BSidesLV

1,015 talks · 1994–2025 · indexed by Breach Arc Archive. Links open each talk on YouTube.

• Closing Ceremonies for 2025 2025
• CG - Securing the 2020 Presidential Campaign: Threats, Challenges, and a Global Pandemic! 2020
• BSides Las Vegas 2019 - Ground Truth - Day 1 2019
• CG - Excuse Me, Your Sword Is In My Eye: Responding to Red Teams and Intrusions in 2019 and Beyond - 2019
• GT - Hackademia: The 2018 Literature Review - Falcon Darkstar Momot & Brittany "Straithe" Postnikoff 2018
• KEYNOTE - BSides LV 2018 Closing Ceremonies 2018
• CG - Booze, Devil's Advocate and Hugs: The Best Debates Panel You'll See at BSidesLV 2014 - David Mo 2014
• PG - Reverse engineering a DOS PC FMV Game from 1994 1994
• A Cheat Code for Security Programs
• A Winning Competition
• Advancing Network Threat Detection Thru Standardized Feature Extraction & Dynamic Ensemble Learning
• Agentic AI Malware: Why the Cybersecurity Battle Isn’t Over
• ATGP - #radBIOS: Wireless Networking with Audio - Richo Healey
• ATGP - All Your RFz Are Belong to Me - Software Defined Radio Exploits - Balint Seeber
• ATGP - Better Spectrum Monitoring with Software Defined Radio - Michael Ossmann
• ATGP - I Amateur Radio (And So Can You!) - Kat Sweet
• ATGP - Intro For New WCTFers - Russell Handorf & Rick Farina
• ATGP - Software-Defined Radio Signal Processing with a $5 Microcontroller - Jared Boone
• ATGP - Underground Wi-Fi Hacking for Web Pentesters - Greg Foss
• ATGP - Wi-Door - Blind/Reverse Shells for Your Wi-Fi - Vivek Ramachandran
• Automating Phishing Infrastructure Development Using AI Agents
• Autonomous Discovery of Logic-based API Vulnerabilities
• Avoiding Credential Chaos: Authenticating With No Secrets
• Azazel System: Tactical Delaying Action via the Cyber‑Scapegoat Gateway
• Beyond the Breach: Why Your Tabletop Exercise Should be Your Worst Nightmare
• Beyond the Command Line: Transitioning from Individual Contributor to Leader
• BG - The Magic of Symbiotic Security - Creating an EcoSystem of Security Systems - Josh Sokol & Dan
• BG - 14 Years Later, Proving Ground is Proving Out
• BG - A Better Way to Get Intelligent About Threats - Adam Vincent
• BG - A Fire In The Eye - Olli-Pekka Niemi & Antti Levomaki
• BG - A Serverless SIEM: Detecting All Baddies - Chen Cao, Daniel Stinson
• BG - A Tale of Two Malware Families - Overcoming Anti-Forensics and Foiling Botnets in the Cloud
• BG - Abusing Webhooks for Command and Control - Dimitry Snezhkov
• BG - All You Need is Guest: Beyond Enumeration
• BG - All your Ether are belong to us (a.k.a Hacking Ethereum-based DApps)
• BG - Allow Myself to Encrypt....Myself - Evan Davison
• BG - Amubush - Catching Intruders At Any Point - Matt Weeks
• BG - An Everything Is On Fireside Chat with Jen Easterly, Director of US C.I.S.A.
• BG - An Introduction of the Kobra, a Client for the Badger Version 2.0, Providing Tactical Situation
• BG - Anatomy of Memory Scraping, Credit Card Stealing POS Malware - Amol Sarwate
• BG - And Together We Crossed the River…
• BG - Applications and Cloud Hackers, Oh My! - Andrew Hay & Matt Johansen
• BG - At Your Service - Abusing the Service Workers Web API - Daniel Abeles & Shay Shavit
• BG - ATT&CKing the Status Quo: Improving Threat Intel and Cyber Defense with MITRE ATT&CK - Katie Ni
• BG - Attacking Ethereum dApps - Brandon Arvanaghi
• BG - Authentication Proxy Attacks: Detection, Response and Hunting
• BG - BEEMKA / Electron Post-Exploitation When The Land Is Dry - Pavel Tsakalidis
• BG - Beyond the Perimeter Uncovering the Hidden Threat of Data Exfiltration in Google Cloud Platform
• BG - Big Data's Fourth V: Or Why We'll Never Find the Loch Ness Monster - Davi Ottenheimer
• BG - BOLABuster: Harnessing LLMs for Automating BOLA Detection
• BG - Breaking Business as Usual: Attacking Android Enterprise Solutions
• BG - Bring Your Own Risky Apps - Domingo Guerra & Michael Raggo
• BG - Building an Empire with PowerShell Will Schroeder & Justin Warner
• BG - Chaos Drive: Briefly known as Loki - Michael Rich
• BG - CheckPlease: Payload-Agnostic Sandbox Detection - Brandon Arvanaghi & Christopher Truncer
• BG - Chrome Cookie Theft on macOS, and How To Prevent It
• BG - Closing Ceremony
• BG - Cluck Cluck: On Intel's Broken Promises - Jacob Torrey
• BG - Collaborative Penetration Testing With Lair - Tom Steele & Dan Kottmann
• BG - Cookie Monster: Exfiltrating Data and More, Byte by Tasty Byte
• BG - Crash The IoT Train Yourself: Intentionally Vulnerable WRT (IV-WRT) - Paul Asadoorian & Nick Cu
• BG - Crunching the Top 10,000 Websites' Password Policies and Controls - Steve Werby
• BG - Defense Evasion Modeling - Frank Artes
• BG - Detecting Log4J on a global scale using collaborative security
• BG - Discovering Dark Matter Towards Better Android Malware Heuristics - Jimmy Shah, David Shaw & Ma
• BG - Dungeons & Dragons, Siege Warfare, And Fantasy Defense In Depth - Evan Davidson & Noah Schiffma
• BG - EMBA - From firmware to exploit
• BG - Empirical Exploitation - H.D. Moore
• BG - Emulation, PowerPC, and Transition
• BG - Everything I know about prototype pollutions: how to react when confronted to a brand new vuln
• BG - Force Multipliers for Red Team Operations - Raphael Mudge
• BG - From EK to DEK: An Analysis of Modern Document Exploit Kits - Joshua Reynolds
• BG - From Email Address to Phone Number: A New OSINT Approach - Martin Vigo
• BG - From keyless to careless: Abusing misconfigured OIDC authentication in cloud environments
• BG - Fuzzing Frontiers: Exploring Unknown Unknown Vulnerabilities
• BG - Generative AI: The Three Concerns Problem and A Tale of Three CISOs
• BG - Getting the Data Out Using Socail Media - Dakota Nelson, Gabriel Butterick & Byron Wasti
• BG - Ghost DMA Attack & The SeDeFuS Conundrum - Dr. Raghudeep Kannavara, Alan Sheng
• BG - Gitdigger Creating Useful Wordlists From Public Github Repositories - WiK & Mubix
• BG - GO Forth And Reverse - Tim Strazzere
• BG - Google Workspace Forensics – Insights from Real-World Hunts & IR
• BG - Governments and UFOs: A Historical Analysis of Disinformation and Deception - Richard Thieme
• BG - Hell-0_World | Making Weather Cry
• BG - Hiding in Plain Sight - The Untold Story of Hidden Vulnerabilities
• BG - Hivemind: Distributed File Storage Using Javascript Botnets - Sean Malone
• BG - How I Learned to Stop Worrying and Love the Smart Meter - Spencer McIntyre
• BG - Injection on Steroids: Code-less Code Injections and 0-Day Techniques - Paul Shofield & Udi Yav
• BG - Injectyll-HIDe: Hardware Implants at Scale
• BG - Insights on using a Cloud Telescope to observe internet-wide botnet propagation activity
• BG - Introducing Android Security Evaluation Framework (ASEF) - Parth Patel
• BG - Introducing Serberus - a multi headed serial hardware hacking tool
• BG - Introducing the Smartphone Penetration Testing Framework - Georgia Weidman
• BG - Invasive Roots of Anti-Cheat Software - Alissa Torres
• BG - iOS Runtime Hacking Crash Course - Michael Gianarakis
• BG - IPv6 Panel - Drinking Game
• BG - JARVIS Never Saw It Coming: Hacking machine learning (ML) in Speech, Text and Face Recognition
• BG - JIT Happens: How Instacart Uses AI to Keep Doors Open and Risks Closed
• BG - JOINing Across the Stack: Structured Security Analytics for the modern attack surface
• BG - Keynote - Silence Equals Death - Violet Blue
• BG - Knock knock. Who's there? Betta! Betta who? Betta check your access control edge devices
• BG - Koadic C3 - Windows COM Command & Control Framework - Sean Dillon & Zach Harding
• BG - Lateral Movement and other Creative Steps Attackers Take in AWS
• BG - Lessons From the Front Lines: New York City Cyber Command - Colin Ahern
• BG - LOLS: LO Level Shells
• BG - Mainframe Hacking for CICS and Giggles
• BG - Max Level Web App Security - Robert Rowley
• BG - Meltdown's Aftermath: Leveraging KVA Shadow To Bypass Security Protections - Omri Misgav & Udi
• BG - Microservices And FaaS For Offensive Security - Ryan Baxendale
• BG - Modern ColdFusion Exploitation and Attack Surface Reduction
• BG - Modern Internet-Scale Network Reconnaissance - underflow
• BG - Mom! I Broke My Insulin Pump... Again! - Jay "Rad" Radcliffe
• BG - My Terrible Roommates (see description for full title)
• BG - Network Forensic Analysis in an Encrypted World - William Peteroy & Justin Warner
• BG - Neurosecurity: where Infosec meets Brain-machine Interface - Ben D. Sawyer & Matt Canham
• BG - NSA Playset - Bridging the Airgap without Radios - Michael Leibowitz
• BG - Occupy Burp Suite: Informing the 99% of what the 1%'ers are knowingly taking advantage of - Jam
• BG - Oops, I Leaked It Again - How we found PII in exposed RDS Snapshots
• BG - Opening Remarks - Day One
• BG - Opening Remarks - Day Two
• BG - Operation So-seki: You Are a Threat Actor. As Yet You Have No Name.
