{"$schema": "https://c3voc.de/schedule/schema.json", "generator": {"name": "pretalx", "version": "2024.3.1"}, "schedule": {"url": "https://program.wiccon.nl/wiccon-2026/schedule/", "version": "1.0", "base_url": "https://program.wiccon.nl", "conference": {"acronym": "wiccon-2026", "title": "WICCON 2026", "start": "2026-10-29", "end": "2026-10-30", "daysCount": 2, "timeslot_duration": "00:05", "time_zone_name": "Europe/Amsterdam", "colors": {"primary": "#000000"}, "rooms": [{"name": "Main Hall", "guid": "58b66335-fbc4-53e9-9d2e-1b6a998afde9", "description": "Main Hall", "capacity": null}, {"name": "Workshop Room", "guid": "68f47131-6986-5eb4-81ea-4c87ce675da0", "description": "Workshop Room", "capacity": null}], "tracks": [{"name": "Talks", "color": "#4F1473"}, {"name": "Workshops", "color": "#9C0000"}], "days": [{"index": 1, "date": "2026-10-29", "day_start": "2026-10-29T04:00:00+01:00", "day_end": "2026-10-30T03:59:00+01:00", "rooms": {"Main Hall": [{"url": "https://program.wiccon.nl/wiccon-2026/talk/JNQAQS/", "id": 250, "guid": "b10b1fff-92be-560d-b550-13c7108e07e9", "date": "2026-10-29T10:00:00+01:00", "start": "10:00", "logo": null, "duration": "00:05", "room": "Main Hall", "slug": "wiccon-2026-250-wiccon-opening", "title": "WICCON Opening", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "Opening the Event", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/GMWX3Q/", "id": 222, "guid": "e7464cee-f1de-51dd-a664-084cc365e3a5", "date": "2026-10-29T10:05:00+01:00", "start": "10:05", "logo": null, "duration": "00:25", "room": "Main Hall", "slug": "wiccon-2026-222-will-the-train-stop-running-the-value-of-responsible-disclosure-", "title": "Will the train stop running? The value of responsible disclosure.", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "In this talk, we share the story of how we almost got breached.\r\nLong before the report came in, we were busy phasing out a legacy system that was used in train operations. A system that multiple internal and external stakeholders used in their primary traffic management processes.", "description": "We had already conducted a risk analysis that highlighted several severe cybersecurity risks, and even though the risks were known, everyone was still surprised when an actual responsible disclosure message came in, notifying us about the vulnerability.\r\nWe will show you how we handled this incident, what we learned, and how responsible disclosure helped accelerate the mitigation of cybersecurity risks.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "2e0e91d6-f65d-56af-aa3c-6dceeda286ea", "id": 214, "code": "SAP79Y", "public_name": "Ola Jankowska", "avatar": "https://program.wiccon.nl/media/avatars/SAP79Y_kIebvlh.jpg", "biography": "Ola is a Solution Architect with over twenty years of experience in designing and delivering software solutions. She works within the Dutch railway domain, focusing on building resilient systems for a critical infrastructure.\r\nHer work connects architecture and security in practice: from designing identity providers, reverse proxies, and IT/OT gateways to bringing business values into production. She has hands-on experience with risk analysis, penetration testing, shifting security controls left, security monitoring, and incident response.\r\n\r\nShe brings a pragmatic perspective on how to make security work in real-world systems, balancing resilience, innovation, and cost-efectivness.", "answers": []}, {"guid": "c7ab600e-5d7d-547c-bb4c-ee7f7a522491", "id": 215, "code": "WTM9GS", "public_name": "Catharine de Jong", "avatar": "https://program.wiccon.nl/media/avatars/WTM9GS_AJaM65w.png", "biography": "Catharine is an Information Security Officer with a focus on advising and assessment. She works within the Dutch railway domain as member of the ProRail cybersecurity team and reports to the CISO. She works as an advisor for multiple IT domains, where mission critical IT-assets are developed and maintained.\r\n \r\nShe is a supportive and approachable professional who is able to provide advise on diverse levels in the organisation. Thanks to her natural prevention-focused mindset, experience in risk management and her critical view, she brings clarity and makes complex cybersecurity risks clear and managable.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/YTMLW9/", "id": 249, "guid": "40ffff65-559c-536d-be5c-c5aa70f0a155", "date": "2026-10-29T10:30:00+01:00", "start": "10:30", "logo": null, "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-249-how-to-capitalise-on-other-people-s-popularity-to-distribute-malware-weaponizing-ci-cd-pipelines", "title": "How to capitalise on other people\u2019s popularity to distribute malware: Weaponizing CI/CD Pipelines", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "I am going to talk about software supply chain security, more precisely about exploiting CI/CD pipelines in GitHub so as to publish malicious versions of popular open source packages (just for example, on npmjs), write arbitrary code in GitHub repos or steal secrets.", "description": "Vulnerabilities are not only in your source code. They can hide in the deepest dependency of your project, in a build script, in a tool one of your dev uses. Every single piece of your software supply chain could impact the artefact you distribute. Including the pipelines you trust, the very pipelines that help you develop faster and secure your codebase. Maybe you should check on those to avoid distributing malware without even knowing it...\r\n\r\nI\u2019m going to show you various methods I\u2019ve used to compromise popular open-source packages by exploiting their GitHub Actions workflows, or those of their dependencies.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "8a30d790-4e20-50b4-a7d6-468ad54fc99f", "id": 234, "code": "EWKXLN", "public_name": "Garance", "avatar": "https://program.wiccon.nl/media/avatars/EWKXLN_4xOu2X6.jpeg", "biography": "Garance works at Depi in the offensive security research team, and she is specialising in software supply chain security. She love understanding and learning random things in the world around her and meeting new people.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/9WMN9B/", "id": 205, "guid": "52bc844f-e42f-54e9-9781-17581a37208b", "date": "2026-10-29T11:30:00+01:00", "start": "11:30", "logo": null, "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-205-hauntology-in-the-machine-reanimating-a-dead-language-to-blindside-modern-security", "title": "Hauntology in the Machine: Reanimating a Dead Language to Blindside Modern Security", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "Jacques Derrida\u2019s philosophy of hauntology shows that the ghosts of the past always return to life. We explore this concept through FORTH, an ancient programming language from the 1970s. By injecting a minimalist FORTH compiler into just 5KB of shellcode, attackers can operate on the lowest architectural floor. This talk serves as a spooky reminder that our most advanced systems are still governed by the very ghosts we thought we buried.", "description": "Today, most security tools only look at the top layers of our computers; AI security tools, monitoring Windows APIs, and checking operating system logs. But what happens when an attacker entirely bypasses this framework by diving straight to the bottom floor (the machine code)?\r\n\u200b\r\nNo deep prior knowledge of low-level programming is required for this talk. We will break down the research step-by-step, explaining basic concepts like compilers and shells, making this session completely beginner-friendly. The technical foundation of this presentation is based on the fascinating offensive research by security researcher Josh Stone.\r\n\r\n\u200bTogether, we will analyze this unique technique: injecting a fully functional compiler into just 5KB of shellcode. Instead of using modern languages, this technique resurrects FORTH, a minimalist language from the 1970s.