WICCON 2026

Opening the Event

In this talk, we share the story of how we almost got breached.
Long before the report came in, we were busy phasing out a legacy system that was used in train operations. A system that multiple internal and external stakeholders used in their primary traffic management processes.

I am going to talk about software supply chain security, more precisely about exploiting CI/CD pipelines in GitHub so as to publish malicious versions of popular open source packages (just for example, on npmjs), write arbitrary code in GitHub repos or steal secrets.

Presentation of Social engineering theory, and techniques, going in-depth to learn about elicitation and building rapport with your potential victim. As we navigate the complex world of cybersecurity, it's essential to understand the tactics employed by social engineers. These attackers use psychological manipulation to influence individuals into divulging sensitive information or performing certain actions that compromise security. In this presentation, we'll delve into the world of social engineering, exploring its definition, techniques, and strategies for building rapport with potential victims.
Examples of real-life attacks, and final thoughts on who could be a social engineer and how to defend yourself against one.

Jacques Derrida’s philosophy of hauntology shows that the ghosts of the past always return to life. We explore this concept through FORTH, an ancient programming language from the 1970s. By injecting a minimalist FORTH compiler into just 5KB of shellcode, attackers can operate on the lowest architectural floor. This talk serves as a spooky reminder that our most advanced systems are still governed by the very ghosts we thought we buried.

Humour can be a powerful tool in cybersecurity awareness because it makes messages more memorable and engaging, ultimately supporting real behavior change. In this presentation you'll learn why humour is useful for more effective awareness campaigns. Research shows that humour can enhance understanding and retention when applied thoughtfully. However, it must be used carefully as misunderstanding and different viewpoints on what is considered funny can have the opposite effect of what you want to achieve. The presentation closes with a short summary of do’s and dont’s for using humour in your next awareness campaign.

It's 02:47 in the morning when the call comes in. Some systems aren't responding. Customer data may have been stolen. Your phone won't stop ringing and your colleague asks you with a shiver in his voice: "What do we do now?"

Having watched dozens of leadership teams walk into that exact moment here’s what stands out: Most of them have crisis plans. Most of them have done a tabletop. Almost none of them stay calm the way they thought they would.

At 7:42 a.m., the call comes in. A critical supplier is no longer available. A regulation changes overnight. A platform your business depends on suddenly becomes a geopolitical liability. In that moment, one question matters more than any other: Do you still have a choice?

This presentation examines how organizations gradually lose strategic flexibility through everyday architectural decisions, vendor dependencies, operational complexity, and governance structures optimized for stability rather than adaptability.

Coverage-guided fuzzing is a software testing methodology that is effective at finding vulnerabilities by automatically and continually making small changes to the program's input and observing its effect on the path a program takes. This hands-on workshop aims to give you the tools needed to set up a simple working fuzzing environment for your own targets.

Fault injection campaigns normally require a lengthy, complex process that can be difficult to reproduce. Finding trigger timings often requires extended research on the target's power consumption and side-channel analysis.

In one week, Eden pentested two completely separate applications built on Supabase, and both had Row-Level Security disabled. This talk walks through both engagements, the surprising ways developers misunderstand Supabase's security model, and why this vulnerability class keeps appearing even when the documentation warns you plainly. If you've ever shipped a Supabase app and didn't think twice about RLS, this one's for you.

For a long time I believed cybersecurity was a meritocracy; Work hard. Be good at your job. Speak the truth. The best person gets the role.

That’s the story we like to tell ourselves.

After more than 10 years in the field, much of it as a CISO, I’ve collected enough experiences to file a bug report against that idea.
In this talk I’ll share some of the greatest hits from my career: interviewing for a CISO job that didn’t actually exist, being told I’d make a great CISO “one day” while already being one, spending six hours in an assessment where my cybersecurity skills were never tested, and being advised by a psychologist to focus on raising my kids instead of pursuing leadership.

In today’s threat landscape, the most dangerous scenarios are not the ones you detect—but the ones that look perfectly normal.
Cyber Security assumes systems can be compromised. Financial crime frameworks assume systems can be trusted. But what happens when those assumptions collide?