• BG - Overlooked Tactics for Attacking Hardened Active Directory Environment - Hao Wang, Yothin Rodan
• BG - Pacu: Attack and Post-Exploitation in AWS - Spencer Gietzen
• BG - Putting Driver Signature Enforcement Tampering to Rest?!
• BG - Puzzle Competitions & You - Christopher Lytle
• BG - Ransomware Emulation Done Right
• BG - Redis or Not: Argo CD & GitOps from an Attacker's Perspective
• BG - Remote Access, the APT - Ian Latter
• BG - Repo Jacking: How GitHub exposes over 70,000 projects to remote code injection
• BG - Reticle: Dropping an Intelligent F-BOMB - Brendan O'Connor
• BG - RFID LOL - Terry Gold
• BG - ROP with a 2nd Stack, or This Exploit is a Recursive Fibonacci Sequence Generator - Nicholas Mo
• BG - Scaling the Security Researcher to Eliminate OSS Vulnerabilities Once and For All
• BG - Search engine deoptimization with Gootloader
• BG - SECSMASH: Using Security Products to own the Enterprise - Kevin Dick & Steven Flores
• BG - Securing Robots at Scale - Talha Tariq
• BG - Security Testing for Smart Metering Infrastructure - Robert Hawk & Steve Vandenberg
• BG - See you later, allocator!': Updating Volatility's analysis of modern Linux memory allocators
• BG - Serverless Infections: Malware Just Found a New Home - Erez Yalon
• BG - SiliVaccine: North Korea's Weapon of Mass Detection - Mark Lechtik & Michael Kajiloti
• BG - SniffAir – An Open-Source Framework for Wireless Security Assessments Steven Darracott & Matthe
• BG - So You Wanta Build a C2?
• BG - Social Aftermath Responding To Social Pwnage - Steven F. Fox
• BG - State of DNS Rebinding - Attack & Prevention Techniques and the Singularity of Origin - Gerald
• BG - Static Detection of Novel Malware Using Transfer Learning with Deep Neural Networks
• BG - Strange interactions in personal data: Brokers and the CFAA - Christine Dudley
• BG - TAPIOCA (TAPIOCA Automated Processing for IOC Analysis) - Ryan Chapman & Moses Schwartz
• BG - The Badmin Project (Na-na-nanana Na-na-nanana BADMIN) - Gillis Jones
• BG - The Black Art of Wireless Post-Exploitation: Bypassing Port-Based Access Controls Using Indirec
• BG - The Cavalry Isn't Coming: Starting The Revolution To fsck it All - Nicholas J. Percoco & Joshua
• BG - The Dark Playground of CI/CD: Attack Delivery by GitHub Actions
• BG - The Dark Side of TheMoon
• BG - The Ever-shifting Habits of Cloud-focused Malware Campaigns
• BG - The Fault in Our Metrics: Rethinking How We Measure Detection & Response
• BG - The Leverage of Language, or, How I Realized Information Theory Could Save Information Security
• BG - The power of guardrails: How to slash your risk of XSS in half
• BG - The Savage Curtain 0 Tushar Dalvi & Tony Trummer
• BG - Tuning The Warp Drive with Laforge: New Tool for Building Security Competitions - Alex Levinson
• BG - Turning (Page) Tables - Bypassing Advanced Kernel Mitigations Using Page Tables Manipulations
• BG - Unpacking pkgs: A look inside macOS Installer packages and common security flaws - Andy Grant
• BG - Untwisting the Mersenne Twister: How I Killed PRNG - moloch & Dan 'AltF4' Petro
• BG - Unveiling the Hidden: Discovering RDP Vulnerabilities using PDF Files
• BG - USB Write Blocking with USBProxy - Dominic Spill
• BG - Using Machines to exploit Machines - harnessing AI to accelerate exploitation - Guy Barnhart-Ma
• BG - Vaccinating Android - Milan Gabor & Danijel Grah
• BG - Vaccination - An Anti-Honeypot Approach - Gal Bitensky
• BG - Virtual Breakpoints for x86/64 - Gregory Price
• BG - Virtualizing Your Ford SYNC3 for Fun and Profit
• BG - Watching the Watchers: Exploiting Vulnerable Monitoring Solutions
• BG - What Reaction to Packet Loss Reveals About VPN - Sergey Bratus & Anna Shubina
• BG - WhyMI So Sexy? WMI attacks, Realtime Defense & Advanced Forensic Analysis - William Ballenthin,
• BG - Wolves in Windows Clothing: Weaponizing Trusted Services for Stealthy Malware
• BG - Writing Malware Without Writing Code - Gal Bitensky
• BG - YARA-as-a-Service (YaaS): Real-Time Serverless Malware Detection - Austin Byers
• BG - Your Electronic Device, Please: Understanding the Border Search Exception & Electronic Devices
• BG - Your Taxes Are Being Leaked - Michael Wylie
• BG - Zero Trust Networks: In Theory and in Practice - Doug Barth & Evan Gilman
• BG - “Malware Management Framework” – We detected WinNTI with it! - Michael Gough
• BG- Keybnote - The Security Industry - How To Survive Becoming Management - Christien Rioux
• BG- Stillwalker - Round 2 - dc949
• BG- We Hacked the Gibson! Now What? - Phillip Young
• Boost Your Career: Get Practical InfoSec Experience in Your Community
• Breaking the Guest List: Hacking Invitation Systems for Fun and Profit
• Breaking the Illusion: Bypassing Endpoint Security Controls with Simple Tactics
• Broke but Breached: Secret Scanning at Scale on a Student Budget
• BSLV2021 Pros vs. Joes - Closing
• BSLV22-CLOSING
• Campfire cocktails - hello muddler
• Campfire Cocktails - M80 in the campfie
• Campfire cocktails - shrub
• campfire Lighting Ceremony
• Campfire Talks
• Can You Hear Me Now? A Survey of Communications Platforms During Emergencies
• Cascading Failure, Unified Defense: Defending Water, Power, Healthcare, & EMS
• Casting Light on Shadow Cloud Deployments
• CG - 101 Things Your Application is Doing Without Your Knowledge
• CG - A Hackers Guide to Using the YubiKey - How to Add Inexpnsive 2-Factor Authentication to Your Ne
• CG - A Place to Hang Our Hats: Security Community and Culture - Domenic Rizzolo
• CG - All Software is Open Source: An Introduction to Reverse Engineering
• CG - All The Sales President’s Men - Patrick McNeil
• CG - All Your Cloud Are Belong To Us - Hunting Compromise in Azure - Nate Warfield
• CG - An Encyclopedia of Wiretaps - Wendy Knox Everette
• CG - Angler Lurking in the Domain Shadows - Nick Biasini
• CG - Are We too Early for the Party? (the perils of Baking Cyber in from the Beginning)
• CG - Baby Got Hack Back - Jen Ellis
• CG - Backdooring MS Office Documents with Secret Master Keys - Shigeo Mitsunari & Yoshinori Takesako
• CG - Barely Legal: The Hacker's Guide to Cybersecurity Legislation - Jen Ellis
• CG - Beyond Whack-a-Mole: Scaling Vulnerability Management by Embracing Automation
• CG - Big SIEM Energy at micro-SIEM cost
• CG - Busting Biases in Infosec
• CG - CloudSec Rules Everything Around Me (C.R.E.A.M.) - Kyle Dickinson
• CG - Conti Leaks and CARVER Analysis for Threat Intel Analysts
• CG - Cyber Crash Investigations: Seizing the Opportunity to Learn from Past Crises
• CG - Cyber Harassment: Stop the silence, save lives
• CG - DefCon DarkNet Badge Hardware And Software: An Introduction To Custom Badge Building - Edward A
• CG - Demystiphying and Fingerprinting the 802.15.4/ZigBee PHY - Sergey Bratus & Ira Ray Jenkins
• CG - Destructive Malware and Interstate Rivalries: The Evolution of Digital Weapons and Geopolitical
• CG - Diamonds, Fitness and Cults: Manipulation for Fun and Profit - Katie Rodzon
• CG - DLP Sucks and Why You Should Use It - John Orleans
• CG - Don't Hate the Disclosure, Hate the Vulnerability: How the Government is Bringing Researchers a
• CG - Don’t Make This Mistake: Painful Learnings of Applying AI in Security
• CG - EC2 or Bust – How to Build Your Own Pen Testing Lab in Amazon EC2 - Grecs
• CG - Escape the Questionnaire Quagmire: Addressing Security Inquiries From Customers and Prospects -
• CG - Evading Code Emulation: Writing Ridiculously Obvious Malware That Bypasses AV - Kyle Adams
• CG - Free Your Mind: Battling Our Biases
• CG - Getting CVSS, NVD, and CVEs to Work for You: Standardizing and Scaling Your Vulnerability Risk
• CG - Good Doesn’t Always Win: Understanding technical and enterprise tradeoffs in Cybersecurity
• CG - Google Apps Scripts Kill Chain - Maor Bin
• CG - Hack the Hustle! Career Strategies for Information Security Professionals - Eve Adams
• CG - Hacking the Law: A Call for Action – Bug Bounties Legal Terms as a Case Study - Amit Elazari
• CG - Hacking the Next Generation - David Schwartzberg
• CG - Hacks and Crafts: Improvised Physical Security Tools for Improvised Situations - TBD
• CG - Hadoop Safari : Hunting For Vulnerabilities - Mahdi Braik & Thomas Debize
• CG - Have You Distributed Randomness? - Yolan Romailler
• CG - How Embracing Social Media Helped Me Stop the Hackers, Save the World and Get the Girl! - Javva
• CG - How Portal Can Change Your Security Forever - Katrina Rodzon
• CG - How to communicate with non-security specialists to drive action
• CG - How to have perfect vulnerability reports and still get hacked
• CG - How To Respond To Cops Who Want Your Passwords - Stephanie Lacambra
• CG - How to Start a Cyber War: Lessons from Brussels -EU Cyber Warfare Exercises - Chris Kubecka
• CG - How to Win Over Executives and Hack the Board
• CG - How We Accidentally Became Hardware Hackers
• CG - I'm a Little Bit (FedRAMP) Country, I'm a Little Bit SOC2 'n Roll
• CG - IMSI Catchers And The Happy Yellow Helicopter: Security Challenges At Standing Rock - Myron Dew
• CG - Information Sharing, or “I’ve got 99 problems and they’re probably pretty similar to yours” - C
• CG - Insider Threat Kill Chain: Human Indicators of Compromise - Ken Westin
• CG - Introduction to Software Defined Radio – For Offensive and Defensive Operations
• CG - Latest Threats and Vulnerabilities to Mission-Critical SAP Applications
• CG - Lessons Drawn From Cybersecurity In The Rise of Privacy Tech
• CG - Let's Chat About SOC 2s, Baby
• CG - LibreSSL - Moving the Ecosystem Forward - Brent Cook
• CG - Malware Analysis 101 - N00b to Ninja in 60 Minutes - Grecs
• CG - Malware Automation - Christopher Elisan
• CG - Manage Your Attack Surface on a Budget
• CG - Meet the CISO - Panel
• CG - Meet the Nation This Week on Sunday: A Special Vulnerability Edition - Jen Ellis, Leonard Baile
• CG - Mind the Diversity Gap - A Panel Discussion - Alyssa Miller, Chloe Messdaghi, Stephanie Ihezukw
• CG - Minimum Viable Risk Management Program - Rachael Lininger
• CG - Network Survival WCS - James Costello
• CG - On Your Ocean's 11 Team, I'm the AI Guy (or Girl)
• CG - One Port to Serve Them All - Google GCP Cloud Shell Abuse
• CG - Pentesting with Docker - Tom Steele
• CG - Popping the Penguin: An Introduction to the Principles of Linux Persistence - Mark Kita
• CG - Prisoner Number Six - Nimrod Stoler & Lavi Lazarovitz
• CG - Purple Team: How This Color Can Help You And Your Organisation Learn and Get Better - Patrick M
• CG - Pwning Software-Defined Networking (SDN) - Tommy Chin
• CG - Quantum Computing: When will it break Public Key cryptography?
