1:30 pm

Registration

2:00 pm

Welcome & short introduction from Mark Beerends, SIGS Contributor & Cyber Strategy Partner at Prusec GmbH

2:00 pm

Patrick Lodder, Global Head of Threat Intelligence Services at NVISO Security

VSHELL - Tracking a State actor used Modern Post-Exploitation Framework in the Wild
VShell is a post-exploitation command and control framework that has increasingly appeared in real world intrusions targeting government and critical sectors. Following NVISO’s initial research and publication, we continued tracking VShell infrastructure globally to better understand how the framework is deployed and operated by threat actors.

This presentation provides a short overview of how VShell works and why it is attractive for adversaries. We will then focus on what happened after disclosure: how VShell infrastructure can still be fingerprinted today, how tracking methods have evolved, and what we have observed in the wild over the past year.

Using practical examples from real world tracking, we demonstrate how network fingerprints, infrastructure patterns, and traffic analysis still allow defenders and investigators to monitor VShell deployments and identify potential victims. The session will also reflect on the broader question of whether public threat research actually changes attacker behaviour, or whether many detection and tracking opportunities remain effective long after publication.

2:30 pm

Nicolas Heiniger, Senior Red Team Operator at Swiss Re

Choose your own Adventure - Red Team Edition
This talk is an interactive game. In the game we will walk through a realistic Red Team exercise from the perspective of the operator. We will face many choices and try to find our path into a fictive company and get access to their most precious secrets.

3:15 pm

Nick Maeckelberghe, Co-Founder & Managing Director at Crimson7

Speed of Threat
A journey which will allow you to detect and remediate the most sophisticated attacks

Security teams are drowning in alerts, overwhelmed by tooling, and stuck in reactive cycles fixing the past and rarely being able to focus on what is ahead. Meanwhile, attacks iterate faster than ever. Intelligence gets shared amongst attackers, tradecraft gets automated, and techniques are continuously refined.

What if defenders operated in the same way?

In this talk, we explore how companies can combine Cyber Threat Intelligence (CTI), Continuous Purple Teaming, Detection & Response-as-code (DRaC), and Threat Hunting to build a continuously validated detection capability; one that turns shared intelligence into tested controls and measurable defensive coverage, allowing you to move at the Speed of Threat.

Fabian Heiz, CISO EMEA at Vectra AI

Every other Thursday.
Fundamentals have never mattered more: Resilience, Vulnerability Debt and Shadow AI

As a former CISO of a major Swiss retailer and today Field CISO at Vectra AI, Fabian Heiz explains why the fundamentals matter more than ever now that AI makes attackers faster and cheaper. He covers three shifts:

• From prevention to resilience: What matters is no longer whether attackers get in, but how far they get. 
• Vulnerability debt: Continuous patching is a myth. Knowing your exposure and your most critical assets turns an impossible backlog into clear decisions & including taking a service offline.
• AI inside the perimeter: Shadow AI is already here. 

3:35 pm

Break

4:15 pm

4 different Breakout Sessions to join - you can choose/attend two of them

Breakout Session 1: Andra-Irina Vasile, Senior Business Information Security Officer at SIX Group & Founder at Netiquetteers

From Tool to Teammate: Making AI a Strategic Partner in Cybersecurity
Move past the hype with a practical blueprint for shifting your AI strategy from a tool you deploy to a teammate you onboard within your cybersecurity operations. This session focuses on eliminating the operational friction that stalls modern security, establishing a secure framework to transition safely from assistive to autonomous cyber defense. Ultimately, it provides a roadmap to maximize operational speed while firmly anchoring human accountability, ethical guardrails and regulatory standards.

KEY POINTS

• Real-Life Operational Examples: Practical use cases for incorporating AI directly into your security operations like SOC, Threat Intelligence, Threat Hunting and Vulnerability Management.
• The "Teammate" Paradigm: Why the goal of AI integration is not to replace human talent, but to remove the repetitive manual workload so your team can focus on high-judgment defense tasks.
• Explainable AI, Ethics & Governance: Critical strategies for managing algorithmic bias, preventing overconfidence in automated alerts, and establishing clear lines of human accountability when a model makes an error.
• The 5-Rule Playbook: Practical framework for rolling out AI, measuring its true operational impact and managing its long-term integration within your security team.

Breakout Session 2: Markus Riegler, Senior Executive - Cyber Threat Intelligence at IKARUS Security Software GmbH

From Report to Detection: Using LLMs to Transform Cyber Threat Intelligence into Actionable Detection Rules
Cyber Threat Intelligence (CTI) reports contain valuable information about adversary tactics, techniques, and indicators, but much of this knowledge remains underutilized due to the manual effort required to translate narrative reports into actionable detection logic. Security teams must interpret text-heavy reports, extract relevant indicators and behaviors, map them to frameworks such as MITRE ATT&CK, and manually implement detection rules for platforms like Sigma rule format, YARA, or SIEM queries.

Breakout Session 3: Joey Verleg, Head of Solution Engineering at Crimson7

Developing an AI SOC Agent and the Pitfalls
We build an AI agent that investigates SOC alerts, live in a terminal, starting from the naïve version and improving it in stages against one real alert. At each stage we hit a pitfall and fix it: hallucinated evidence, jumping to a verdict too early, giving a different answer every run, and clearing a real threat as benign because the logs it needed were never collected, mistaking a blind spot in the data for an all-clear.

The lesson underneath is that you should never trust an LLM by default. Even as these models get good, they still make mistakes, so you test them the way we do in this session rather than taking their verdict on faith. You leave with a blueprint for a SOC agent that shows its work, and a clear way to check where it can and can't be trusted.

Breakout Session 4: Fabian Gentinetta, Architect & Leandro Kalt, Security Engineer at Vectra AI

The Evolving SOC: Which Architecture Sets the Pace?
SIEM, Endpoint, Identity and the Future of AI-Powered Workflows

Increasing complexity, fragmented security tools and increasingly sophisticated attacks raise a critical question for Security Operations Centers: How can detection, investigation and response become more efficient without losing operational control?

SIEM-centric, Endpoint-centric or Identity-centric? Each approach offers distinct strengths but also comes with operational challenges.

In this interactive workshop, we will compare the three approaches, explore their advantages and limitations, and discuss how AI agents can support and transform existing SOC workflows.

Key Takeaways:

• Understand the strengths and limitations of different SOC approaches
• Gain insights into more efficient detection and investigation workflows
• Explore how to effectively integrate AI agents into SOC operations

5:20 pm

Short break and change the room to the next Breakout Session of your choice

5:30 pm

Start of the second Breakout Session round

6:30 pm

Dinner & Networking till open end

Fabian Gentinetta
Architect at Vectra AI

Nicolas Heiniger
Senior Red Team Operator at Swiss Re

Fabian Heiz
Field CISO EMEA

Patrick Lodder
Global Head of Threat Intelligence Services at NVISO

Nick Maeckelberghe
Co-Founder and Managing Director at Crimson7

Andra-Irina Vasile
Senior Business Information Security Officer at SIX Group & Founder of Netiquetteers

Joey Verleg
Head of Solution Engineering at Crimson7