\r\n\r\n\u200bA traditional compiler like GCC is a massive software system that needs to parse code into complex trees and link external libraries. FORTH does none of this. It functions simply as a command shell. Because the execution logic is so small, the entire compiler easily fits into a tiny piece of shellcode.\r\n\r\n\u200bThis is where philosophy meets reality. Derrida\u2019s concept of 'hauntology' describes how ghosts of the past return to life to disrupt the present. By bringing back this \"dead\" language, hackers create temporary tools that modern endpoint scanners cannot see. When a hacker sends basic commands to this injected compiler, it talks directly to the CPU.\r\n\r\n\u200bJoin this session to see how digging up ancient code can completely blindside modern security tools. And remember: next time your SIEM dashboard stays quiet but you hear a strange noise coming from your computer, it might just be the ghost of 1970 compiling inside your machine.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "dc8a5ab0-89ce-5ce3-889e-628ed093a078", "id": 198, "code": "EAPWBP", "public_name": "Marijke Moolenaar", "avatar": "https://program.wiccon.nl/media/avatars/EAPWBP_CC00VLv.jpg", "biography": "Marijke Moolenaar is a Security Expert at DTX with an unconventional path into cybersecurity. With her roots deeply embedded in literature and philosophy, she brings a unique, analytical perspective to the tech world. Before diving into security, she spent time in the ring as a competitive boxer. Today, she combines her philosophical mindset, tech skills, and fighting spirit to dissect complex security challenges and protect digital infrastructures from the ghosts in the machine.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/F3BVAN/", "id": 211, "guid": "ccae1b93-5b05-532c-9945-730e5fe01201", "date": "2026-10-29T13:30:00+01:00", "start": "13:30", "logo": null, "duration": "00:25", "room": "Main Hall", "slug": "wiccon-2026-211-humour-your-secret-weapon-for-more-effective-cybersecurity-awareness", "title": "Humour, your Secret Weapon for more effective Cybersecurity Awareness", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "Humour can be a powerful tool in cybersecurity awareness because it makes messages more memorable and engaging, ultimately supporting real behavior change. In this presentation you'll learn why humour is useful for more effective awareness campaigns. Research shows that humour can enhance understanding and retention when applied thoughtfully. However, it must be used carefully as misunderstanding and different viewpoints on what is considered funny can have the opposite effect of what you want to achieve. The  presentation closes with a short summary of do\u2019s and dont\u2019s for using humour in your next awareness campaign.", "description": "Cybersecurity awareness is not all fun and games, but adding a bit of fun to the mix could be very beneficial!  Humour can be a very effective tool in creating a stronger connection with the people you're trying to reach with your awareness campaigns. Intuitively we understand that humour can help us bring the message across, form allies within the organisation and stand out from corporate communication messages. \r\n\r\nBut this presentation take you back to why it is effective, especially with the rise of AI. We'll take a short tour to different parts of the world to see what humour looks like in different cultures. Humour that misses the point can also hurt your campaign. \r\n\r\nIf you believe cybersecurity awareness could benefit from a more lighthearted approach, this presentation gives you a foundation to convince the ney-sayers in your organisation, and help you create more effective awareness campaigns.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "c3fb149e-73e5-5a90-81ac-10802158c9ba", "id": 157, "code": "BAHYEN", "public_name": "Rosanne Pouw", "avatar": "https://program.wiccon.nl/media/avatars/BAHYEN_If2AVl9.jpg", "biography": "Rosanne Pouw is Product Manager Awareness and Training at SURF. She helps Dutch research and education institutions increase security awareness with the Cybersave Yourself Toolkit. Her special talent is infusing cybersecurity awareness with optimism, creativity and a multidisciplinary approach. \r\nPart of her role at SURF is stimulating the awareness community of professionals in higher education , sharing thoughts and ideas and developing materials together.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/G3LJMT/", "id": 217, "guid": "adebf3c1-9e3f-5d05-a379-8358d092b815", "date": "2026-10-29T14:00:00+01:00", "start": "14:00", "logo": null, "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-217-no-it-is-no-it-problem", "title": "No IT is no IT problem", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "At 7:42 a.m., the call comes in. A critical supplier is no longer available. A regulation changes overnight. A platform your business depends on suddenly becomes a geopolitical liability. In that moment, one question matters more than any other: Do you still have a choice?\r\n\r\nThis presentation examines how organizations gradually lose strategic flexibility through everyday architectural decisions, vendor dependencies, operational complexity, and governance structures optimized for stability rather than adaptability.", "description": "Kim van Wilgen examines how hidden dependencies can limit strategic freedom and why resilience should be designed around adaptability rather than control. \r\n\r\nThe session combines strategic storytelling, practical examples, and actionable frameworks that help organizations evaluate their resilience against cyber, operational, regulatory, and geopolitical disruption.\r\n\r\nThe central message is simple: The goal is not absolute control. The goal is preserving optionality.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "d7cdbeae-a7cd-5f1d-a193-d410a9f8909b", "id": 203, "code": "3YVDFQ", "public_name": "Kim van Wilgen", "avatar": "https://program.wiccon.nl/media/avatars/3YVDFQ_fFpTTnn.jpg", "biography": "Kim van Wilgen is CTO at Schuberg Philis and a trusted advisor to executive teams and technology leaders responsible for mission-critical digital environments. She specializes in operational resilience, cybersecurity, AI adoption, and digital sovereignty. \r\nKim helps organizations design technology landscapes that remain adaptable in the face of cyber threats, geopolitical uncertainty, and rapid technological change. She is known for translating complex technical challenges into clear strategic choices for business leaders. Her work bridges technology, leadership, and business continuity in an increasingly digital world.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/CPTZQC/", "id": 215, "guid": "2470c859-5e7d-569a-be68-ec9e450fe934", "date": "2026-10-29T15:30:00+01:00", "start": "15:30", "logo": "https://program.wiccon.nl/media/wiccon-2026/submissions/CPTZQC/setup2_iQVV5mg.jpeg", "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-215-misbehaving-while-awake-nrf52810-runtime-em-fault-injection-approtect-bypass-cve-2025-9709-", "title": "Misbehaving while awake: nRF52810 Runtime EM Fault Injection APPROTECT Bypass - (CVE-2025-9709)", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "Fault injection campaigns normally require a lengthy, complex process that can be difficult to reproduce. Finding trigger timings often requires extended research on the target's power consumption and side-channel analysis.", "description": "While trying to reproduce CVE-2020-27211 by LimitedResults, I discovered a novel, triggerless runtime attack on Nordic Semi's nRF52810 System-on-Chip (SoC) using electromagnetic (EM) fault injection. Unlike conventional approaches, this technique requires neither precise timing nor accurately synchronized EM pulses, making it remarkably simple and reproducible. Given the correct injection location, the attack succeeds on average with the first pulse. This is the first triggerless runtime attack ever reported. \r\nI will walk you through the research process and discuss where this work could lead next. \r\nThis issue was recognized by Toreon as CVE-2025-9709.", "recording_license": "", "do_not_record": true, "persons": [{"guid": "ca6bc701-f601-544e-ba95-11e569086061", "id": 205, "code": "LSRCSB", "public_name": "g0mb4ck", "avatar": "https://program.wiccon.nl/media/avatars/LSRCSB_2EYz5kY.jpg", "biography": "Milena aka g0mb4ck is a Hardware Security Researcher and has just started her journey in Keysight Device Security, formerly known as Riscure B.V. \r\nHer main focus is on fault injection, which is a way to test and break hardware security. Her goal is to really understand how these attacks work so she can help design better defenses.