• CG - Raiders of the Lost Artifacts: Racing for Hidden Treasures in Public GitHub Repositories
• CG - Red Teaming a Manufacturing Network (Without Crashing It) - Johnny Medina & Kyle Cucci
• CG - Regulatory Nets vs. The Fishing Hook Of Litigation - Wendy Knox Everette
• CG - Rething, Repurpose, Reuse . . . Rain Hell - Michael Zupo
• CG - Rockstar Role: Security TPM
• CG - Russian Malware in the Ukraine War
• CG - SBOM challenges and how to fix them!
• CG - Secure IT Operations, or, How to Shoehorn Security into a Small/Medium Business
• CG - Securing Your Cloud-Native DevOps: A Zero Trust Approach
• CG - Security Awareness Training Refresh - Lauren Clausen
• CG - Security for AI Basics - Not by ChatGPT
• CG - Security Management Without the Suck - Tim Krabec & Tony Turner
• CG - SHA-1 Backdooring and Exploitation - J.P. Aumasson
• CG - Solving for Somebody Else's Problem: Hacking Devs for Better Security - Sarah Gibson
• CG - Strategies for secure development with GraphQL
• CG - Sure, Let Business Users Build Their Own. What Could Go Wrong?
• CG - Techniques for Escaping the AppSec Labyrinth - Andrew Hay
• CG - The Contemplator Approach: A Tale of Data Enrichment - Rodrigo Brenes & Pedro Rodriguez
• CG - The Erudite Inebriate’s Guide to Life, Liberty, and the Purfuit of Happinefs - Jack Daniel
• CG - The Evolution of Magecart Attacks
• CG - The Exclave Experience: Relocating To 'Almost Canada'
• CG - The History of Malware- From Floppies to Droppers
• CG - The Road to Hell is Paved with Bad Passwords - Chris Kubecka
• CG - The Slings and Arrows of Open Source Security - Tod Beardsley & Mister X
• CG - The Struggle Is Real: My Journey With Mental Health Issues - Joel Cardella
• CG - The Technical Trap
• CG - The Untold Story About ATM Malware - Daniel Regalado
• CG - Towards Effective & Scalable Vulnerability Management
• CG - Travel Hacking With the Telecom Informer - TProphet
• CG - Trust Me, I'm a Robot: Can we trust RPA with our most guarded secrets?
• CG - Understanding, Abusing and Monitoring AWS AppStream 2.0
• CG - Vulnerability & Exploit Trends: A Deep Look Inside The Data - Ed Bellis & Michael Roytman
• CG - Vulnerability Intelligence for All: Say Goodbye to Data Gatekeeping
• CG - Watch Out For That Bus! (Personal Disaster Recovery Planning) - David Minch
• CG - Weaponizing Your Fitness Tracker Against You
• CG - What if Petraeus was a hacker? Email Privacy for the Rest of Us - Fak3r
• CG - What the Yandex Leak Tells Us About How Big Tech Uses Your Data
• CG - Where are the reinforcements? - Brady Nielsen
• CG - Where in the world are Carmen's $adjective cyber attacks: The game show that wonders why things
• CG - Who Maed Dis; A Beginners Guide to Malware Provenance Based on Compiler Type - Lucien Brule
• CG - Who Wants to Be A Regulator: The IoT Security Game Show - Allan Friedman, Jen Ellis, Wendy Knox
• CG - Whose encryption key is this? It's a secret to everybody.
• CG - Why Am I Surrounded By Friggin' Idiots?!? (Because You Hired Them!) - Stephen Heath
• CG - Wrangling Cats: How We Coordinate Red Team Testing
• CG - Yes, You Too Can Perform Daring Acts of Live Acquisition - D0n Quix0te
• CG - You Don't Have to Be Crazy to Work Here: An Honest Talk About Mental Health
• CG - You're just complaining because you're guilty: A Guide for Citizens and Hackers to Adversarial
• CG - Your Ad Here: Helping your organization build their security brand
• CG2 - Alex Dreams of Risk: How the Concept of Being a Craftsman can Help you Find Meaning and Avoid
• CG2 - Attacking and Defending Full Disk Encryption - Tom Kopchak
• CG2 - GTFO FTW: Hacking Your Lifestyle for Fun and Profit - Beau Woods & Taylor Banks
• CG2 - Say It to My Face - Shannon Sistrunk
• CG2 - You Can't Make People Act More Securely, You Can Help Them Want To - Ivan Campbell & Twyla Cam
• Closing Remarks
• Community Defense in Depth: Teaching digital security and privacy practices for the public good
• Copy of CFPs 101 - Tottenkoph, Guy McDudefella, Security Moey, David Mortman
• Cracking 936 Million Passwords
• Cracking Hidden Identities: Understanding the Threat Surface of Hidden Identities...
• Crafts - cantainer securitree
• Crafts - honeypot
• Crafts - macaroni network diagram
• Crafts - tabletop excercise cootie catcher
• Craps, Clout, and Career Chaos: The Game They Forgot to Explain
• Creating the Torment Nexus: Using Machine Learning to Defeat Machine Learning
• Cyber Civil Defense: Volunteers to the Rescue
• Cyber Incident Command System (CICS): A people orchestration layer
• DaemonTamer sits by the fire and reads a book
• Defending Our Water – Defending Our Lives
• Desktop Applications: Yes, We Still Exist in the Era of AI!!!
• Detect and Respond? Cool Story — or Just Don’t Let the Bad Stuff Start.
• Detecting, Deobfuscating, and Preventing Obfuscated Script Execution with Tree‑sitter
• Determining Normal: Baselining with Security Log and Event Data - Derek Thomas
• Don’t be LLaMe – The basics of attacking LLMs in your Red Team exercises
• Dungeons & Dragons: The security tool you didn’t know you needed
• Early BSides retrospective
• Emergency & Urgent Care Remains in Critical Condition
• End of Life (EOL) Equipment should not mean End of Life (Your Life)
• eXes & Oauths They Haunt Me: In-Depth Analysis of OAuthOIDC Misconfigurations & Token Replay Attacks
• Extending Password (in)Security to the Browser
• Fragmentation of CTI: The Deck is Stacked Against the Defenders
• From Help Desk to CISO
• From Interview Questions to Cluster Damage: Adventures in k8s Cluster Shenanigans
• From Interview Questions to Cluster Damage: Adventures in k8s Cluster Shenanigans
• G1234! - (Im)proper Database Authentication - Mitch Wasson
• G1234! - Abusing Password Reuse at Scale: Bcrypt and Beyond - Sam Croley
• G1234! - Active Directory Password Blacklisting - Leeren Chang
• G1234! - An Investigation of the Security of Passwords Derived From African languages - Sibusiso Sis
• G1234! - Anatomy of NTLMv1/NTLMv1-SSP - Evil Mog
• G1234! - Automating Crypto Bugs Discovery - Jean-Philippe Aumasson & Yolan Romailler
• G1234! - Breaking Smart [Bank] Statements - Manuel Nader
• G1234! - Cash in the Aisles: How Gift Cards are Easily Exploited - William Caput
• G1234! - Deploying WebAuthn at Dropbox Scale: Second Factor and Beyond - Brad Girardeau
• G1234! - Enterprise Overflow: How Breached Credentials Impact Us All - Robert Paul
• G1234! - Exploiting Windows Group Policy for Reconnaissance and Attack - Darren Mar-Elia
• G1234! - F! Passwords! - David Zendzian
• G1234! - Fighting Fraud in the Trenches - Amir Shaked
• G1234! - Give the Dog a Bone - Exploring OSINT Capabilities of Pen-testing Tools - John Brunn
• G1234! - Going Passwordless - Evan Johnson
• G1234! - Guardians of GitHub - Joshua Danielson & Dileep Gurazada
• G1234! - How I Met Your Password - Dimitri Fousekis
• G1234! - How To Obtain 100 Facebooks Accounts Per Day Through Internet Searches - Yael Basurto & Gui
• G1234! - Measuring the Use and Abuse of Brain Wallets - Ryan Castellucci & Marie Vasek
• G1234! - My quest for (privileged) identity to own your domain - Nir Yosha
• G1234! - Optimizations for Bitcoin Key Cracking
• G1234! - Password Cracking 201: Beyond the Basics - Royce Williams
• G1234! - Protecting Windows Credentials: An Excessive Guide for Security Professionals - Mark Burnet
• G1234! - Ransombile, Yet Another Reason to Ditch SMS - Martin Vigo
• G1234! - Rethinking P@ssw0rd Strength Beyond Brute-force Entropy - Ross Dickey
• G1234! - Safer Storage and Handling of User Answers to Security Questions - Arnold Reinhold
• G1234! - Sex, Secret and God: A Brief History of Bad Passwords - Kyle Rankin
• G1234! - SSO Wars: The Token Menace - Alvaro Munoz & Oleksandr Mirosh
• G1234! - The Chrome Crusader - Lily Chalupowski
• G1234! - The Effect of Constraints on the Number of Viable Permutations of Passwords - Randy Abrams
• G1234! - Think Complex Passwords Will Save You? - Ian Foster & David Hulton
• G1234! - TMTO...Y? - Steve Thomas
• G1234! - Using Lockpicking to Teach Authentication Concepts - Kat Sweet
• G1234! - Who dis? The Right Way To Authenticate - Lakshmi Sudheer & Dhivya Chandramouleeswaran
• G1234! - Why FIDO Security Keys & WebAuthn are Awesome - Jen Tong
• GF - (De)Serial Killers - Dor Tumarkin
• GF - Actions have consequences: The overlooked Security Risks in 3rd party GitHub Actions
• GF - Adversaries Also Lift & Shift: Cloud Threats Through the Eyes of an Adversary
• GF - Applied Quantitative Risk Analysis - Michael Rich
• GF - ATT&CKing Your Adversaries -- Operationalizing cyber intelligence in your own environment for b
• GF - Becoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations
• GF - Build hybrid mobile applications like a security pro!
