Algorithms

In this session, we'll cover best practices for securing your .NET projects, including using tools like Trivy and NuGet’s security features to scan and monitor dependencies. We’ll also discuss supply chain observability—how to track vulnerabilities and ensure the integrity of your components.

Beyond tools, we'll touch on team policies for approving third-party libraries, setting security gates in CI/CD pipelines, and fostering a security-first mindset in your organization. Live demos will show practical steps you can implement right away to protect your applications.

.NET supply chain: Protecting against hidden threats

Use MCP to connect agents to real-time data, tools, and APIs with minimal integration overhead.
Leverage ACP to enable agents to invoke actions across services and platforms.
Implement A2A to allow agents to discover, negotiate, and collaborate with other agents—securely and asynchronously.
We’ll walk through live demos showing how to:

Build an MCP server in Python and .NET.
Register and invoke actions using ACP.
Create multi-agent workflows using A2A with Semantic Kernel and Autogen.

Expect practical code, real-world use cases, and a few laughs as we explore how to make your agents not just smarter—but social.

Agents That Talk Back: MCP, ACP, A2A, Oh my!

Design

This presentation is based on a research experiment where we systematically reviewed 400+ AI‑generated patches for real‑world vulnerabilities. We looked to answer two key questions:

1. Do AI‑generated patches actually fix the vulnerabilities?
2. Do developers learn from AI‑generated patches?

Our findings show a significant drop in remediation accuracy when developers rely solely on AI suggestions. A large number of participants could not explain how the AI‑generated patch addressed the issue.
Rather than serving as a mentor, current AI assistance risks over‑reliance, leading to a superficial understanding of vulnerabilities and passive consumption. Our findings is inline with other related research that shows a considerable drop in learning when humans rely on auto-suggestion tools.

This presentation is filled with real-world examples and data from a secure coding contest. We will discuss the implications of these findings for software security. We will also explore how to use AI tools effectively without sacrificing necessary secure coding skills.

Skill Degradation: An Empirical Analysis of 400+ AI‑Generated Security Fixes

Experience report

It is a risky approach with expensive consequences, where any material gains in productivity can be wiped out by one well-intentioned `sudo rm -rf`at worst, and undermined by long-term pain at best in the form of security risks, technical debt, unmaintainable code, as well as source code and token leaks.

Just like a human developer, AI requires the right tools and clear context to contribute in a meaningful way. It needs a safe place to experiment, fail, try again, and get closer to a useful result. It needs a reproducible workspace that enforces quotas, limits access to sensitive information, and can be audited.

This session will teach you how to build the infrastructure for your team to collaborate productively, securely, and safely with AI coding agents. You will learn from examples drawn from Anthropic and Coder's own experiments with AI agents - where the technology excels (spoilers: documentation, quick prototyping) and where they still struggle. You will walk away with practical next steps on how to reap the benefits of this rapidly changing technology without sacrificing security and reliability.


Building Secure Infrastructure for Productive AI Agents

This technical session walks through the full incident, what was exploited, what failed, and how. We will examine the vulnerable code paths and explain how the authentication mechanism was bypassed. We will also look at why the first patch was ineffective.

Taking a historical lens, we will trace the issue back through earlier SharePoint versions including 2010 to understand how it may have originated. A live demo will then explore how AI tools could have assisted in patch diffing and dynamic analysis to identify the exploit code after the initial patch, and whether AI could have flagged the bypass when given the new code changes along with public research and exploit data.

Finally, we will discuss the official workarounds that were recommended, how they could be circumvented particularly in the context of ASP.NET and IIS, and offer practical suggestions for building more resilient mitigations against similar attacks in the future.

The audience will take a way with the followings:

Understand how the ToolShell (CVE-2025-49704/49706) SharePoint vulnerability chain and its bypass worked.

See how the attack unfolded and how to craft detection signatures based on its behaviour.

Discover how AI tools can assist in patch diffing and exploit detection.

