In this talk, I’ll share the story of how our team built an open-source, in-house Software Composition Analysis (SCA) tool to better manage third-party dependencies across projects. Rather than relying on expensive, rigid commercial tools, we built something lightweight, free, and flexible—designed to actually work within real engineering workflows.I’ll walk through the motivations, technical decisions, and lessons learned along the way—from implementing custom dashboards and scoring systems to integrating it directly into CI/CD pipelines. I’ll also touch on how we automated updates and prioritized risks more effectively.As part of the session, I’ll run a live demo of the tool to show how it works in practice—scanning dependencies, flagging vulnerabilities, generating reports, and offering a quick view of security posture. This will give attendees a clear sense of how they can start using or adapting it themselves.

What happens when you ask for of today's top Gen AI tools to generate an action figure of you using the exact same prompt? In this provocative and visually engaging session, we will explore how widely different outputs ranging from bias caricatures to eerily, accurate replicas expose critical vulnerabilities, and how identity trust and authenticity are interpreted by using real examples from this experiment. Each flawed replica is mapped to a broader cyber security threat from synthetic identity fraud to inconsistent trust signals to model bias, and the symmetry of fraud detection. We will unpack how these risks are already playing out in the ecosystem where milliseconds matter and near perfect fakes are enough to bypass legacy controls.

This session examines the security gaps created when SOCs focus only on structured data. Faris Suleiman outlines how unstructured data such as documents, emails, media files, and shared content hides sensitive information and attacker activity. The talk highlights common blind spots, leakage patterns, and the controls needed to extend monitoring, classification, and detection to the unstructured layer.

Modern software supply chain attacks are stealthy, sophisticated, and increasingly bypass traditional security tools. Malicious dependencies, compromised CI/CD pipelines, and tampered build artifacts can quietly infiltrate production without triggering static scanners. As defenders, we need to shift our focus — not just left, but forward — into runtime behavior.This session introduces a powerful new approach: using eBPF (Extended Berkeley Packet Filter) as a runtime observability engine to detect and analyze suspicious activities originating from your CI/CD and deployment pipelines. We’ll walk through real-world attack scenarios that bypass static analysis and show how custom eBPF probes can uncover malicious behavior like unauthorized file reads, unexpected outbound connections, or untrusted process executions — all without modifying your application or containers.You’ll learn how to build an efficient eBPF-based runtime layer that complements your existing SAST/SCA tools and enables post-deployment defense. We’ll cover probe design, filtering noisy syscalls, handling performance concerns at high throughput (10K+ requests/sec), and integrating runtime signals into modern alerting or SIEM workflows.Whether you're a platform engineer, product security lead, or SRE tired of false negatives from static tools, this talk will give you actionable techniques to secure your cloud-native environments where it truly matters: in production. Live demos, original tooling, and practical insights will ensure you walk away with both strategic vision and implementation-ready knowledge.

With deepfakes, GenAI-driven scams, and autonomous agentic attacks on the rise, AI is becoming one of the fastest-moving threat vectors. This session breaks down how these attacks work, why they’re so hard to detect, and what defenders can do to stay ahead of AI gone rogue.

In this session, Abdullah Afadhel examines why many SOCs fail to prove measurable security outcomes. The talk covers gaps in detection logic, evidence quality, incident ownership, alert fatigue, and untested response paths. It explains practical controls to validate SOC effectiveness, reduce noise, improve signal accuracy, and strengthen real incident alignment using Safe Decision practices.

This session takes you inside the world of AI in investigations, where machines turn malware into pictures, rebuild what happened from broken logs, and uncover hidden behavior deep inside a system. You’ll see how these abilities actually work in a clear and visual way.....and why, no matter how advanced AI becomes, its power still needs a human mind to finish the story

In this session, Mr. Abdul Qadir outlines how AI and emerging technologies change risk management fundamentals. The talk highlights flaws in traditional scoring, blind reliance on static controls, and delayed risk decisions. It explains how organisations can adopt AI-aware prioritisation, evaluate new attack vectors, and reduce exposure from rapid technology integration. PwC Pakistan AI‐aware risk prioritization.

Modern red team operations rarely play out in friendly territory. The days of wide-open egress are fading, replaced by environments where defenders tighten every screw. Outbound traffic is inspected, filtered, and often blocked entirely. A shell on a public-facing server might feel like a win, but in many cases, it comes with no DNS, no HTTP, and no callbacks at all. In these conditions, the familiar C2 playbook runs out of pages, and operators are forced to adapt or stall.In this session, we will flip the C2 model on its head. You will see how to turn "dead-end" footholds into fully functional command channels without a single outbound packet, blending covert tasking into legitimate inbound web traffic. We will break down the design choices, the stealth advantages, and the pitfalls you will want to avoid, then share tooling to make it work with your own implants and frameworks.If you have ever been stuck behind a wall of egress controls, you will walk away with a new blueprint and a few tricks to make the unreachable reachable.