• GF - Building Data Driven Access with the tools you have
• GF - CICD security: A new eldorado (talk)
• GF - Clean Forensics: Analyzing network traffic of vacuum bots
• GF - Climbing the Production Mountain: Practical CI/CD Attacks Using CI/CD Goat
• GF - Code Dependency: Chinese APTs in Software Supply Chain Attacks
• GF - CTFs for Fun and Profit: Playing Games to Build your Skills - David Tomaschik
• GF - Detection Engineering Demystified: Building Custom Detections for GitHub Enterprise
• GF - Discover the Hidden Vulnerability Intelligence within CISA's KEV Catalog
• GF - Don't Bring Me Down: Are You Ready for Weaponized Botnets? - Cheryl Biswas
• GF - EHLO World: Spear-Phishing at Scale using Generative AI
• GF - Enemy Within: Leveraging Purple Teams for Advanced Threat Detection & Prevention
• GF - From Vulnerability to CTF
• GF - Get on the Eye Level: Tailoring the Security Talk - Fahmida Y Rashid
• GF - Hidden Networks Pivoting: Redefining DNS Rebinding Attack - Tomer Zait & Nimrod Levy
• GF - Hillbilly Storytime - Pentest Fails - Adam Compton
• GF - How to avoid being labeled a “Chicken Little” while promoting better security decision making
• GF - Hyper-scale Detection and Response
• GF - I got an alert, now what?
• GF - Insert coin: Hacking arcades for fun
• GF - Invoke-NoShell - Gal Bitensky
• GF - Lessons Learned by the WordPress Security Team - Aaron D Campbell
• GF - Look! The scammer is coming!
• GF - Low & Slow - Techniques for DNS Data Exfiltration - Dimitri Fousekis
• GF - Malware Analysis - Red Team Edition
• GF - Musings of an Accidental CISO - Brian Markham
• GF - Navigating Security pitfalls during M&A : Playbooks & Strategies for doing acquisitions right
• GF - Next Generation Enterprise Security
• GF - Nothing Went to Plan..... Because You Didn't Have a Plan
• GF - Open Source GitOps for Detection Engineering
• GF - Parsing Differential Problem
• GF - Pipeline Pandemonium: How to Hijack the Cloud and Make it Rain Insecurity
• GF - Prepare for the Appocalypse - Exposing Shadow and Zombie APIs
• GF - Rolling out the C2: A Take on Modern Red Team Infrastructure
• GF - Security and DevOps are really Best Friends - Emily Gladstone Cole
• GF - Tactics of a Trash Panda
• GF - The Art of Letting Go: Secure delegation of permissions in AWS environments
• GF - The B-side that no one sees: the ransomware that never reached mainstream popularity
• GF - The Importance of Engineering Privacy From the Get Go
• GF - The road to developers' hearts
• GF - The Telenovela of Latin America Banking Trojans: A Dramatic story about Cybercrime
• GF - Tomb Raider - Automating Data Recovery and Digital Forensics
• GF - What is Cyber Threat Intelligece? - John Stoner & Ronnie Obenhaus
• GF - When DevSecOps Fails
• GF - Who Watches the Watchers?: Understanding the Internet's Background Noise - Curt Barnard
• GF - WHOIS the boss? Building Your Own WHOIS Dataset for Reconnaissance
• GF - Windows 10 DFIR and InfoSec Challenges - Andrew Case
• GF - Windows EventLog Persistence? The Windows can help us
• GF - You’ve Gained +2 Perception! Leveling Up Your Red Team with a New Maturity Model
• GF - Zero Days should not be a fire drill
• GT - 101 ways to fail at getting value out of your investments in security analytics ‚Ķ and how not
• GT - A System Dynamics Approach to CNO Modelling - Sara Mitchell
• GT - Advancing Internet Security Research with Big Data and Graph Databases - Andrew Hess
• GT - Adversary Intelligence From Conflict to Consensus - Alex Valdeia & Rich Barger
• GT - AI in a Minefield: Learning from Poisoned Data
• GT - AI in the human loop: GenAI in security service delivery
• GT - All that glitters isn't Chrome: Hunting for Suspicious Browser Extensions - Mike Sconzo
• GT - An Introduction to Machine Learning and Deep Learning - Hillary Sanders
• GT - Another One Bites the Dust: Failed Experiments in Infrastructure Security Analytics and Lessons
• GT - Applying Information Security Paradigms to Misinformation Campaigns: A Multidisciplinary Approa
• GT - Arbitrary Albatross: Neutral Names for Vulnerabilities at Volume - Art Manion & Leigh Metcalf
• GT - Attack Flow: From Data Points to Data Paths
• GT - Back to Basics: Using Descriptive Statistics to Study the Shape of the Internet
• GT - Bad Neighborhoods – data-driven detection of malicious internet infrastructure
• GT - Behavioral Analysis from DNS and Network Traffic - Josh Pyorre
• GT - Birthday Hunting - Jack Burgess
• GT - Building a Benign Data Set - Rob Brandon & John Seymour
• GT - Building an enterprise security knowledge graph to fuel better decisions, faster - Jon Hawes
• GT - Building Your Own AI Platform and Tools Using ChatGPT
• GT - Can Data Science Deal With PAM? - Leila Powell
• GT - Catch me, Yes we can! -Pwning Social Engineers using Natural Language Processing Techniques in
• GT - ClusterF*ck - Actionable Intelligence from Machine Learning - David Dorsey & Mike Sconzo
• GT - Cognitive Security and Social Engineering: A Systems-Based Approach
• GT - Comparing Function Embeddings - Rob Brandon
• GT - Crema: A LangSec-inspired Language - Jacob Torrey & Sergey Bratus
• GT - Cyber risk: How does cyber events become so costly?