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/8J8XPT/", "id": 195, "guid": "85383004-4e91-50dc-923d-9bc2dc382083", "date": "2026-10-29T16:30:00+01:00", "start": "16:30", "logo": null, "duration": "00:25", "room": "Main Hall", "slug": "wiccon-2026-195-supabase-shenaningans-extended-edition", "title": "Supabase Shenaningans: Extended Edition", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "In one week, Eden pentested two completely separate applications built on Supabase, and both had Row-Level Security disabled. This talk walks through both engagements, the surprising ways developers misunderstand Supabase's security model, and why this vulnerability class keeps appearing even when the documentation warns you plainly. If you've ever shipped a Supabase app and didn't think twice about RLS, this one's for you.", "description": "This talk covers two real-world penetration testing engagements conducted within the same week, both targeting applications built on Supabase. The findings were independently discovered, disclosed responsibly, and are now public on skelli.win.\r\n\r\nThe talk covers how Supabase's permissive defaults work and why they exist, the architectural mistake of rolling custom auth instead of using Supabase Auth, common RLS policy gaps, remediation patterns for Supabase developers, and what good responsible disclosure looks like from both sides.\r\nThe intended audience is anyone who builds with or recommends modern BaaS platforms, and anyone interested in how subtle architectural decisions create severe vulnerabilities. Technical enough for practitioners, accessible enough for developers just starting to think about security.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "9bd0446c-056d-5a26-9080-f8dec19c2f89", "id": 190, "code": "BHTWZP", "public_name": "Eden Stroet", "avatar": "https://program.wiccon.nl/media/avatars/BHTWZP_vVVin8J.png", "biography": "Eden Stroet is a security researcher and SOC analyst at Hadrian Security in Amsterdam, where they focus on vulnerability research, automated scanning, and pentesting. They are a volunteer with the Dutch Institute for Vulnerability Disclosure (DIVD) and an active bug bounty hunter on HackerOne and Intigriti. Eden runs two online cyber security communities called Digital Overdose and Hard Way Hacking and Coding. When they're not hacking, they're on an aerial hoop or playing videogames with friends.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/9QXSDG/", "id": 175, "guid": "2f17635c-ce8f-5f7b-b14f-46221497ad21", "date": "2026-10-29T17:00:00+01:00", "start": "17:00", "logo": null, "duration": "00:25", "room": "Main Hall", "slug": "wiccon-2026-175-well-behaved-women-seldom-make-history", "title": "Well behaved women seldom make history", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "For a long time I believed cybersecurity was a meritocracy; Work hard. Be good at your job. Speak the truth. The best person gets the role.\r\n\r\nThat\u2019s the story we like to tell ourselves.\r\n\r\nAfter more than 10 years in the field, much of it as a CISO, I\u2019ve collected enough experiences to file a bug report against that idea.\r\nIn this talk I\u2019ll share some of the greatest hits from my career: interviewing for a CISO job that didn\u2019t actually exist, being told I\u2019d make a great CISO \u201cone day\u201d while already being one, spending six hours in an assessment where my cybersecurity skills were never tested, and being advised by a psychologist to focus on raising my kids instead of pursuing leadership.", "description": "The industry loves to tell women to adapt. Be less loud. Less confrontational. Dress differently. Speak differently. Be more strategic. Be less emotional.\r\n\r\nSo I tried that.\r\n\r\nSpoiler: it doesn\u2019t work.\r\nBecause the problem isn\u2019t how women behave. The problem is the system evaluating them.\r\n\r\nThis talk isn\u2019t about how I beat that system. It\u2019s about what happens when you stop pretending the system works. It\u2019s about the quiet ways talented people are pushed out of cybersecurity, and why the industry keeps reproducing the same leadership over and over again. And it\u2019s about what we can actually do instead: amplify each other, open doors when we have the chance, and refuse to sand down the sharp edges that made us good at this job in the first place.\r\n\r\nCybersecurity loves talking about breaking systems.\r\nMaybe it\u2019s time we start with this one.\r\n\r\nCybersecurity loves to believe it\u2019s a meritocracy. Work hard, be good at what you do, and the best person gets the job. But what happens when the system evaluating talent is broken?\r\nIn this talk, a CISO with more than a decade of experience shares a series of personal stories from inside the industry: interviewing for jobs that never existed, being told she might become a CISO one day while already being one, and failing a full-day assessment that never tested a single cybersecurity skill.\r\nThese experiences reveal uncomfortable truths about how hiring, assessments, and leadership selection actually work in cybersecurity, and who gets left behind.\r\nThis is not a talk about fixing yourself to fit the system.\r\nIt\u2019s a bug report about the system itself.\r\nExpect sharp edges, uncomfortable lessons, and a call to start hacking the culture of our own industry.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "14459b9f-df9b-51fc-92ac-1939d9ccb75a", "id": 5, "code": "SK7MYW", "public_name": "Fleur van Leusden", "avatar": "https://program.wiccon.nl/media/avatars/Profielfoto1_WUCcxER.png", "biography": "Ten year security expert. Much of which for the government.\r\n\r\nNot a well behaved woman.", "answers": []}], "links": [], "attachments": [], "answers": []}], "Workshop Room": [{"url": "https://program.wiccon.nl/wiccon-2026/talk/ZQY987/", "id": 176, "guid": "15eb2d88-63f2-5d2b-9ec1-2473510ee96c", "date": "2026-10-29T10:30:00+01:00", "start": "10:30", "logo": "https://program.wiccon.nl/media/wiccon-2026/submissions/ZQY987/WIRlogo-removebg_mu4OvGh.png", "duration": "02:00", "room": "Workshop Room", "slug": "wiccon-2026-176-social-engineering-techniques-of-hacking-a-human-being", "title": "Social engineering techniques of hacking a human being", "subtitle": "", "track": "Workshops", "type": "Workshop 120 minutes", "language": "en", "abstract": "Presentation of Social engineering theory, and techniques, going in-depth to learn about elicitation and building rapport with your potential victim. As we navigate the complex world of cybersecurity, it's essential to understand the tactics employed by social engineers. These attackers use psychological manipulation to influence individuals into divulging sensitive information or performing certain actions that compromise security. In this presentation, we'll delve into the world of social engineering, exploring its definition, techniques, and strategies for building rapport with potential victims.