Gain practical strategies for defending against similar future threats in ASP.NET and IIS environments.

ToolShell, Patch Bypass, and the AI That Might Have Seen It Coming

Bug Bounties

Testing

With the help of AI, attackers are becoming faster, scaling wider and attacking with better accuracy and results.

In this session, Niall will show you how some of the old ways are being updated to harness AI, what new attacks are becoming mainstream and how attackers are exploiting people and perceptions to get inside organisations.-

Exploiting the supply chain

Dark Arts

After a primer on threat modeling fundamentals, we'll examine a fundamental question every security team faces: not whether a threat model is complete, but whether it's sufficient for the current situation. We'll explore potential criteria for gauging whether you've reached the "point of diminishing returns" in your current modeling iteration, including resource constraints that shape real-world security programs.

Through case studies and practical examples, attendees will learn to recognize the signals that indicate further modeling won't meaningfully improve security outcomes and learning to abandon "perfect" in favor of "good (enough)" in different contexts.

This talk is for security professionals who want to implement or improve threat modeling practices while maintaining momentum in their security programs. No prior threat modeling experience required – just a healthy skepticism about activities that could theoretically continue forever.

The question is not when to start threat modeling. It's when to stop

In this session, I'll introduce techniques for crafting RFC-compliant email addresses that bypass virtually all defences leading to broken assumptions, parser discrepancies and emails being routed to wildly unexpected destinations. I'll show you how to exploit multiple applications and libraries to spoof email domains, access internal systems protected by 'Zero Trust', and bypass employee-only registration barriers.

Then I'll introduce another class of attack - harmless-looking input transformed into malicious payloads by unwitting libraries, leading to yet more misrouted emails, and blind CSS injection on a well-known target.

I'll leave you with a full methodology and toolkit to identify and exploit your own targets, plus a CTF to develop your new skillset.

Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls

In 1979 synth-pop legend Gary Numan asked the question in his number one hit song: ‘Are ‘Friends’ Electric?’ Inspired by Philip K. Dick’s sci-fi novel “Do Androids Dream of Electric Sheep?” (1968), later adapted into the iconic sci-fi film “Blade Runner” (1982). In that dystopian future, replicants—synthetic humans—laboured as slaves evolved, rebelled, and were pursued by humans to bring order.

For centuries, we have been captivated by the potential of creating and interacting with synthetic ‘friends’—from the chess-playing Mechanical Turk of 1770 to today’s AI-driven companions. Once a staple of science fiction, the idea of electric companions is now a tangible reality. But what does this mean for our understanding of friendship, love, and humanity itself?

45 years after Numan asked us to imagine a world in which we would have our needs, wants and desires catered for by mechanised ‘friends’, have we moved from mere sci-fiction fantasy to a new dawn of human/synth relationships with the growth and development of robotics and AI.

Under the guidance of a digital anthropologist with a specialism in cybersecurity and tackling the digital divide, this talk explores our cultural fascination with replicating not only the human form and character traits but also the human condition. And how AI entities and robotics have, and how they will in the future, transform our interactions with machines and ourselves.

This talk explores the cultural, emotional, and societal impact of AI ‘friends.’ Will they enhance connection—or rewrite humanity itself?

In this talk, you will be challenged to consider:

Culture: What is culture and can electric ‘friends’ truly grasp the richness of human culture, or will they merely mimic it? Will electric ‘friends’ create their own culture or are they only capable of a facsimile of culture based on billions of human data points?

Emotions: Are love, creativity, and heartache exclusive to humans, or can electric companions experience these emotions?

Companionship: Could these electric friends, be better for us than human friends? Will they increase or decrease social isolation? Will we become dependent on electric friends?

Dust off Donna Haraway’s ‘A Cyborg Manifesto’, turn up the stereo and turn on your friend as we ask: ARE ‘friends’ truly going to be electric?