• GT - Data Visualization in Security: Still Home of the WOPR? - Matthew Park
• GT - Decision Analysis Applications in Threat Analysis Frameworks - Emily Shawgo
• GT - Deep Learning Neural Networks – Our Fun Attempt At Building One - Ladi Adefala
• GT - Devising and detecting spear phishing
• GT - DoH Deception: Evading ML-Based Tunnel Detection with Black-Box Attack Techniques
• GT - Double Entry Accounting for Security
• GT - Exploration of Novel Visualizations for Information Security Data - Roni Choudhury & Brian Wyli
• GT - F Your ML Model
• GT - GCP BigQuery as Security Detection Platform
• GT - Getting Insight Out Of and Back Into Deep Neural Networks - Richard Harang
• GT - GPT-3 and me
• GT - Grapl - A Graph Platform for Detection and Response - Colin O'Brien
• GT - Grappling Hooks on the Ivory Tower: This Year in Practical Academic Research - Falcon Darkstar
• GT - Hacking Things That Think
• GT - Hidden Hot Battle Lessons of Cold War: All Learning Models Have Flaws, Some Have Casualties - D
• GT - How to Make Metrics and Influence People - Leila Powell
• GT - How to prioritize Red Team Findings? Presenting CRTFSS: Common Red Team Findings Score System
• GT - I won't allow my child to have a smartphone: Why Smart parents make not so smart children
• GT - Improving Security by Avoiding Traffic and Still Get What You Want in Data Transfers - Art Conk
• GT - Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs
• GT - Intro to Data Science for Security - Rob Bird & Alex Shagla-McKotch
• GT - Is Data Visualization Still Necessary? - Edmond Rogers, Grace Rogers & John Stillwell
• GT - Is This Magikarp a Gyarados?: Machine Learning for Phishing Detection - Veronica Weiss
• GT - Know They Operator - Misty Blowers
• GT - Lessons learned while modeling rare catastrophic cyber loss events
• GT - Long Overdue: Making InfoSec Better Through Library Science
• GT - Looking for Smoke Signals in Financial Statements, for Cyber
• GT - Looking For the Perfect Signature: An Automatic YARA Rules Generation Algorithm in the AI-Era
• GT - Magical Thinking... and how to thwart it - Mara Tam
• GT - Making & Breaking Machine Learning Anomaly Detectors in Real Life - Clarence Chio
• GT - Measuring the IQ of Your Threat Intelligence Feeds - Kyle Maxwell & Alex Pinto
• GT - Mining Software Vulns in SCCM / NIST’s NVD– The Rocky Road to Data Nirvana - Loren Gordon
• GT - Model Robustness Isn't Security
• GT - Navigating the Changing Cyber Landscape: Trends, Costs, and Risk Mitigation Strategies
• GT - No More Fudge Factors and Made Up Shit: Performance Numbers That Mean Something - Russell Thoma
• GT - Old Things Are New Again: Efficient Automatic Signature Generation for Malware Detection - Hyru
• GT - Overcoming Barriers in Security DSLs with BabbelPhish
• GT - PhishDefend: A Reinforcement Learning Framework
• GT - Playing Games with Cybercriminals
• GT - PowerShell Classification: Life, Learning, and Self-Discovery - Derek Thomas
• GT - Profiling User Risk: Borrowing from Business Intelligence to Understand the Security of Your Us
• GT - Reassessing 50k Vulnerabilities: Insights from SSVC Evaluations in Japan's Largest Telco
• GT - Reduce, Reuse and Recycle ML Solutions for Security - Ram Shankar Siva Kumar
• GT - Reducing Inactionable Alerts via Policy Layer - John Seymour
• GT - Regular expressions are good, actually
• GT - Repurposing Vulnerability Tickets to Predict Severity Levels
• GT - Revenge on the Worms! Towards Deception Against Automated Adversaries
• GT - Scheming with Machines - Will Pearce
• GT - Scratching the Surface of Risk - Benjamin Edwards & Wade Baker
• GT - Security AI in the real world
• GT - Security data science -- Getting the Fundamentals Right - Richard Harang
• GT - Security Data Science Teams: A Guide to Prestige Classes
• GT - Seek out new protocols, and boldly go where no one has gone before
• GT - Sight beyond sight: Detecting phishing with computer vision - Daniel Grant
• GT - Social Engineering: Training The Human Firewall
• GT - Stop and Step Away from the Data: Rapid Anomaly Detection via Ransom Note File Classification
• GT - Strategies Without Frontiers - Meredith L. Patterson
• GT - Sympathy for the Developer - Sarah Gibson
• GT - That Escalated Quickly: A System for Alert Prioritization
• GT - The Human Factor: Why Are We So Bad at Security and Risk Assessment? - John Nye
• GT - The New Cat and Mouse Game: Attacking and Defending Machine Learning Based Software - Joshua Sa
• GT - The Power Law of Information - Michael Roytman
• GT - The Role of Data Visualization in Improving Machine Learning Models - Phil Roth
• GT - The Semantic Age - or - A Young Ontologist's Primer - Unknown
• GT - Tracking Malicious Logon: Visualize and Analyze Active Directory Event Logs - Shusei Tomonaga
• GT - Transfer Learning: Analyst-Sourcing Behavioral Classification - Ignacio Arnaldo & Tim Mather
• GT - Weeding Out Living-off-the-land Attacks at Scale
• GT - What Do We Learn When We Scan the Internet every hour?
• GT - When Steganography Stops Being Cool - David Sancho
• GT - Who Watches the Watchers? Metric for Security Strategy - Michael Roytman
• GT - Your Model Isn't That Special: Zero to Malware Model in Not Much Code and Where the Real Work L
• GT - ZERO-RULES Alert Contextualizer & Correlator
• GT -Defensive Counting: How to quantify ICS exposure on the Internet when the data is out to get you
• Hack Your Network: Career Connections for Cyber Pros
• Hackers Kinda Like to Eat
• Hacking Secure Coding Into Education
• Hardening Containers with Seccomp: Hands-On Profiles, Pitfalls, and Real Exploits
• Harnessing AI and Post-Quantum Cryptography for Cybersecurity in the Quantum Era
• Hazard Analysis of Military AI Systems Using STPA-Sec...
• HG - Addressing non-linear InfoSec career paths In Infosec - Sarah Young
• HG - Behavioral Interviewee-ing: Inverting the Corporate Interview to Get You Hired
• HG - Behind the Recruiting Curtain: What Do Recruiters Really Say and Do - Matt Duren, Kris Rides, T
• HG - Brute Force Your Job Application
• HG - Community Career Panel or How to Get More than a T-Shirt Working at a Con - Cindy Jones
• HG - Cultivating Resilience: How to Succeed in a Role that Didn’t Exist
• HG - Discovering Your Passion in Cyber Security - Cherie Burgett
• HG - Failing Upwards: How to Rise in Cybersecurity by finding (and exploiting) your weaknesses
• HG - Failing Upwards: How to Rise in Cybersecurity by finding (and exploiting) your weaknesses
• HG - Fast-track your Hacking Career – Why Take The Slow Lane? - Joe Klein
• HG - Finance Industry Career Search Panel
• HG - Find your north star
• HG - From Hacker to Serial Entreprenuer - Matt DeVost
• HG - Hack (Apart) Your Career - How to Fund Doing What You Love - John Grigg
• HG - Hacking College, a Cybersecurity Career, and Certifications - Marcus Carey
• HG - Hacking from Above: A Brief Guide for Transitioning to Leadership - Joey Maresca
• HG - Hacking Is Easy, Hiring Is Hard: Managing Security People - Mike Murray
• HG - Hacking Office Politics for Cybersecurity Leaders - Caroline Wong & Robert Wood
• HG - Hacking Remote Interviewing: Lessons Learned
• HG - Hacking Tech Interviews - Adam Brand
• HG - Hire Ground Kickoff - Lesley Carhart
• HG - How Living and Quilting History made me a better Cybersecurity Professional
• HG - How to Fail Well (In Order to be Successful) - From IT to Infosec & More - Roy Wattanasin
• HG - How To Hack Recruiting: Turning the Tables (Panel) - Steve Levy, Pete Radloff & Kris Rides
• HG - Increasing Retention Capacity - Andrea Little Limbago
• HG - It’s all about Talent
• HG - It’s Not Me, It’s You: How To Be A Better Hiring Manager or Rooting Out Excellent Candidates De
• HG - KEY - How To Accidentally Get A Job In InfoSec. - Johnny Xmas
• HG - Management Hacking 101: Leading High Performance Teams
• HG - Management Hacking 102: Personalities, Empathy, and Difficult Conversations
• HG - Noobs: Training the Next Generation of Security Engineers - David Seidman
• HG - Penetration Testing Experience and How to Get It
• HG - Penetration Testing Experience and How to Get It
• HG - Penetration Testing Experience and How to Get It
• HG - Rate the Recruiter - Ashley Bush & Brian Sheridan
• HG - Recruiter Smack Down (Panel) - Jennifer Kyle, Steve Levy, Pete Radloff & Kris Rides
• HG - Redefining the Hacker - Manju Mude
• HG - Security Lessons From the Woofmutts; Or, How I Learned to Embrace the Slobber… - Chris Roberts
• HG - Separating Fact from Fiction: The Realities of Working in Government
• HG - So Who's Line Is It Anyway? (A Recruiter Panel)
• HG - So Who’s Line Is It Anyway? Recruiter Panel
• HG - Startup Security Leadership: Lessons to Level Up from Fortune 100 to Tech Startup - Ty Sbano
• HG - Stupid Job Posts Don't Matter!
• HG - The Commoditization of Security Solutions: Will You Be Replaced by a Small Script? - Nathan Swe
• HG - The Importance of Culture - Mike Murray
• HG - The Key to Managing High Performance Security Teams - Mike Murray
• HG - The Long Way Around – from Software Engineering to Cyber Security (How Choosing Wrong Turned ou
• HG - Tracking and hacking your career
• HG - What A Career In Public Service Is Really About - Bobbie Stempfley
• HG - What Goes Bump in the Night? Recruiter Panel About Job Search and Other Scary Things
• HG - You CAN get there from here!
• HG - You Need a Jay-z and a Beyoncé
• HG - You're Good and You Should Feel Good - Victor Wieczorek
• Human Attack Surfaces in Agentic Web: How I Learned to Stop Worrying and Love the AI Apocalypse
• I Didn’t Register for This: What’s Really in Google’s Artifact Registry?
• IATC - #SBOM is here: making progress (not excuses)
• IATC - A Good Day to Die? IoT End of Life - Jessica Wilkerson, Allan Friedman, Karl Grindal, Karim
• IATC - A Hacker’s Guide for Changing The World (and Where do we go from Here?)
• IATC - A&Q - Altrusim - Andrea
• IATC - A&Q - Burnout
• IATC - A&Q - Career & Wrapup & Next-Steps - Josh-Corman & Beau-Woods
• IATC - A&Q - Communications Presentation - Keren Elazari
• IATC - A&Q - Disclosure - Katie Moussouris
• IATC - A&Q - Media - Jen Ellis
• IATC - AIs Wide Open - Making Bots Safer Than Completely $#%cking Unsafe - Davi Ottenheimer
• IATC - Blood in the Water: Preparing For the Feeding Frenzy
• IATC - Building Ambassadors to Reduce Friction, Drive Change, and Get Sh*t Done - Katie LeDoux
• IATC - ByteSweep: A Free Software IoT Security Analysis Platform - Matt Brown
• IATC - CAN Bus in Aviation - Patrick Kiley
• IATC - Cavalry is ALL OF US - Joshua Corman, Beau Woods, Rod Soto, Travis Moore & Heath Wickline
• IATC - Certification and Labeling in IoT - Richard Manning
• IATC - Coordinated Disclosure of ICS Products: Who's got time for that? - Jay Angus
• IATC - CVE CVSS NVD OMGWTFBBQ - Tom Millar, Katie Trimble, Art Manion, Seth Carmody & Josh Corman
• IATC - Cyber Safety Disclosure - Nina Alli, Suzanne Schwartz, Jay Radcliffe & Joshua Corman
• IATC - Cybersec and AI Risk Management Challenges for the Next Generation of Public Safety Systems
• IATC - Day One Feedback Loop: What did we hear?