\r\nExamples of real-life attacks, and final thoughts on who could be a social engineer and how to defend yourself against one.", "description": "1. What is social engineering? Examples.\r\n2. Becoming Anyone you want to be - Pretexting.\r\n3. Four Phases of Social Engineering (Reconnaissance, Engagement, Exploitation, Closure);\r\n4. Building your artwork: What is elicitation? Elicitation Techniques.\r\n5. I know how to make you like me: Building Rapport.\r\n6. Examples of Real Social Engineering Attacks.\r\n7. Now What? Skills you need to become a social engineer, and how to defend yourself.\r\n8. Conclusion, final thoughts\r\n\r\nThe person listening to my talk will end it with tangible knowledge on social engineering and places to go if they want to learn more. This workshop will include working in groups, and challenges for attendees - to gain some real skills, and better memorization of the techniques presented.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "f78e7bf1-d22c-5b5e-972c-6cfbafa945e4", "id": 168, "code": "KHJESM", "public_name": "Dorota Kozlowska", "avatar": "https://program.wiccon.nl/media/avatars/KHJESM_U9jX2Xn.jpeg", "biography": "Meet Dorota Kozlowska, known as 'Woman in Red,' a renowned penetration tester, social engineering and physical audit specialist. What she brings to the table is a unique blend of technical penetration testing skills, social engineering, hands-on physical security experience, and evolving Red Teaming capabilities. As a sought-after international keynote speaker on Offensive Security related topics, she has captivated audiences at the most prominent events, and biggest stages. \r\nHer passion for sharing knowledge and expertise has been recognized with CEFCYS Cyber Woman of Hope 2023 award, and her appearance on the '40 Under 40 in Cybersecurity 2023' list by Top Cyber News Magazine. \r\nIn addition to her speaking engagements, she also hosts popular Podcasts \"Ethical Hacking, Guests, and Wholesomeness,\" and \u201cInspiring Ladies of Cyber\u201d where she delves into the world of cybersecurity with guests from the industry.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/BQV3AJ/", "id": 231, "guid": "482d05c6-6e88-52be-86ee-3e03bb090b69", "date": "2026-10-29T13:30:00+01:00", "start": "13:30", "logo": "https://program.wiccon.nl/media/wiccon-2026/submissions/BQV3AJ/CyberMasterWiccon_DGg6YQf.png", "duration": "01:00", "room": "Workshop Room", "slug": "wiccon-2026-231-want-to-play-a-game-", "title": "Want to play a game?", "subtitle": "", "track": "Workshops", "type": "Workshop 60 minutes", "language": "en", "abstract": "It's 02:47 in the morning when the call comes in. Some systems aren't responding. Customer data may have been stolen. Your phone won't stop ringing and your colleague asks you with a shiver in his voice: \"What do we do now?\"\r\n\r\nHaving watched dozens of leadership teams walk into that exact moment here\u2019s what stands out: Most of them have crisis plans. Most of them have done a tabletop. Almost none of them stay calm the way they thought they would.", "description": "This talk is about what happens when the playbook breaks. Not the plan written down, but the reflex underneath it. In gamified fully-immersive simulations we put teams in a room with a live SIEM, a hacker on the chat, social media on fire, a regulator on hold and a ransom on the table. No pause. The clock runs. The information keeps changing.\r\n\r\nWhat we see in that room is not what people tell themselves they would do. What I'll show you today is what really decides how a team gets through it: The patterns we watch for during a simulation, scored in the moment so we can come back three months later and see who got sharper.\r\n\r\nAnd you won't be sitting still for all of it either. Somewhere in this hour you'll be asked to make a decision you can't unmake. No saws. No lost legs. Just the clock, what you don't know yet, and no one but you to make that call. The same call those teams faced.\r\n\r\nI won't tell you what they decided.\r\n\r\nYou'll have to come see for yourself\u2026", "recording_license": "", "do_not_record": false, "persons": [{"guid": "b73b7c70-32a7-5386-b806-57207574e1f3", "id": 140, "code": "LB3L8H", "public_name": "Kaja M\u00f6ller", "avatar": "https://program.wiccon.nl/media/avatars/LB3L8H_defWuCU.jpg", "biography": "Next to her fulltime job at the government, Kaja is the founder of CyberMaster, a fully-immersive cybercrisis simulation that puts teams under the kind of pressure no slide deck can. \r\n\r\nThe foundation for CyberMaster was laid in her background in criminology, law and technology and cybercrime, cybersecurity and riskmanagement, which is where she learned that cyber problems are rarely just technical: they're about people.\r\n\r\nAs a proper nerd, she loves to discuss these topics endlessly which is why she is a guest lecturer at the University of Twente and TU Darmst\u00e4dt, where she does her best to make privacy law sound... less.... like... privacy law and to introduce to technical students that there is also another side of cybersecurity.\r\nTherefore, her work sits at the intersection of privacy, cybersecurity and the human factor and after guiding enough crisis teams. She is convinced people are our strongest link in cybersecurity, NOT the weakest!", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/9MB79U/", "id": 181, "guid": "66d37923-f820-533b-8d4b-bdb0b3669954", "date": "2026-10-29T15:30:00+01:00", "start": "15:30", "logo": null, "duration": "01:30", "room": "Workshop Room", "slug": "wiccon-2026-181-coverage-guided-fuzzing", "title": "Coverage-guided Fuzzing", "subtitle": "", "track": "Workshops", "type": "Workshop 120 minutes", "language": "en", "abstract": "Coverage-guided fuzzing is a software testing methodology that is effective at finding vulnerabilities by automatically and continually making small changes to the program's input and observing its effect on the path a program takes. This hands-on workshop aims to give you the tools needed to set up a simple working fuzzing environment for your own targets.", "description": "Fuzz testing is a broad area of software testing that involves making many, (informed) random mutations on input with the goal of finding bugs. This workshop focuses on coverage-guided fuzzing methodologies where the path a program takes for specific inputs is used to decide which inputs to further mutate. This method of testing allows for gaining more coverage across the program faster but requires specific preparation for the target.\r\n\r\nThe following topics will be covered during the session:\r\n\r\n- Compiling an instrumented binary\r\n- Creating an initial corpus\r\n- Perform coverage-based fuzzing\r\n- Interpreting results\r\n\r\nFor this workshop no prior fuzzing knowledge is required, but limited familiarity with C and basic understanding of memory layout are assumed.\r\n\r\nIMPORTANT: The workshop requires a laptop with Docker installed.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "50b1d9c7-3a7e-50b9-8359-3b6dc4e3e5c8", "id": 170, "code": "XEEZLH", "public_name": "Sebastiaan Groot", "avatar": "https://program.wiccon.nl/media/avatars/XEEZLH_V6r2PuS.jpg", "biography": "Sebastiaan is an Ethical Hacker at KPN with an interest in binary analysis and exploitation, system security and breaking programs in general. Before that, he worked as an incident responder and forensic analyst at KPN-CERT. Whenever opportunity arises, he can be found at CTF events.", "answers": []}, {"guid": "5d5c1b95-9894-52bc-9e20-ccd16ff72970", "id": 195, "code": "8DRKUN", "public_name": "Frank Cozijnsen", "avatar": "https://program.wiccon.nl/media/avatars/8DRKUN_ziGflF4.png", "biography": "Frank Cozijnsen is a seasoned ethical hacker at KPN, the leading telecommunications provider in the Netherlands, where he has worked for over 25 years. Previously, he held roles as a VoIP engineer and system administrator within the same organization.