This session explores the hidden intersection where identity compromise, data manipulation, and legitimate system access transform secure environments into enablers of financial crime. Across AML, fraud, sanctions, and corruption risk, attackers are no longer just bypassing controls—they are operating within them.

It challenges the belief that “secure systems produce safe outcomes,” and introduces a new perspective: financial crime risk as a direct consequence of broken trust in identity, data, and behaviour.

Get to know the Capture the flag (CTF) game without stressing out!
In this workshop, we'll look at a couple of examples of CTF categories. After a short tech introduction, you'll practice solving a challenge. You can work togethere, there's people to help, the only thing you need to do is be brave and start hacking!

One cannot open an annual report on advanced persistent threats without finding Russia listed as one of the top threats in the cyberdomain. This talk examines Russia's evolution as a threat actor from a broader perspective, drawing on historical, socio-economic and cultural factors. Viewed through this broad lens, the tactics, techniques and procedures of Russian APTs emerge not as random aggression, but as the expression of a coherent - if at times failing - doctrine.

I built a homemade offensive pipeline from free tools, a few hundred lines of Python, and an LLM that reads attack data and tells you where to strike next. In this talk I show what it can do, where it fails, and what that gap reveals about the future of offensive security. Every tool is free, every concept is reproducible, and the answer to the title question is more interesting than you expect.

Getting an LLM to spill its secrets is a subtle artform, part social engineering of the application, and part social engineering of the humans (and other LLMs) who built it. It's witchy magic that's both gentle and assertive: you ask nicely to stay under the abuse radar, then tell the bot to step outside its role entirely.
In this talk I'll walk through what I've learned testing LLMs across chatbots, lifestyle assistants, and enterprise tools - from leaking system prompts and hunting indirect, no-authentication prompt injection, to chaining an AI's own "legitimate" tools into something destructive. I'll cover real attacks like using the AI's own tools to ransom a company, turning connected integrations into exfiltration channels, and the crossover where this all starts to look a lot like traditional web application testing. They told us SQL injection was dead, and we just reimagined it, gave it a new name, and pointed it at the model.
Expect practical techniques, a healthy respect for how confidently these systems lie, and a reminder that organisations need people who think this way because people with worse intentions are already doing it.

LLMs are already in your products, your workflows, and your infrastructure. But are they secure? Probably not — and attackers already know it.
This workshop walks you through every vulnerability in the OWASP Top 10 for LLM Applications (2025), with real-world examples that will make you uncomfortable in the best possible way. You'll get hands-on time with a live hacking platform built specifically for this session, so you don't just watch — you do.
We'll close out by exploring AI agent vulnerabilities, the emerging threat category that's changing everything we thought we knew about application security.

Social engineers aim at one target: a human whose judgement has gone offline. They pull known levers, like authority, liking and urgency, to make their target compliant. Generative AI frequently pulls the same levers, whether by design or accident, while slowly eroding the very skills we would use to protect ourselves. Coming at this from an odd mix of social engineering, a year of psychology, some basic knowledge of tradecraft, and the AI work I do now, I will lay out the eerie overlap between long-game social engineering and everyday LLM use, the research on how it erodes human skill and what it does to our judgement. While cyber security’s usual defences were built for louder, one-shot attacks, tradecraft may have some useful techniques that could apply here.

Ransomware is no longer the work of isolated hackers, but an organised criminal ecosystem operating on a service-based model. This talk explores the realities of ransomware-as-a-service (RaaS), where developers, affiliates and negotiators work together to deliver attacks. Using real data from ransomware leak sites, including ransom notes and negotiation chats, I'll examines how these groups operate and the psychology behind their attacks. The talk cuts through common misconceptions and shows why organisations should be more prepared than ever.

During a major cyber incident, who actually controls the story? Increasingly, it's not the victim. Threat actors have figured out that narrative damage, like reputational collapse or a stock price in freefall, can hurt worse than the breach itself and it can be built in parallel to the attack. By the time legal has cleared a statement, the attacker may have already spread a confident, detailed account of catastrophic impact, and the media has run with it.

WICCON Closing