• IATC - Difficult Conversations
• IATC - Energy Poverty and Potential Impacts to Other Critical Infrastructures
• IATC - Engaging Policymakers at the State Level - Maurice Turner, Joe Hall & David Forsey
• IATC - Engaging the Media: Know Your Target - Jen "Cat Herder" Ellis, Joseph Cox, Sean Gallagher, St
• IATC - Engaging the Media: Telling Your Story - Steve Ragan, Sean Gallagher & Paul Wagensell
• IATC - Feds (Panel) - Allan Friedman & Jessica Wilkerson
• IATC - Getting Serious (Un)-Resilience of Lifeline Critical Infrastructure.
• IATC - Hack the Future - Keren Elazari
• IATC - Hackers of the World- Unite? - Keren Elazari
• IATC - Hacking the Pentagon: How a Rebel Alliance Shifts Culture to Protect National Security - Bret
• IATC - Hacking the Public Policy API - Travis Moore, Maurice Turner & Jessica WIlkerson
• IATC - Health Care is in Intensive Care
• IATC - Healthcare in Critical Condition - Christian Dameff & Jeff Tulley
• IATC - HHS Task Force (Panel) - Josh Corman
• IATC - How to Treat Your 'Hacker' (and Responsible Vulnerability Disclosure) - Monta Elkins
• IATC - Hungry, Hungry Hackers
• IATC - Hungry, Hungry Hackers: A Hacker’s Eye-view of the Food Supply
• IATC - I Am The Cavalry Track Welcome and Overview - I Can Do This All Day? - Joshua Corman & Beau W
• IATC - I Just Want to Help Make Flying More Secure...not Work with the Government or How I Learned t
• IATC - IATC Closing - TBD
• IATC - IATC Cyber Crisis Simulation - Keren Elazari, Jay Healey & Chris King
• IATC - IATC Mock Congressional Hearing - John Costello, Jay Healey & Jessica Wilkerson
• IATC - ICS Security Assessments 101 or How da Fox I Test Dis?
• IATC - Internet of Cars - Abe Chen, Chris King & Kevin Tierney
• IATC - Introduction to I Am The Cavalry - Day Two - Preparing for 2027
• IATC - Introduction to IATC Day Two
• IATC - Introduction to the Track, Reflections on a Decade of IATC
• IATC - KEY - IATC Kickoff - Josh Corman, Keren Elazari & Beau Woods
• IATC - Kickoff & Panel - Joshua Corman & Beau Woods
• IATC - Leading in a "Do"-ocracy - Tod Beardsley, Chris Nickerson & Beau Woods
• IATC - Lessons Learned from the CISA COVID Task Force & Healthcare Attacks
• IATC - Lightning Talks: Thinking Different - David Batz, Steven Luczynski, Caroline Wong & Bob Wood
• IATC - Living With the Enemy – How to protect yourself (and Energy Systems)
• IATC - M33t the Press: CyberSafety Got Real: Now What?
• IATC - No IOUs with IOT - Bryson Bort
• IATC - Public Policy of Things - Jessica Wilkerson
• IATC - Public Service Journeys (To and From Hacking Culture)
• IATC - QuadBlockQuiz - Supply Chain Sandbox Edition
• IATC - Real World Security in a Clinical Healthcare Environment: Hacking a Hospital - Paul Dant
• IATC - Red/Blue Q&A: Pressure Test Lightning Talk Ideas (Panel) - TBD
• IATC - Rivers on Fire; Shaping the next phase of the mission
• IATC - Saving Lives in Healthcare
• IATC - Security Trek: The Next Generation
• IATC - State of Automotive Cyber Safety - Josh Corman
• IATC - State of Medical Device Cyber Safety - Beau Woods & Scott Erven
• IATC - STUFF is on Fire - a Panel
• IATC - Stupid Hacker Tricks: Bridging Airgaps and Breaking Data Diodes - Monta Elkins
• IATC - Target Rich Cyber Poor
• IATC - Technical Tactics: Embedded Linux Software BOM - Daniel Beard
• IATC - Technical Tactics: Fear & loathing in Building Management Systems - Edward Farrell
• IATC - The Case for Software Bill of Materials - Allan Friedman
• IATC - The Hip Hacker's Guide to Policy
• IATC - Time is up. You have three years, 3 months, 3 weeks, to protect your Stuff. What do you do?
• IATC - Track Introduction and Overview - Part 1 - Josh Corman & Nicholas J. Percoco
• IATC - Track Introduction and Overview - Part 2 - Josh Corman & Nicholas J. Percoco
• IATC - Transforming Industries for Fun and Safety (Panel) - Pete Cooper, Matthew Vaughan & Jeff Troy
• IATC - Transforming Industries for Fun and Safety (Presentation) - Beau Woods & David Rogers
• IATC - Wars and Rumors of Wars - What are the implications for Domestic Critical Infrastructure?
• IATC - Water, Water Everywhere: The Krakens, Kelpies, and Mermaids in today’s Water Sector
• IATC - We the People: Providing for a 'common defence' with CVD - Cameron Dixon & Matthew Cornelius
• IATC - We're not from the government, but we're here to help them help you
• IATC - Why journalists and hackers need each other (a panel discussion with infosec reporters) - Sea
• IATC - Your critical system IS (NOT?) vulnerable: CSAF, VEX, SBOM and the future of advisories
• Increasing Complexity and Frequency of Cyber Events: Trends, Costs, and Risk Mitigation Strategies
• Indexing the Chaos: Extract PII from Ransomware Leaks
• Infiltrating Like a Ninja: Unveiling Detection Gaps in Physical Security Across Japan and the U.S.
• Innovative, Shiny, and Vulnerable: Four Ways to Exploit Modern SaaS Data Platforms
• Inside the Open-Source Kill Chain: How LLMs Helped Catch Lazarus and Stop a Crypto Backdoor
• Interview Like a Legend: No Slides, Just Vibes
• I’m A Machine, And You Should Trust Me: The Future Of Non-Human Identity
• Keeping Our History Alive: The Hacker’s Guide to Sticker Preservation
• KEY - Oepning Keynote - Beyond Good and Evil: Toward Effective Security - Adam Shostack
• Keynote - Beyond logs and time series: observability for security & privacy
• KEYNOTE - Cold Case Cyber Investigations: Catfishing Cooper and Other Ops - Jim Christy
• KEYNOTE - Ghosts of Past, Present, and Future - Bob Lord
• KEYNOTE - How To Lose Friends and Influence People (An Apology) - Josh Corman
• Keynote - Opening Remarks - Day Two
• KEYNOTE - Q&A - Ghosts of Past, Present, and Future - Bob Lord
• KEYNOTE - Something Wicked: Defensible Social Architecture in the context... - Allison Miller
• KEYNOTE - Something Wicked: Defensible Social Architecture in the context... - Allison Miller
• KEYNOTE - The Best of Security BSides Now and Then: Ten Years of Mixes - Jack Daniel
• KEYNOTE - The State of Security BSides - Jack Daniel
• Keynote, Day 1: "Secure AI" is 20 years old
• Keynote, Day 2: Homicideware
• Keynote: Fragilience - The quantum state of survivable resilience in a world of fragile indifference
• Keynotes - Closing Ceremony
• Keynotes - Opening Remarks - Day One
• KN - A Fireside Chat With Jack Daniel and Chris Krebs
• KN - Konrad Koerding
• Laser Beams & Light Streams: Building Affordable Light-Based Hardware Security Tooling
• Lessons from Black Swan Events and Building Anti-Fragile Cybersecurity Systems
• Let’s Go Shopping: Third-Party Vendors and CyberRisk
• Locking Hands: Ransomware Meets Bioimplants
• Lockpicking intro
• LT - Attribution Shmatribution! FIX YOUR SHIT! - Krypt3ia
• LT - Breach Panel - Davi Ottenheimer, Raymond Umerley, Jack Daniel, Steve Werby, David Mortman & Geo
• LT - Calling All Researchers: A Discussion on Building a Security Research Framework - Michael “DrBe
• LT - Cookie Reuse - Sam Bowne
• LT - Cross Platform Metasploit Payloads - B Perry
• LT - Evil Empire: SIEM FTW - EggDropx & CheezMan
• LT - GPS Hacking - Recompiler
• LT - Hack Cellular Metabolism By Targeting Mitochondria - Ambimorph
• LT - Least Authority File System - Zooko
• LT - SSD Data Evaporation - Sam Browne
• LT - You Are Being Watched! - Bharat Jogi
• Machine Identity & Attack Path: The Danger of Misconfigurations
• Malicious Packages – they’re gonna get ya!
• Manufacturing Breakthroughs: How Conflict Leads to Innovation
• Mental Models to Anticipate the Next Stages of the AI and Cybersecurity Revolution
• My friend Ben: solid employee, DPRK agent
• Neighborhood & Household Resilience – A Month Without External Assistance
• No IP, No Problem: Exfiltrating Data Behind IAP
• Opening Remarks
• Opening Remarks, Monday: Breaking Ground
• Opening Remarks, Tuesday: Breaking Ground
• Password Expiry is Dead: Real-World Metrics on What Rotation Actually Achieves
• Password ~Audit~ Cracking in AD: The Fun Part of Compliance
• Passwords: Policies, Securing, Cracking, and More
• PEBKAC Rebooted: A Hacker’s Guide to People‑Patching in 90 Days
• PG - #edsec: Hacking for Education - Jessy Irwin
• PG - (In)Outsider Trading - Hacking Stocks Using Public Information and Influence - Richard Hocking
• PG - +10 Knowledge: Sharing What You Learn For The Benefit of the Everyman - Ashley Miller
• PG - A Day in the Life of a Product Security Incident Response Manager - Tyler Townes
• PG - A New Host Touches the Beacon
• PG - A Quick Story Of Security Pitfalls With Exec Commands In Software Integrations
• PG - Adding +10 Security to Your Scrum Agile Environment - Josh Louden
• PG - An adversarial approach to Airline Revenue Management
• PG - Analyzing AutoIt Malware: Tools and Techniques
• PG - Analyzing user decision making on phishing sites - using mouse data and keyboard dynamics - San
• PG - And what if it was hacked? Tactics and Impacts of Adversarial Machine Learning
• PG - Applied OSINT: Enabling Better Social Engineering for Better Pen Tests - Joe Gray
• PG - Are you content with our current attacks on Content-Type?