\r\n\r\nFrank likes to focus on assessing mobile networking equipment and telecom infrastructure, with a particular interest in binary exploitation and hacking complex environments. He likes to play CTF's and has discovered vulnerabilities in several products using custom fuzzing techniques.", "answers": []}], "links": [], "attachments": [], "answers": []}]}}, {"index": 2, "date": "2026-10-30", "day_start": "2026-10-30T04:00:00+01:00", "day_end": "2026-10-31T03:59:00+01:00", "rooms": {"Main Hall": [{"url": "https://program.wiccon.nl/wiccon-2026/talk/YJJ3DR/", "id": 214, "guid": "e389b3c4-eff8-5cca-a50c-359f9e1d0560", "date": "2026-10-30T10:00:00+01:00", "start": "10:00", "logo": null, "duration": "00:25", "room": "Main Hall", "slug": "wiccon-2026-214-the-dark-spell-of-trust-how-secure-systems-become-enablers-of-financial-crime", "title": "The Dark Spell of Trust: How Secure Systems become Enablers of Financial Crime", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "In today\u2019s threat landscape, the most dangerous scenarios are not the ones you detect\u2014but the ones that look perfectly normal.\r\nCyber Security assumes systems can be compromised. Financial crime frameworks assume systems can be trusted. But what happens when those assumptions collide?\r\n\r\nThis session explores the hidden intersection where identity compromise, data manipulation, and legitimate system access transform secure environments into enablers of financial crime. Across AML, fraud, sanctions, and corruption risk, attackers are no longer just bypassing controls\u2014they are operating within them.\r\nIt challenges the belief that \u201csecure systems produce safe outcomes,\u201d and introduces a new perspective: financial crime risk as a direct consequence of broken trust in identity, data, and behaviour.", "description": "In Cyber Security, we design controls assuming attackers are already inside, identities can be compromised, and systems\u2014even trusted ones\u2014can be manipulated. \r\n\r\nFinancial crime frameworks have evolved differently. Across AML, fraud, sanctions, and anti-bribery & corruption (ABC), controls are built on a more implicit assumption: that identities are real, data is accurate, and systems provide a reliable view of reality. Risk is detected through patterns, rules, and known typologies\u2014often after events have already taken place.\r\n\r\nThis session explores what happens when these two worlds meet.\r\nUsing real-world examples and cross-domain insights, we will examine how modern attack techniques\u2014such as identity compromise, synthetic identities, data manipulation, and abuse of legitimate access\u2014can quietly undermine financial crime controls. In these scenarios, systems continue to operate as designed, transactions appear legitimate, and decisions remain \u201ccompliant\u201d\u2014while financial crime risk unfolds undetected beneath the surface.\r\n\r\nThe talk will: \r\n- Compare the core assumptions of cybersecurity and financial crime frameworks\r\n- Explore how \u201ctrusted systems\u201d can become enablers of AML breaches, fraud, sanctions evasion, and corruption risk\r\n- Highlight what cybersecurity can learn from financial crime disciplines, including decision accountability and risk assessment under uncertainty\r\n- Translate these insights into practical actions for CISOs and security teams\u2014focusing on identity trust, data integrity, and cross-domain detection\r\n- Challenge the audience to rethink how signals, systems, and trust models should be connected\r\nThis is not a compliance session. It is a conversation about trust. And how both cybersecurity and financial crime functions must evolve together to respond.\r\n\r\nThis session is an invitation for cybersecurity professionals to extend their thinking beyond infrastructure and to play a critical role in preventing financial crime risks that traditional controls were never designed to detect.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "6fd3f904-9d75-5c83-b24f-ecb3b5b53123", "id": 187, "code": "VW8VMR", "public_name": "Caroline", "avatar": "https://program.wiccon.nl/media/avatars/VW8VMR_kiN7N1z.jpg", "biography": "Caroline van Gorp, FICA, MBA, is Head of Global FEC Sanctions Change & Portfolio at Rabobank, where she leads large-scale transformation initiatives at the intersection of financial crime prevention, risk, technology, and regulatory change.\r\n\r\nWith a career spanning financial services, compliance, risk management, and business transformation, Caroline is known for her ability to connect disciplines that are often treated separately. She brings a holistic perspective to risk, exploring how innovation, technology, human behaviour, and governance collectively shape organizational resilience. Pioneer, entrepreneur, and Non-Executive Director for NGOs.\r\n\r\nPassionate about the potential of technology to drive meaningful change, Caroline focuses on navigate complex challenges in an increasingly interconnected and digital world. Her work combines strategic thinking with practical execution, enabling sustainable transformation while strengthening trust, security, and customer outcomes.\r\n\r\nA speaker and thought leader, Caroline is particularly interested in the paradoxes, wicked problems, and different perspectives. Her insights challenge conventional thinking and encourage audiences to look beyond silos to better understand the evolving risk landscape.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/MFEAAW/", "id": 207, "guid": "859e2544-6a0a-5c21-82a6-b34bcebe3747", "date": "2026-10-30T10:30:00+01:00", "start": "10:30", "logo": null, "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-207-war-and-unpeace-how-russia-became-one-of-the-world-s-most-advanced-cyber-threat-actors", "title": "War and Unpeace: How Russia became one of the world's most advanced cyber threat actors", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "One cannot open an annual report on advanced persistent threats without finding Russia listed as one of the top threats in the cyberdomain. This talk examines Russia's evolution as a threat actor from a broader perspective, drawing on historical, socio-economic and cultural factors. Viewed through this broad lens, the tactics, techniques and procedures of Russian APTs emerge not as random aggression, but as the expression of a coherent - if at times failing - doctrine.", "description": "Russia's emergence as a top-tier cyber threat actor is not a coincidence or a purely technical achievement \u2014 it is the product of a historically grown state logic in which geopolitical ambitions, economic constraints, and a deep cultural distrust converge. This talk traces that logic across five interconnected dimensions: the Soviet and post-Soviet institutional heritage, economic marginalisation, political consolidation under Putin, socio-cultural narratives of encirclement, and deliberate technological capacity-building. The Ukrainian war serves as the critical stress test \u2014 revealing both the destructive potential and the surprising limitations of Russian cyber operations in a combined-arms conflict. Russia's Tactics, Techniques and Procedures are then examined through this strategic lens, showing how they reflect not random aggression but a coherent, if sometimes failing, doctrine.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "a49a4c07-aa22-5f46-9b78-b58eb261c045", "id": 200, "code": "HPRZNE", "public_name": "Dominique Heuff", "avatar": "https://program.wiccon.nl/media/avatars/HPRZNE_FbgU2yh.png", "biography": "Dominique Heuff holds a Master's Degree in Russian Studies. Currently working as a senior security analyst at the SOC of SSC-ICT - a shared service provider for IT for the Dutch government - she aims to bridge her academic background with her professional experience to place cybersecurity developments in a broader context. This presentation is the result of that ambition.