1:30 pm

Registration

2:00 pm

Welcome & short introduction from Mark Beerends, SIGS Contributor & Cyber Strategy Partner at Prusec GmbH

2:00 pm

Patrick Lodder, Global Head of Threat Intelligence Services at NVISO Security

VSHELL - Tracking a State actor used Modern Post-Exploitation Framework in the Wild
VShell is a post-exploitation command and control framework that has increasingly appeared in real world intrusions targeting government and critical sectors. Following NVISO’s initial research and publication, we continued tracking VShell infrastructure globally to better understand how the framework is deployed and operated by threat actors.

This presentation provides a short overview of how VShell works and why it is attractive for adversaries. We will then focus on what happened after disclosure: how VShell infrastructure can still be fingerprinted today, how tracking methods have evolved, and what we have observed in the wild over the past year.

Using practical examples from real world tracking, we demonstrate how network fingerprints, infrastructure patterns, and traffic analysis still allow defenders and investigators to monitor VShell deployments and identify potential victims. The session will also reflect on the broader question of whether public threat research actually changes attacker behaviour, or whether many detection and tracking opportunities remain effective long after publication.

2:30 pm

Nicolas Heiniger, Senior Red Team Operator at Swiss Re

Choose your own Adventure - Red Team Edition
This talk is an interactive game. In the game we will walk through a realistic Red Team exercise from the perspective of the operator. We will face many choices and try to find our path into a fictive company and get access to their most precious secrets.

3:15 pm

Nick Maeckelberghe, Co-Founder & Managing Director at Crimson7

Speed of Threat
A journey which will allow you to detect and remediate the most sophisticated attacks

Security teams are drowning in alerts, overwhelmed by tooling, and stuck in reactive cycles fixing the past and rarely being able to focus on what is ahead. Meanwhile, attacks iterate faster than ever. Intelligence gets shared amongst attackers, tradecraft gets automated, and techniques are continuously refined.

What if defenders operated in the same way?

In this talk, we explore how companies can combine Cyber Threat Intelligence (CTI), Continuous Purple Teaming, Detection & Response-as-code (DRaC), and Threat Hunting to build a continuously validated detection capability; one that turns shared intelligence into tested controls and measurable defensive coverage, allowing you to move at the Speed of Threat.

Short presentation from a sponsor

3:35 pm

Break

4:15 pm

4 different Breakout Sessions to join - you can choose/attend two of them

Breakout Session 1: Andra-Irina Vasile, Senior Business Information Security Officer at SIX Group & Founder at Netiquetteers

From Tool to Teammate: Making AI a Strategic Partner in Cybersecurity
Move past the hype with a practical blueprint for shifting your AI strategy from a tool you deploy to a teammate you onboard within your cybersecurity operations. This session focuses on eliminating the operational friction that stalls modern security, establishing a secure framework to transition safely from assistive to autonomous cyber defense. Ultimately, it provides a roadmap to maximize operational speed while firmly anchoring human accountability, ethical guardrails and regulatory standards.

KEY POINTS

• Real-Life Operational Examples: Practical use cases for incorporating AI directly into your security operations like SOC, Threat Intelligence, Threat Hunting and Vulnerability Management.
• The "Teammate" Paradigm: Why the goal of AI integration is not to replace human talent, but to remove the repetitive manual workload so your team can focus on high-judgment defense tasks.
• Explainable AI, Ethics & Governance: Critical strategies for managing algorithmic bias, preventing overconfidence in automated alerts, and establishing clear lines of human accountability when a model makes an error.
• The 5-Rule Playbook: Practical framework for rolling out AI, measuring its true operational impact and managing its long-term integration within your security team.

Breakout Session 2: Markus Riegler, Senior Executive - Cyber Threat Intelligence at IKARUS Security Software GmbH

From Report to Detection: Using LLMs to Transform Cyber Threat Intelligence into Actionable Detection Rules
Cyber Threat Intelligence (CTI) reports contain valuable information about adversary tactics, techniques, and indicators, but much of this knowledge remains underutilized due to the manual effort required to translate narrative reports into actionable detection logic. Security teams must interpret text-heavy reports, extract relevant indicators and behaviors, map them to frameworks such as MITRE ATT&CK, and manually implement detection rules for platforms like Sigma rule format, YARA, or SIEM queries.

Breakout Session 3: Joey Verleg, Head of Solution Engineering at Crimson7

(Details will follow)

Breakout Session 4: (details will follow)

5:20 pm

Short break and change the room to the next Breakout Session of your choice

5:30 pm

Start of the second Breakout Session round

6:30 pm

Dinner & Networking till open end

Nicolas Heiniger
Senior Red Team Operator at Swiss Re

Andra-Irina Vasile
Senior Business Information Security Officer at SIX Group & Founder of Netiquetteers

Joey Verleg
Head of Solution Engineering at Crimson7