• PG - Aristotle In Security: How an Ancient Greek Can Improve Your Security Program
• PG - Attacking Drupal - Greg Foss
• PG - Back Dooring the Digital Home - David Lister
• PG - Baited Canaries - Monitoring Attackers With Active Beacons - Gregory Caswell
• PG - Bestsellers in the Underground Economy - Measuring Malware Popularity by Forum - Winnona DeSom
• PG - Black Magic and Secrets: How Certificates Influence You - Robert Lucero
• PG - Breaking Microsoft Dynamics Great Plains - An Insider's Guide - David Keene
• PG - Breaking the Bodyguards - Chrissy Morgan
• PG - Breaking The Giants With Logic
• PG - Brick in the Wall vs Hole in the Wall - Caroline D. Hardin
• PG - Bridging the Air Gap: Cross Domain Solutions - Patrick Orzechowski
• PG - Broken Arrow: The Enemy is Inside the Perimeter - Will Baggett
• PG - Building a Culture of Cybersecurity: A Case Study Approach to Enhancing Risk Management
• PG - Building a Security Audit Logging System on a Shoestring Budget
• PG - Building A Teaching / Improvement Focused SOC - Andrew Gish-Johnson
• PG - Building the badge- How you can make small, cheap and custom hardware for function or fashion -
• PG - Burpsuite Team Collaborator: Enabling Collaborative App Testing - Tanner Barnes
• PG - Bypassing Antivirus Engines using Open Sourced Malleable C2 Software, MSFVenom, Powershell and
• PG - Can I Code Against an API to Learn a Product? - Adrienne Merrick-Tagore
• PG - Catching Linux Post-Exploitation with Auditd - Eric Gershman
• PG - Cats and Mice - Ever Evolving Attackers and Other Game Changers - Eric Kmetz
• PG - Check That Certificate - Jacob Jernigan & Andrew Sorensen
• PG - Classic Misdirection: Social Engineering to Counter Surveillance - Peter Clemenko III
• PG - Convincing Your Management, Your Peers, And Yourself That Risk Management Doesn't Suck - Josh S
• PG - Cover Your A**: How to Protect Yourself as an Independent Security Consultant - Suchi Pahi
• PG - Cruising the MJ Freeway: Examining a large breach in legal Cannabis - Rex
• PG - CTF All the Things: Leveraging Gamification to Up Your Security Game - Matt Pardo
• PG - Cut the Sh*t: How to Reign in Your IDS - Tony Robinson/da_667
• PG - CVSS v4 – A Better Version of an Imperfect Solution
• PG - Cyber Deception after Detection: Safe observation environment using Software Defined Networking
• PG - Deepfakes, Deep Trouble: Addressing the Potential Impact of Deepfakes on Market Manipulation -
• PG - Demystifying SBOMs: Strengthening cybersecurity defenses
• PG - Disabling Encryption to Access Confidential Data - Christopher Simon Hanlon
• PG - Disinform your Surroundings: AI and disinformation campaigns
• PG - Do You Understand the Words That Are Coming Out of My Mouth
• PG - Dropping Hell0days: Business Interaction for Security Professionals - Or Anyone Else - Elliot J
• PG - Embedding Web Apps in MITMProxy Scripts - Chris Czub
• PG - Enemy at the Gate, and Beyond: Detecting and Stopping Account Takeover
• PG - Engineering My Way Into InfoSec - Nitha Suresh
• PG - Everything is Not Awesome: How to Overcome Barriers to Proper Network Segmentation - Jason Beat
• PG - Examining DES-based Cipher Suite Support within the TLS Ecosystem - Vanessa Frost
• PG - FAA, FTC, FCC - FU: How Three F'ing Agencies Are Shaping Info Sec - Elizabeth Wharton
• PG - Fight Back - Raising Awareness @Infosec - Petri Koivisto
• PG - Firmware Security 101 - Arpita Biswas
• PG - Flameout - Burnout Supernova - Dan Ward
• PG - From SOC to CSIRT - Ben Butz
• PG - Fun With WebSockets Using Socket Puppet - Mister Glass
• PG - Gamification of Tabletop Exercises
• PG - Geek Welfare - Confessions of a Convention Swag Hoarder - Rachel Keslensky
• PG - GEN-Z Critique on SOC 2
• PG - Hackers vs Auditors - Dan Anderson
• PG - Hacking Trust Establishment
• PG - How I Learnt Hacking in High School - Lokesh Pidawekar
• PG - How I Managed to Break Into the InfoSec World With Only a Tweet and an Email - Michael Fornal
• PG - How to Escalate Privileges to Administrator in Latest Windows - Soya Aoyama
• PG - How to Succeed as a Freelance Pentester
• PG - Human honeypots, or: How I Learned to Stop Worrying and Love The Implant - Nick Koch
• PG - I Club and So Can You - Christopher Lamberson
• PG - I Club and So Can You - Christopher Lamberson
• PG - I Got More Games Than Milton Bradley: Incentivize a Positive Change in Your Security Culture -
• PG - Implementing the Three Cs of Courtesy, Clarity, and Comprehension to Optimize End User Engageme
• PG - Incorporating Human Intelligence (HUMINT) into An Information Security Team - Aamil Karimi
• PG - Intel-Driven Adversary Simulation for A Holistic Approach to Cybersecurity
• PG - Interrogation Techniques for Fun and Profit: Designing Better Tools for Your SOC Team - Karolyn
• PG - Introduction to Reversing and Pwning - David Weinman
• PG - iOS URL Schemes: omg:// - Guillaume Ross
• PG - I’m a hunter! Cyber Intelligence in the New(ish) Frontier - Yasmine Johnston-Ison
• PG - Legendary Defender - The Voltron Analogy - Brian Carey
• PG - Lightning Talks
• PG - Lotus Notes Password Hash Redux - Willaim Ghote
• PG - Mainframed - The Forgotten Fortress - Phil Young
• PG - Making Your Website Vulnerable for Fun and Security Awareness - Kenny Jansson
• PG - Matriux Leandros:An Open Source Penetration Testing and Forensic Distribution - Prajwal Panchma
• PG - Maximizing Bro Detection - John B. Althouse
• PG - Messing with Forensic Analysts: Modifying VSS Snapshots - James Clawson
• PG - Metrics That Suck Even Less - Walt Williams
• PG - Mirror Mirror - Reflected PDF Attacks Using SQL Injection - Shawn Asmus & Kristov Widak
• PG - Modern Political Warfare: A Look at Strategy and TTPs - Sina Kashefipour
• PG - Never Mind Your Diet, Cut the Crap From Your Vocabulary - Keli Hay
• PG - No InfoSec Staff? No Problem - Anthony Czarnik
• PG - Not Your Grandpa's Password Policy - Kevin T Neely
• PG - Oauth third party not departing
• PG - OH-SINT: Merging OSINT Into RE Workflows to Simplify Analysis
• PG - One OSINT Tool to Rule Them All - Emilie St-Pierre
• PG - Oops, That Wasn't Supposed To Happen: Bypassing Internet Explorer's Cross Site Scripting Filter
• PG - Out of Denial: A 12-Step Program for Recovering Admins - Paul Lee
• PG - PCR 9: How a simple misconfiguration can break TPM full disk encryption
• PG - Phishing: Going From Recon to Credentials - Adam Compton & Eric Gershman
• PG - Please Inject Me, a x64 Code Injection - Alon Weinberg
• PG - Practice Safe Cyber: The Miseducation of American Students on Internet Safety - Vivienne Pustel
• PG - Pwn All The Mobile Porn Apps - Ben Actis
• PG - Pwning the Hapless or How To Make Your Security Program Not Suck - Casey Dunham & Emily Pience
• PG - Radio Frequencies All Around Us! What Data Are You Leaking and What is Done With It? - Keya Lea
• PG - Revisiting the Analog Hole: Using OCR and other techniques to exfiltrate data
• PG - Robust Defense for the Rest of Us - Russell Mosley
• PG - Salesforce Data Governance: What 'Dark Secrets' Lurk in Your Instance? - Pete Thurston
• PG - Satellite Vulnerabilities 101 - Elizabeth Wilson
• PG - Scamming the Scammers - Becoming the Robin Hood of the Phones - Nathan Clark
• PG - Secure Mail Takes Professionalism - Jeremy Brown & Ms. Cheryl Biswas
• PG - Secure your AWS accounts without breaking the bank
• PG - Securing and Trusting Third-Party Javascripts in Your Web App
• PG - Securing Fast (and Furious) DevOps Pipelines - Abdessamad Temmar
• PG - Securing Sensitive Data: A Strange Game - Jeff Elliot
• PG - Serial Box - Primer for Dealing with Serial and JTAG for Basic Hardware Hacking - Matthew Jakub
• PG - Shining a light into the security blackhole of IoT and OT
• PG - Shot With Your Own Gun - How Appliances Are Used Against You - Christpher Campbell
• PG - SIEMple Technology - Bill Davison
• PG - Sixteen Colors: Archiving the Evolution of ANSI and ASCII Art - Doug Moore
• PG - So You Think You Can CHMOD - Jared Chandler
• PG - Social Engineering at Scale, For Fun - Sara-Jayne Terp
• PG - Social Media in Incident Response Program - JoEtta LeSueur
• PG - Speaking Metrics to Executives - Michael St. Vincent
• PG - Stop Shooting Blanks: No Magic Bullets in Your Arsenal - Renegade6
• PG - Taking D-Bus to Explore the Bluetooth Landscape
• PG - Teach a Man to Phish - Vinny Lariza
• PG - The Birds, the Bees, and the CVEs
• PG - The Blooming Social Media Economics Built on Fake Identites - Jason Ding
• PG - The Brazillian DeepWeb. How Brazilian fraud groups work on Telegram and WhatsApp
• PG - The Current State of Adversarial Machine Learning - Heather Lawrence
• PG - The drunk colonel and the flipped stone: Game Theory for a Defensive Strategic Advantage - Vane
• PG - The Goodness is Baked In: Baking Assurance into Software - Ebony
• PG - The Immortal Retrofuturism of Mainframe Computers and How to Keep Them Safe
• PG - The Journey to ICS - Larry Vandenaweele
• PG - The Little Dutch Boy - D0n Quix0te
• PG - The Lore shows the Way - Eric Rand
• PG - The Resilient Hacker: Growth Mindset, Health Hacks & Powerful Help to Navigate Personal Challen
• PG - The Sensual Side of 3D Printing - Kat Sweet
• PG - The Seven Habits of Highly Effective CISOs - Franklin Tallah
• PG - The SOC Counter ATT&CK - Mathieu Saulnier
• PG - The Struggles of Teaching Automation - Joe O'Connell
• PG - The Truth, You Thought We Wouldn’t Know? - Wolf Flight
• PG - Threat Modeling at Scale: More than shifting left
• PG - Training With Raspberry Pi - Nathaniel Davis
• PG - Treble or Trouble: Where Android's Latest Security Enhancements Help And Where They Fail - Tami
• PG - Two-Factor Auth - Demand Bidirectional - Joe Kirwin
• PG - Understanding the Human API: Evolving End Users From Authorized Adversaries Into Our Best Defen
• PG - Unifying the Kill Chain - Paul Pols
• PG - Unleashing the Future of Development: The Secret World of Nix & Flakes
• PG - Using Machine Learning to Support Information Security - Alex Pinto
• PG - Vulnerabilities in Application Whitelisting: Malware Case Studies - Jared Sperli & Joe Kovacic
• PG - Vulnerability Management 101: Practical Experience and Recommendations - Eric Bryan
• PG - What I Learned As A Con-Man - Master Chen
• PG - What is Agile and How Can I Use it Well? - Nicole Schwartz
• PG - What Lurks in the Shadow - Cheryl Biswas
• PG - What the Heck Is This Radio Stuff Anyway? - Nick Kartsioukas
• PG - Why We Can't Have Nice Things: Original Research on Conflict Resolution Styles in Information S
• PG - You can be neurodivergent and succeed in InfoSec
• PG - Your Facts Are Not Safe with Us: Russian Information Operations as Social Engineering - Meagan
• PG - ZOMG It's OSINT Heaven! - Tazz Tazz
• Phish-Back: How to turn the problem into a solution.