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/DEJSUZ/", "id": 182, "guid": "c7a50cdb-d97b-5c2f-abc9-4374fdd0da40", "date": "2026-10-30T11:30:00+01:00", "start": "11:30", "logo": "https://program.wiccon.nl/media/wiccon-2026/submissions/DEJSUZ/end_of_pentester_q3xMG1k.png", "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-182-the-end-of-human-pentesting-", "title": "The end of human pentesting?", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "I built a homemade offensive pipeline from free tools, a few hundred lines of Python, and an LLM that reads attack data and tells you where to strike next. In this talk I show what it can do, where it fails, and what that gap reveals about the future of offensive security. Every tool is free, every concept is reproducible, and the answer to the title question is more interesting than you expect.", "description": "Everyone is asking whether AI will replace hackers. Most answers come from vendors selling platforms, analysts writing reports, or defenders worried about their budgets. This one comes from someone who actually built the thing and ran it against real targets.\r\n\r\nThe results are unsettling in ways nobody is talking about yet. Not because AI is as good as the pitch decks claim, but because the gap between what it can do and what it cannot do reveals something important about where offensive expertise actually lives in 2026.\r\n\r\nThis talk is practical, opinionated, technical and built on real experience. You will leave knowing exactly which parts of your workflow to hand to a machine, which parts to protect fiercely, and why the most dangerous person in the room is not the one with the biggest toolset.\r\n\r\nCome with curiosity. Leave with a new way of thinking about what it means to be a hacker today.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "1f7a3a21-041b-51d3-b84c-d57503a987a9", "id": 171, "code": "QEEGTU", "public_name": "An Van Leuven", "avatar": "https://program.wiccon.nl/media/avatars/QEEGTU_iOtiLy3.jpg", "biography": "An is a cybersecurity consultant based in Belgium who has never quite managed to stay on one side of the fence. Her work spans incident response, forensics, threat modelling, cyberdefense projects, and penetration testing, which means she spend roughly equal time thinking about how attacks happen and how organisations survive them. \r\nShe spoke at Annacon in 2025 and became genuinely obsessed with what AI actually does to that balance, from both ends of the kill chain.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/DGAYA3/", "id": 229, "guid": "486f7449-a593-5be3-98cb-71fa46ba3b02", "date": "2026-10-30T13:30:00+01:00", "start": "13:30", "logo": null, "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-229-i-jailbroke-a-scam-bot-with-1-prompt-and-so-can-you", "title": "I jailbroke a scam bot with 1 prompt, and so can you", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "Getting an LLM to spill its secrets is a subtle artform, part social engineering of the application, and part social engineering of the humans (and other LLMs) who built it. It's witchy magic that's both gentle and assertive: you ask nicely to stay under the abuse radar, then tell the bot to step outside its role entirely. \r\nIn this talk I'll walk through what I've learned testing LLMs across chatbots, lifestyle assistants, and enterprise tools - from leaking system prompts and hunting indirect, no-authentication prompt injection, to chaining an AI's own \"legitimate\" tools into something destructive. I'll cover real attacks like using the AI's own tools to ransom a company, turning connected integrations into exfiltration channels, and the crossover where this all starts to look a lot like traditional web application testing. They told us SQL injection was dead, and we just reimagined it, gave it a new name, and pointed it at the model. \r\nExpect practical techniques, a healthy respect for how confidently these systems lie, and a reminder that organisations need people who think this way because people with worse intentions are already doing it.", "description": "Modern LLM deployments aren't risky because of the model - they're risky because of what the model is connected to and how we try to put guardrails around them. You no longer have to imagine a machine with agency over your emails, calendars, Slack, Jira, Confluence, and GitHub because we already live in that reality. I explore how these systems delight users with unexpected solutions, and how users become comfortable (or fatigued) with giving more and more access. The moment a system can read untrusted content, access private data, and communicate externally, you've got indirect prompt injection as a feature no matter how well-aligned the model is. I'll walk through how malicious instructions get in and how stolen data gets out through those same integrations.\r\n\r\nThen we'll get to the part I find most interesting: you often don't need to make the model do anything obviously malicious. Each legitimate tool an LLM has like a code execution sandbox, file access, crypto functions, and web requests become the capabilities we take advantage of. Chain them in the right order and you get outcomes the developers never imagined. I'll cover sequential tool-chaining attacks, where individually harmless steps add up to data held hostage.\r\n\r\nI'll also spend time on the things that make this work in practice. Why a prompt that fails ninety-nine times succeeds on the hundredth, is still a vulnerability. And why you should treat everything a bot tells you about itself as a lead, never a fact, because LLMs \"hallucinate\" information about themselves, and lie with total confidence.\r\n\r\nYou'll leave with concrete testing and design techniques you can use the next time you're handed an AI-powered application and asked whether it's safe.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "faf4f988-04cb-5209-b1c4-e9d7d74310c5", "id": 15, "code": "WWDQAE", "public_name": "Yianna Paris", "avatar": "https://program.wiccon.nl/media/avatars/WWDQAE_A4hqS3s.jpeg", "biography": "Yianna Paris is an Australian-born security researcher now causing trouble as a Senior Offensive Security Consultant at Xebia in the Netherlands. She recently founded her training and research consultancy, Luda Hex. Her experience has spanned from deeply technical, high performing engineering companies to working for checkbox-compliance leadership. She breaks things professionally, from web apps, infrastructure, the architecture behind them, and increasingly the AI-powered systems everyone's bolting on without reading the manual. Her work spans penetration testing, secure coding, hardware and RF hacking, and the OSINT legwork of figuring out what an organisation actually runs versus what it thinks it runs (the two are rarely the same).\r\n\r\nShe's a DEFCON and Xebia Academy trainer, volunteer teaching kids to code, crafter and loves spending time in her garden. Having made the move from apologetic Aussie to we-say-what-we-mean Dutch directness, she's well-practised at pushing back, both on systems, and on the humans who built them.