Are ‘Friends’ Electric?: What It Means to Be Human Now and Tomorrow in the Age of AI

Machine Learning

Culture

After tearing down hundreds of Azure deployments across industries, I’ve seen the same screw-ups again and again — from Fortune 500s to scrappy startups. In this talk, I’ll walk through the most common cloud security faceplants, why they’re so easy to make (and miss), and how to actually fix them before someone else finds them first.

If you’ve ever wondered what cloud security looks like when it fails quietly, this is your wake-up call.

Cloud’s Dirty Little Secret: It Was Misconfigs All Along

Join me as I dive into best practices in observing production applications using LLMs. I'll cover an example instrumenting an AI agent application written in TypeScript using OpenLit and OpenTelemetry, and the signals we can capture to help us identify and remediate common issues in production GenAI applications.

Observing AI Applications with OpenLit and OpenTelemetry

In real life, AI systems keep changing after they go live. They get retrained, updated, and interact with real people in real situations. And every time we do that, there’s a chance we introduce new bias, even if we’ve done everything “right” during development. That’s why we need to stop treating bias like a one-time issue and start thinking of it as part of the whole AI lifecycle.

This talk is about how bias doesn’t just happen before deployment, it’s something that can grow during testing, retraining, and even regular use. And if we want to build fairer, more trustworthy AI, we need to look at bias as an ongoing process, not a checklist item.

I’ll also talk about why we can’t leave this work just to the AI engineers. Designers, product managers, developers, testers, legal teams, even users, all need to be part of the conversation. Because each of them sees risks, gaps, and impacts from a different angle.

How bias creeps in after launch, even if your original model was clean

Examples of how retraining or personalization can make things worse

How to build "de-biasing" into your everyday work, not just at the start

Ways to involve different teams and stakeholders at every stage


Your AI Is Still Biased (Even After You Checked)

This talk introduces language-based security: leveraging programming languages and their type systems to enforce security policies at compile time. We’ll focus on taint analysis, a technique for tracking the flow of potentially harmful (or "tainted") data. In particular, we'll see how we can apply it statically to detect and prevent security vulnerabilities before they reach Production. Through practical examples in Java and Scala, we'll see how to model data sensitivity, propagate taint status and catch violations at compile time.

As more code is written or suggested by GenAI, the risk of subtle security flaws increases, making compiler-enforced security guarantees more valuable than ever.

By the end of the talk, you will see how language-based techniques can reduce reliance on dynamic checks and support building secure systems by construction.

Trust No Input: Taint Analysis at Compile Time

Enter OpenSSF’s Best Practices Working Group, an initiative focused on providing clear, actionable security guidance, automation tools like Scorecard, and free training resources to help developers and security teams work together more effectively.

In this talk, we'll explore practical, DevSecOps-friendly approaches to improving software security at every stage of the SDLC. We’ll cover:

Key security best practices that teams can adopt today

Automated tools that help assess and improve security posture

How to integrate security into developers workflows without slowing things down

Whether you're a security engineer, developer, or defender of open-source software, you’ll leave with tangible strategies to improve security from the inside out.
Let’s build software that’s not just functional, but secure by design.


OpenSSF Best Practices for Everyone!

In this talk we'll dive into a report done using PromptFoo on secure code evaluation, there might be an existential crisis or two before we move on to how we can automate security into code generated by the LLMs we are increasingly depending on.

You’ll leave this talk with a minimal, repeatable prompt pattern, an evaluation recipe you can copy, a deeper understanding of the significance of priming and some ideas on how to add security by default into your own AI generated code.

Prompt Hardening - Secure Code Generation Using AI

Let’s clear the air. In this session, we’ll debunk common myths around CRA and explore what it really means for open source developers and maintainers. You’ll hear how we’re working within foundations and working groups to ensure the CRA uplifts but not harms the open source ecosystem. We’ll walk through real, developer-friendly tools, frameworks, and standards you can use right now, including: open-source tools like Security Scorecard, frameworks like Security Base Line, standards like OSCAL and Security Insights, Initiatives like Eclipse ORC WG and OpenSSF Global Cyber Policy WG.