• Poison in the Wires: Interactive Network Visualization of Data Attacks
• Power Play: AI Dominance Depends on Energy Resilience
• Predicting the Lifespans of Internet Services: Falling down the ML Rabbit Hole, and What We Learned
• Proactive Password Leak Processing - Bruce Marshall
• Prompt Hardener – Automatically Evaluating and Securing LLM System Prompts
• PW - A Journey To Zero Trust
• PW - All Things FIDO (Panel + Q&A)
• PW - All your badge are belong to me
• PW - Are You Sure That You Still Need Passwords? - Björn Pirrwitz & Daniele Vantaggiato
• PW - Are your secrets safe - How mobile applications are leaking millions of credentials
• PW - Auth for Encrypted Services with Server Side APT - Steve “Sc00bz” Thomas
• PW - Blind Hashing - Jeremy Spilman
• PW - Breachego - Christian Heinrich & Daniel Cuthbert
• PW - Breaking Historical Ciphertexts with Modern Means
• PW - bscrypt - A Cache Hard Password Hash
• PW - Can a password management service safely learn about users' passwords?
• PW - Cloud Attack: Dissecting Attack Paths with Graph-Mode
• PW - Combating phone spoofing with STIR/SHAKEN
• PW - Comparing Centrally and Locally Verified Memorized Secrets
• PW - Could Passwordless be Worse than Passwords?
• PW - Cracking passwords for good, bad & commercial purposes: second thoughts on password cracking
• PW - CVE Hunting: Wi-Fi Routers, OSINT & 'The Tyranny of the Default'
• PW - Detecting Credential Abuse
• PW - Do you know where your secrets are? Exploring the problem of secret sprawl
• PW - Harvesting Passwords from Source Code Repositories - Philippe Paquet
• PW - How I hacked a bank using pen & paper
• PW - How Secure Are Multi-Word Random Passphrases? - Bruce Marshall
• PW - How to Handle Getting Dumped: Compromised Passwords
• PW - I forgot My Password - Michal Špaček
• PW - I know...But I Have a System
• PW - Long Live Short Lived Credentials - Auto-rotating Secrets At Scale
• PW - No More Graphical Passwords - Mark Burnett
• PW - Passkeys: Where we started and where we're going
• PW - Password Alert by Google - Drew Hintz
• PW - Password Privacy Keystroke Dynamics - Per Thorsheim
• PW - Password surveys are shit!
• PW - Password911: Authentication Adventures in Healthcare
• PW - Passwords 101
• PW - PBKDF2: Performance Matters - Joseph Birr-Pixton
• PW - Picking a fight with the banks
• PW - Poppin' (Digital) Locks - Devin Egan
• PW - Practical Perimeter-less authentication solutions for Startups using AWS native solutions
• PW - Privileges in the Real World: Securing Password Management - Andrey Dulkin
• PW - Protecting Against Breached Credentials in Identity Workflows
• PW - Pushing on String: Adventures in the 'Don't Care' Regions of Password Strength - Cormac Herley
• PW - Scrutinizing WPA2 Password Generating Algorithms in Wireless Routers - Eduardo Novella
• PW - Secrets of the Second Factor: Threat Hunting with Multi Factor Authentication
• PW - Security Questions Considered Harmful - Jim Fenton
• PW - Standardizing Password Surveys
• PW - Stronger Password-Based Encryption Using I/O Hardness - Greg Zaverucha
• PW - Tell Me Who You Are and I Will Tell You Your Lock Pattern - Marte Løge
• PW - That's not my name
• PW - The attackers guide to exploiting secrets in the universe
• PW - The One With The Foreign Wordlist
• PW - Towards Standardizing Comparisons of Password Guessability - Sean M. Segreti & Blase Ur
• PW - Unspeakable Passwords: Pronounceable or Diceware - Jeffrey Goldberg
• PW - We removed passwords, now what?
• PW - What Would Fix Passwords? Some Weekly Password Audits. Pretty Graphs to Prove it! (A Haiku) - D
• PW - Why kidz couldn't care less about your password advice.
• PW - Your Passwords Should Be Shorter
• PW - Zero downtime credential rotation
• RAG Against the Machine: Using Retrieval-Augmented Generation & MCP to Fortify Cybersecurity Defense
• RAGnarok: Assisting Your Threat Hunting with Local LLM
• Ransomware As Canary For Societal Disruption
• Reversing F5 Service Password Encryption
• Rewriting the Playbook: Smarter Vulnerability Management with EPSSv3, CVSSv4, SSVC & VEX Frameworks
• Risk it for the Biscuit: Crunching the Numbers on Cyber Threats
• Root To CISO or not?
• Russian Nesting Dolls: Turla got into the ISI who was into an Indian Embassy, & how we found them
• Rusty pearls: Postgres RCE on cloud databases
• Securing AI Infrastructure: Lessons from National Cybersecurity Strategies...
• Securing Frontends at Scale: Paving our Way to the Post-XSS World
• Security Theater, Now Playing: When Security Is a Sideshow Instead of a Strategy
• Setting the Table – WarGames 2027 & Maslow’s Hierarchy of Needs as Hybrid Warfare Nears
• Shedding Light on Web Isolation Technologies and Their Bypass Techniques...
• Shorts Begone: Modding YouTube on iOS (without jailbreaking)
• SIGMA, one rule to find them all
• So You Want to Give A Talk: How to Write a CFP
• SOC Like a Genius: Cognitive Agents Delivering Wisdom at Scale
• So… You want to build your own hacking device…
• Stealing Browser Cookies: Bypassing the newest Chrome security measures
• Take all my money – penetrating ATMs
• Taking down the power grid!
• The (Un)Rightful Heir: My dMSA Is Your New Domain Admin
• The Age of Zygote Injection
• The Art of Concealment: CVE’s Challenge with Transparency
• The HMAC Trap: Security or Illusion?
• The Not So Boring Threat Model of CSP-Managed NHI’s
• The Perfect BLEnd: Reverse engineering a bluetooth controlled blender for better smoothies
• The Protocol Behind the Curtain: What MCP Really Exposes
• The Rise of Synthetic Passwords in Botnet & Attack Operations
• The Scene is Dead
• The Two Types of Fool – Generations in Cybersecurity
• The Unbearable Weight of Commercial Licensing. Combining Closed Systems with Open Source Defense
• The World Famous Hire Ground Panel, Tuesday Edition
• Thinking Outside the SOC: Structured Analytics for the Overloaded Cyber Analyst
• Thwarting Key Extraction and Supply Chain attacks by Detonating GPUs
• Time is Running Out – Tying it All Together – What Will You Do in the Near Term?
• Turbo Tactical Exploitation: 22 Tips for Tricky Targets
• UG - Your Droid Has No Clothes - Mike Murray & Allan Zhang
• Unawakened Wakeup: A Novel PHP Object Injection Technique to Bypass __wakeup()
• UNION SELECT * FROM hackers...
• Vulnerabilities Beyond CVEs: Cyber Resilience and the Next Financial Crisis
• We Fight for the User’s… Session
• What Should CVE Be When It Grows Up
• What to Tell Your Developers About NHI Secrets Security and Governance
• When Attackers Tune In: Weaponizing LLM Tuning for Stealthy C2 and Exfiltration
• When the Breach Hits the Fan: Understanding Cyber Insurance
• Where’s Waldo? Why Recruiters Can’t Find You (and What To Do About It)
• Who Scans the Scanner? Exploiting Trend Micro Mobile Security
• XSS is dead – Browser Security Features that Eliminate Bug Classes
• Your Interview Game is Weak: Gamifying Technical Interviews through Role-Playing