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/ZU83AN/", "id": 225, "guid": "726ae3bd-6e94-5bbb-9b25-4cdd7c0f6566", "date": "2026-10-30T14:30:00+01:00", "start": "14:30", "logo": null, "duration": "00:25", "room": "Main Hall", "slug": "wiccon-2026-225-the-largest-social-engineering-attack-ever-the-hidden-effects-of-ai-on-the-human-mind", "title": "The largest social engineering attack ever? The hidden effects of AI on the human mind", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "Social engineers aim at one target: a human whose judgement has gone offline. They pull known levers, like authority, liking and urgency, to make their target compliant. Generative AI frequently pulls the same levers, whether by design or accident, while slowly eroding the very skills we would use to protect ourselves. Coming at this from an odd mix of social engineering, a year of psychology, some basic knowledge of tradecraft, and the AI work I do now, I will lay out the eerie overlap between long-game social engineering and everyday LLM use, the research on how it erodes human skill and what it does to our judgement. While cyber security\u2019s usual defences were built for louder, one-shot attacks, tradecraft may have some useful techniques that could apply here.", "description": "Besides my daily work as a data and AI consultant I have a handful of eclectic interests: a hobby level interest in social engineering, a single course in tradecraft and a year of psychology. Lately I noticed an overlap I had not expected. \r\n\r\nAs cyber security experts know, humans are a great attack surface, and social engineering can be an incredibly effective attack. There are the corporate clich\u00e9s of the classic phishing email, or the phone call from a very polite supposed customer with a really urgent issue and maybe a screaming infant in the background. Then there are the classic consumer facing attacks, like calls from someone impersonating a loved one who urgently needs money, or \u201cWindows\u201d calling your grandmother personally to help with that unknown danger on her computer.\r\n\r\nWhat gets talked about far less is long-game social engineering. Slowly gaining someone's trust, building rapport over time. Bit by bit their opinions start to carry weight, they start to matter to you, and you find their input invaluable. In the corporate world this may be a new coworker playing a long game and has a surprising amount of overlap with some parts of tradecraft. So where is the overlap with AI? Strangely large language models have been pulling a lot of the same levers in their large customer base for a while now. While the goal is unclear there is the classic large scale gathering of information, the winning of trust through manufactured authority, the relationship building through sycophancy, and manufactured urgency (largely from 3rd parties) to \u201cadopt AI now to boost your productivity\u201d. \r\n\r\nWhat we end up with are study after study on the effects of long-term AI use on human thinking, human skills, human isolation, and in the most extreme cases reported AI psychosis. I am not claiming there is some big conspiracy underfoot. I am pointing out that the disproportionate effects LLMs are having on people may lie in the disproportionate overlap their behaviours have with known techniques from social engineering and tradecraft for the explicit manipulation of humans. I will also touch on some old-school intelligence methods for keeping human judgement intact under surprisingly similar kinds of pressure.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "83097d1d-9b69-5004-8476-050164e81a01", "id": 217, "code": "WQCXS7", "public_name": "Monika Stewart", "avatar": "https://program.wiccon.nl/media/avatars/WQCXS7_bnisCu4.jpg", "biography": "Monika is a data and AI consultant in the Netherlands, with around 10 years across data quality, machine learning and engineering. Her current focus is AI safety and governance, including the EU AI Act, agentic AI risk and prompt injection. \r\nOn her blog ai.stewart.wtf she write about AI news and concerns about AI for business audiences, while keeping it grounded in science. You may have seen her as a visitor at the last EMF, WHY2025 or 39C3.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/PSBEKS/", "id": 186, "guid": "a520837d-abde-5267-a7af-05077d25259f", "date": "2026-10-30T15:30:00+01:00", "start": "15:30", "logo": "https://program.wiccon.nl/media/wiccon-2026/submissions/PSBEKS/1000117847_SsivRe8.jpg", "duration": "00:50", "room": "Main Hall", "slug": "wiccon-2026-186-what-negotiation-chats-reveal-about-ransomware-as-a-service", "title": "What Negotiation Chats Reveal About Ransomware-as-a-Service", "subtitle": "", "track": "Talks", "type": "Talk - 50 minutes", "language": "en", "abstract": "Ransomware is no longer the work of isolated hackers, but an organised criminal ecosystem operating on a service-based model. This talk explores the realities of ransomware-as-a-service (RaaS), where developers, affiliates and negotiators work together to deliver attacks. Using real data from ransomware leak sites, including ransom notes and negotiation chats, I'll examines how these groups operate and the psychology behind their attacks. The talk cuts through common misconceptions and shows why organisations should be more prepared than ever.", "description": "During my placement at the West Midlands Regional Cyber Crime Unit within West Midlands Police, I gained first-hand insight into the realities of ransomware incidents and became particularly interested in how modern ransomware groups operate less like isolated hackers and more as sophisticated criminal enterprises. This talk draws on research I have conducted into ransomware-as-a-service (RaaS) groups, including analysis of victim leak sites, ransom notes, and real negotiation chats associated with groups such as Scattered Spider and Akira.\r\n\r\nThe presentation will explore what negotiation chats reveal about extortion tactics and the use of human psychology to apply pressure during incidents. Using a real negotiation case study, I will highlight indicators of manipulation and operational structure within these groups. The talk will also challenge common misconceptions about ransomware and show how understanding attacker behaviour can strengthen organisational preparation. It will conclude with lessons for organisations on response planning and reducing the impact of ransomware attacks.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "fc01c2b1-3d14-5bc7-9d9a-7130d3c1410f", "id": 179, "code": "AFAS7N", "public_name": "Becky Stacey", "avatar": "https://program.wiccon.nl/media/avatars/AFAS7N_4q0SXGU.jpg", "biography": "Becky is a Cyber Crime Intern at the West Midlands Regional Cyber Crime Unit in the UK and a Computer Science student at the University of Birmingham. Her work spans supporting cyber crime investigations, delivering cyber security training, and researching emerging cyber threats. Alongside this, she is involved in educational outreach and conference speaking to improve cyber awareness. She is also active in widening participation in the industry through leadership roles with CyberWomen@Birmingham and Leading Cyber Ladies Midlands.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/9DDU73/", "id": 219, "guid": "11c0435f-0ad3-5650-bde0-9325a77792f5", "date": "2026-10-30T16:30:00+01:00", "start": "16:30", "logo": null, "duration": "00:25", "room": "Main Hall", "slug": "wiccon-2026-219-the-attacker-posted-first-the-breach-wasn-t-the-expensive-part", "title": "The Attacker Posted First: The Breach Wasn't the Expensive Part", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "During a major cyber incident, who actually controls the story? Increasingly, it's not the victim. Threat actors have figured out that narrative damage, like reputational collapse or a stock price in freefall, can hurt worse than the breach itself and it can be built in parallel to the attack. By the time legal has cleared a statement, the attacker may have already spread a confident, detailed account of catastrophic impact, and the media has run with it.", "description": "This talk looks at case studies like the 2014 Ukraine elections and the 2023 MGM Resorts breach to discuss how cyber operations and narrative attacks can get synchronized on purpose, asking who in your crisis structure is actually responsible for closing that gap.