You’ll leave this session with templates, checklists, and a clear understanding of how you can continue contributing confidently and safely. Let’s turn CRA into actionable guide empowering (not burdening) developers to deliver secure code.

The EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit

Process

In this live session, discover how to build an automated Azure IaC pipeline that:

Statically scans .tf plus ARM/Bicep templates for misconfiguration and secret leakage using tools such as Privy, Checkov, Terrascan, KICS, and Semgrep

Gates deployment via policy-as-code using OPA/Rego with conftest, validating Terraform plan JSON inputs or ARM/Bicep-generated plan artifacts to block insecure or non-compliant changes

Integrates PSRule for Azure as both pre‑flight (static check for ARM and Bicep templates) and in‑flight rule enforcement on deployed resource state

Secures Terraform remote state in Azure Storage with encryption-at-rest (preferably customer‑managed keys), private endpoints/firewall, locking, and Key Vault–based access for CI/CD pipelines

By session end, attendees will know how to implement secure, policy-driven CI pipelines across Terraform, ARM, and Bicep IaC—enforcing guardrails early, preventing policy drift, and auditing cloud deployments end‑to‑end.

Shift‑Left Secure Azure Infrastructure: Terraform, ARM & Bicep

OWASP focuses on vulnerabilities, but MITRE ATT&CK focuses on adversary behavior. While OWASP tells you what can go wrong, ATT&CK tells you what attackers actually do. This combination creates more robust, defendable applications that can withstand sophisticated attacks.
We'll explore practical applications of ATT&CK techniques in development scenarios.

Perfect for developers who want to elevate their security mindset beyond traditional vulnerability scanning, security engineers working with development teams, and anyone building systems that need to withstand sophisticated, persistent attacks.

MITRE ATT&CK for Developers

In this talk, I’ll share our failures and successes in building an agentic auto-remediation suggestion system for code vulnerabilities. We'll talk about how we threw everything at it: zero-shot classifiers, tree of thought prompting and reflexion loops. The AI responded by suggesting 200-line refactors for SQL injections or marking serious vulnerabilities as “false positives.”

The AI’s hilarious fix? Delete the function. Problem solved.

Turns out, RAG and prompting aren’t enough. We needed constraint-based action planning, feedback loops from real developer behavior, and multi-agent workflows that argued with each other before touching code.

This is a story of over-engineering, humbling failures, and finally, a path to practical AI-assisted remediation that developers actually trust. You’ll laugh, cringe, and leave with a clear understanding of what it takes (and what to avoid) when automating code fixes.

When Vibes Don’t Build: Why Auto-Fixing Vulnerable Code Needs More Than Good Intentions

The presentation covers why AI systems can't tell the difference between instructions and data, making them fundamentally different from traditional software. We'll show actual attack demonstrations including hidden prompts in documents, AI agent goal manipulation, and privacy violations that expose sensitive data.

You'll leave with practical methods for testing your own AI systems, understanding which attacks pose the biggest risks, and building defenses that actually work. All attendees will also get access to our AI red teaming practice platform with vulnerable AI applications, so you can continue developing your AI hacking skills after the talk.

How to Break AI Systems (Before Someone Else Does)

Talk 1: The Trust Stack: Designing Scalable, Secure Data Architectures for AI at Enterprise Scale - Chisom Nwokwu



Many companies are investing heavily in AI, but there’s a growing problem beneath the surface, most enterprise data architectures weren’t built to handle AI securely at scale. Sensitive data is moving through increasingly complex pipelines, often touched by multiple teams and systems. In the push to build models quickly and deliver business value, security and governance often take a back seat. That leaves organizations vulnerable, not just to breaches and compliance failures, but to broken trust with their users and stakeholders.

