AI is accelerating cyberattacks while recovery remains slow, making the costs of conflict harder to contain. Drawing on SEC filings and attacks on hospitals and suppliers, this keynote examines recovery, economic fallout, and the erosion of the boundary between cybercrime and warfare.

AI’s capabilities in bug discovery, exploitation, and reverse engineering have made Linux kernel exploits cost < $20, and OpenBSD exploits no longer rare. This keynote discusses applying frontier models to computer security problems, successes and failures, future challenges and preparations.

This talk is the story of hunting for a zero day Windows Local Privilege Escalation (LPE) destined for a hacking competition, successfully weaponizing it, and then watching the payout evaporate entirely due to unlucky timing and an inconvenient patch.

This session examines proxy and relay infrastructure used to collect and exfiltrate geospatial data, covering its design, purpose, daily operations, national security implications, network observations, and potential attribution of backend interfaces.

Cybersecurity’s autonomous capabilities often operate in silos. Introducing Autonomous Mission Assurance: a human-governed architecture connecting development, operations, validation, compliance, remediation, and monitoring through shared context, evidence, orchestration, and bounded autonomy.

Examines perimeter device compromises through a real-world edge appliance intrusion, showing how attacker tactics have evolved, why these cases are hard to investigate, and how defenders can improve visibility, readiness, and response.

CCCS presents an LLM-driven purple-team pipeline that automates detection engineering, adversarial testing, telemetry validation, hardening, and triage. The talk examines architecture, failure modes, and which capabilities genuinely improved analyst effectiveness.

This talk explores AI’s benefits and pitfalls in malware analysis, emphasizing the role of domain expertise. Using LegionLoader as a case study, it covers agent-assisted unpacking, C2 analysis, and extraction of cryptographic keys and indicators.

Explore how Windows access tokens govern permissions, follow processes and threads, and enable impersonation. Learn how attackers abuse tokens to escalate privileges—and what defenders can monitor to spot misuse.

This talk traces an unusual surveillance operation tied to a real-world event, combining infrastructure analysis, OSINT, and on-the-ground context to reveal a novel commercial-spyware infection vector and explore its implications for espionage, attribution, and the future of surveillance.

A case study of forged X.509 certificates used to intercept logins to Cisco SSL VPNs at U.S. government networks. Learn how the technique connects to proxy infrastructure and how JA4 fingerprinting can help defenders detect and disrupt similar attacks.

Military AI can aid high-stakes decisions, but visible reasoning may not reflect how newer models reach conclusions. This talk examines the resulting trust gap and explores alternatives to chain-of-thought for meaningful human oversight.

This talk examines how AI can build and analyze social graphs of adversarial networks, using China’s vulnerability research ecosystem as a case study. It explores how incomplete or leak-skewed data can distort graph algorithms—and how analysts can mitigate these pitfalls.

Experts in AI-enabled cyber offense and defense examine real shifts in exploit development and malware, separate credible risks from hype, and explore how organizations can govern and control increasingly capable AI agents.

PANELIST: Faster Than Our Guardrails - AI on Offence, Defence and Everything in Between

Lightning Talk Speaker

Lightning Talk Speaker

Lightning Talk Speaker