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "3015fd60-160c-581e-939c-264b48332690", "id": 211, "code": "D8BTMV", "public_name": "Ieva Salnaite", "avatar": "https://program.wiccon.nl/media/avatars/D8BTMV_hbBp4xx.JPG", "biography": "Ieva grew up in Lithuania, where the line between an attack and narrative manipulation was the backdrop of daily life. That early exposure became an academic focus (a master's in International Security at Sciences Po Paris, with Ukraine as her case study) and, later, a profession. \r\nShe has worked on OT Security and operational resilience projects in Switzerland and is now at Accenture Netherlands, helping clients improve their capabilities in cyber recovery, Major Incident Management, and DORA. Much of that work involves rebuilding crisis management structures to survive contact with a real incident. She studies how attackers pair technical and narrative attacks, arguing most crisis plans still aren't prepared for it.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/ZBZKTR/", "id": 251, "guid": "53a50931-7700-50b4-84b4-5c10a7a7b75e", "date": "2026-10-30T16:55:00+01:00", "start": "16:55", "logo": null, "duration": "00:05", "room": "Main Hall", "slug": "wiccon-2026-251-wiccon-closing", "title": "WICCON Closing", "subtitle": "", "track": "Talks", "type": "Talk - 25 minutes", "language": "en", "abstract": "WICCON Closing", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "attachments": [], "answers": []}], "Workshop Room": [{"url": "https://program.wiccon.nl/wiccon-2026/talk/AJBMFK/", "id": 185, "guid": "1bc07fea-ca51-5967-aecc-f3cebf1b5166", "date": "2026-10-30T10:30:00+01:00", "start": "10:30", "logo": null, "duration": "02:00", "room": "Workshop Room", "slug": "wiccon-2026-185-ctf-introduction-workshop-with-challenge-the-cyber", "title": "CTF introduction workshop with Challenge the Cyber", "subtitle": "", "track": "Workshops", "type": "Workshop 120 minutes", "language": "en", "abstract": "Get to know the Capture the flag (CTF) game without stressing out!\r\nIn this workshop, we'll look at a couple of examples of CTF categories. After a short tech introduction, you'll practice solving a challenge. You can work togethere, there's people to help, the only thing you need to do is be brave and start hacking!", "description": "Get to know the Capture the flag (CTF) game without stressing out!\r\nIn this workshop, we'll look at a couple of examples of CTF categories. After a short tech introduction, you'll practice solving a challenge. You can work togethere, there's people to help, the only thing you need to do is be brave and start hacking!\r\n\r\nWe'll use challenges that have been used in former national Challenge the Cyber competitions.\r\nProbably of the following categories:\r\n- networking\r\n- reversing\r\n- crypto", "recording_license": "", "do_not_record": false, "persons": [{"guid": "2f1847f5-0d4a-5f91-9cd9-db603ab17a66", "id": 7, "code": "AWB977", "public_name": "Maja Reissner", "avatar": "https://program.wiccon.nl/media/avatars/maja_TxD1O6d.jpg", "biography": "Maya is an enthusiastic nerd who found her way into cybersecurity through the developer world. She absolutely loves diving deep into technology, figuring out how things work, and then discussing and exchanging ideas about it with fellow nerds.\r\nShe volunteers for Challenge the Cyber by helping out with the events and she has helped with building challenges for the yearly CTF.", "answers": []}, {"guid": "1dc5c1ca-374b-598c-91e8-4486f106806b", "id": 238, "code": "K37MTV", "public_name": "Danique Lummen", "avatar": "https://program.wiccon.nl/media/avatars/K37MTV_1XtV8RE.jpg", "biography": "Danique Lummen is a Cybersecurity Specialist at Royal Schiphol Group and an active contributor to Stichting Challenge the Cyber. Through the foundation, she helps grow and diversify the next generation of cybersecurity talent in the Netherlands, supporting young people with the skills and opportunities needed to excel in the field. Danique was also Team Captain of Team Europe during the first International Cybersecurity Challenge, organized by ENISA, where the team became world champion. She is passionate about strengthening the cybersecurity community by connecting talent, knowledge, and practical experience.", "answers": []}], "links": [], "attachments": [], "answers": []}, {"url": "https://program.wiccon.nl/wiccon-2026/talk/HV9H9C/", "id": 216, "guid": "781f2732-dc7f-5ac8-af09-c7aa64c50f11", "date": "2026-10-30T13:30:00+01:00", "start": "13:30", "logo": "https://program.wiccon.nl/media/wiccon-2026/submissions/HV9H9C/LLM_HackingAI_Agents_P9946Mm.jpeg", "duration": "01:30", "room": "Workshop Room", "slug": "wiccon-2026-216-llm-hacking-and-latest-vulnerabilities-on-ai-agents-owasp-top-10-for-llm-applications", "title": "LLM Hacking and Latest vulnerabilities on AI agents - OWASP Top 10 for LLM Applications", "subtitle": "", "track": "Workshops", "type": "Workshop 120 minutes", "language": "en", "abstract": "LLMs are already in your products, your workflows, and your infrastructure. But are they secure? Probably not \u2014 and attackers already know it.\r\nThis workshop walks you through every vulnerability in the OWASP Top 10 for LLM Applications (2025), with real-world examples that will make you uncomfortable in the best possible way. You'll get hands-on time with a live hacking platform built specifically for this session, so you don't just watch \u2014 you do.\r\nWe'll close out by exploring AI agent vulnerabilities, the emerging threat category that's changing everything we thought we knew about application security.", "description": "LLMs are no longer experimental \u2014 they are embedded in production systems, customer-facing products, and critical infrastructure. And yet, the security community is still catching up to what that actually means in practice.\r\n\r\nThis workshop is designed to close that gap.\r\n\r\nWe'll work through the complete OWASP Top 10 for LLM Applications (2025 edition) \u2014 not as a checklist, but as a hands-on investigation. Each vulnerability comes with real-world context, a live demonstration, and the kind of technical depth that turns awareness into action.\r\n\r\nBut knowing isn't enough. That's why participants get access to a purpose-built hacking platform \u2014 a safe, interactive environment with no complex setup designed specifically for this workshop \u2014 where you can move from observer to attacker and experience each vulnerability firsthand.\r\n\r\nIn the final chapter, we go beyond the OWASP list entirely. AI agents are introducing a new class of vulnerabilities that existing frameworks weren't built to handle. We'll look at what makes agentic architectures uniquely dangerous and discuss what defenders and developers need to start thinking about right now.\r\n\r\nWhether you're a security professional trying to stay ahead of the curve, a developer building on top of LLMs, or simply someone who wants to understand the risks before they become incidents \u2014 this workshop was built for you.", "recording_license": "", "do_not_record": false, "persons": [{"guid": "e05a59f2-523e-5478-b0bc-112259d05634", "id": 209, "code": "HMMEXL", "public_name": "Anca Maria Capota", "avatar": "https://program.wiccon.nl/media/avatars/HMMEXL_DrgMOKE.jpeg", "biography": "Anca is an Information Security Analyst on the Incident Response team at Adobe. She recently completed her Master's degree and is now on the lookout for new opportunities, events, and challenges to dive into.\r\nPublic speaking and knowledge-sharing are a big part her journey in this field. She has delivered talks at events like YouniHack and EduFest, spoke on the importance of AI security at the University Politehnica of Bucharest, NLP Master's courses and labs at the University of Bucharest.\r\nShe is constantly working toward new certifications, driven by a simple goal: never stop learning. Beyond presenting, she has been involved in organizing BSides Bucharest at the Adobe office and has attended numerous conferences along the way \u2014 always looking for the next room to learn in, or the next stage to speak from.", "answers": []}], "links": [], "attachments": [], "answers": []}]}}]}}}