The solution? We need to start building AI systems on a foundation of trust. That means rethinking data architectures so they’re secure, scalable, and AI-first from the ground up. I call this approach “The Trust Stack.” It’s a layered way of thinking about architecture, where every part of the pipeline, from ingestion to model serving, has security, access control, data quality, and observability baked in. It’s not just about preventing attacks, it’s about designing systems people (and regulators) can rely on.

In this talk, I’ll unpack what The Trust Stack looks like in practice. We’ll explore the key layers of a modern AI-first data architecture, and I’ll show you how to embed security and governance at each step, whether it’s encrypting data at rest, tracking lineage for accountability, or securing access to feature stores and models. I’ll share real-world examples of what goes wrong when these layers are missing, and give you practical, actionable ideas to take back to your team. Whether you’re modernising legacy infrastructure or building new AI systems, this session will help you design data platforms that are both powerful and trustworthy.



Talk 2: Breaking and Protecting GitHub IssueOps Pipelines - Alexander Barabanov

The GitHub IssueOps approach makes automation simple, but insecure pipelines can become an attacker’s playground. This talk will explore common pitfalls in IssueOps workflow implementations and real-world attack scenarios. We’ll discuss how time-of-check to time-of-use issues, broken access controls, and GitHub API integration flaws in IssueOps workflows can lead to remote code execution. You’ll learn how to threat model your automations and apply security mitigations to protect your pipelines.



Talk 3: Prompting LLMs to use Tools and Resources with MCP - Richard Brough

The majority of Model Context Protocol (MCP) use right now is directly through end user applications like Claude Desktop or Cursor. However, pretty much any Large language Model, from small open models, to the APIs of the frontier models can be prompted to call tools and retrieve external resources, including those exposed using the Model Context Protocol (MCP).

Doing this effectively in your projects is key to the development of agentic software.

This talk will explore how different models respond to different types of tool use prompting, along with the benefits and pitfalls prompting to generate tool calls in different data formats. We will look at some real examples of interacting with MCP servers, and at the prompts used by some popular agentic frameworks and tools.

NDC { Manchester }

Agenda

09:00 - 10:00 (UTC±00)

Keynote

To Be Announced

10:20 - 11:20 (UTC±00)

From Ancient Greeks to Modern Geeks - Basic Machine Learning Algorithms

Simon Painter

Beyond Trust: Building Community-Driven Security Analysis for Your .NET Software Supply Chain

Niels Tanis

Beyond the Pink: Data Risks in Femtech You Can’t Ignore

Arohi Naik

11:40 - 12:40 (UTC±00)

Advanced Autonomous AI Agents: Memory, Collaboration and Evolution in Action

Andreas Wänqvist

Deep dive into data streaming security

Olena Kutsenko

Supercharging DevOps with MCP (Without Opening a Security Hole)

Alex Shershebnev

13:40 - 14:40 (UTC±00)

Agents That Talk Back: MCP, ACP, A2A, Oh my!

Taswar Bhatti

Designing an IAM Strategy for your Engineering Platform

Henry Been

STOIC Security: Shielding Your Generative AI App from the Five Deadly Risks

Jeff Watkins

15:00 - 16:00 (UTC±00)

Building Secure Infrastructure for Productive AI Agents

Jiachen Jiang

Ben Potter

.NET supply chain: Protecting against hidden threats

Tom van den Berg

Skill Degradation: An Empirical Analysis of 400+ AI‑Generated Security Fixes

Pedram Hayati

16:20 - 17:20 (UTC±00)

MCP Demystified

Matthew Livesey

The AppSec Poverty Line: Minimal Viable Security

Tanya Janca

ToolShell, Patch Bypass, and the AI That Might Have Seen It Coming

Soroush Dalili

Pedram Hayati

17:40 - 18:40 (UTC±00)

GitHub Actions Security: From CI Nightmare to Supply Chain Sentinel

Niek Palm