1:30 pm

Registration

2:00 pm

Welcome & short introduction from Mark Beerends, SIGS Contributor & Cyber Strategy Partner at Prusec GmbH

2:00 pm

Patrick Lodder, Global Head of Threat Intelligence Services at NVISO Security

VSHELL - Tracking a State actor used Modern Post-Exploitation Framework in the Wild
VShell is a post-exploitation command and control framework that has increasingly appeared in real world intrusions targeting government and critical sectors. Following NVISO’s initial research and publication, we continued tracking VShell infrastructure globally to better understand how the framework is deployed and operated by threat actors.

This presentation provides a short overview of how VShell works and why it is attractive for adversaries. We will then focus on what happened after disclosure: how VShell infrastructure can still be fingerprinted today, how tracking methods have evolved, and what we have observed in the wild over the past year.

Using practical examples from real world tracking, we demonstrate how network fingerprints, infrastructure patterns, and traffic analysis still allow defenders and investigators to monitor VShell deployments and identify potential victims. The session will also reflect on the broader question of whether public threat research actually changes attacker behaviour, or whether many detection and tracking opportunities remain effective long after publication.

2:30 pm

Nicolas Heiniger, Senior Red Team Operator at Swiss Re

Choose your own Adventure - Red Team Edition
This talk is an interactive game. In the game we will walk through a realistic Red Team exercise from the perspective of the operator. We will face many choices and try to find our path into a fictive company and get access to their most precious secrets.

3:15 pm

Nils Maeckelberghe, Co-Founder & Managing Director of Crimson7

Always Under Attack: Continuous (AI) Purple Teaming
A red team engagement ends the same way every time. We phish a user, run our code, escalate, grab credentials, and move laterally until we have compromised something that demonstrates high impact. Then we write it up, hand you the report, and leave, and two questions walk out the door with us. First: once you have built a detection for that attack path, does it actually catch the attack? Second: could you run the path again to find out? For most organizations
the honest answer to both is no.

Attendees leave with a repeatable model for behavior-level detection validation, a live look at how detections regress between tests and how to catch it the week it happens, and a closed attack-to-defense loop that turns every missed technique into a rule the blue team keeps.

KEY TAKEAWAYS

• AI behavior fuzzing. How an LLM turns one human-authored procedure into dozens of functionally-equivalent variants, swapping LOLBins, API and syscall paths, injection methods and obfuscation, then runs them all to show exactly which variants your controls miss.
• AI campaign orchestration. How an agent reads a MITRE Attack Flow, picks the matching building block for each node, and passes real loot, dumped credentials or enumerated hosts, from initial access through to impact, without ever generating exploit code itself.
• Continuous drift detection. A scheduled replay loop that correlates every run with SIEM and EDR telemetry and raises a regression alert the week a previously-detected technique goes dark, with a diff of what changed underneath it.
• A closed attack-to-defense loop. When a technique evades, the AI drafts a candidate custom detection rule from the telemetry that did land; you commit it, re-run the same chain, and confirm the detection now fires.

Short presentation from a sponsor

3:35 pm

Break

4:15 pm

4 different Breakout Sessions to join - you can choose/attend two of them

Breakout Session 1: Andra-Irina Vasile, Senior Business Information Security Officer at SIX Group & Founder at Netiquetteers

From Tool to Teammate: Making AI a Strategic Partner in Cybersecurity
Move past the hype with a practical blueprint for shifting your AI strategy from a tool you deploy to a teammate you onboard within your cybersecurity operations. This session focuses on eliminating the operational friction that stalls modern security, establishing a secure framework to transition safely from assistive to autonomous cyber defense. Ultimately, it provides a roadmap to maximize operational speed while firmly anchoring human accountability, ethical guardrails and regulatory standards.

KEY POINTS

• Real-Life Operational Examples: Practical use cases for incorporating AI directly into your security operations like SOC, Threat Intelligence, Threat Hunting and Vulnerability Management.
• The "Teammate" Paradigm: Why the goal of AI integration is not to replace human talent, but to remove the repetitive manual workload so your team can focus on high-judgment defense tasks.
• Explainable AI, Ethics & Governance: Critical strategies for managing algorithmic bias, preventing overconfidence in automated alerts, and establishing clear lines of human accountability when a model makes an error.
• The 5-Rule Playbook: Practical framework for rolling out AI, measuring its true operational impact and managing its long-term integration within your security team.

Breakout Session 2: Markus Riegler, Senior Executive - Cyber Threat Intelligence at IKARUS Security Software GmbH

From Report to Detection: Using LLMs to Transform Cyber Threat Intelligence into Actionable Detection Rules
Cyber Threat Intelligence (CTI) reports contain valuable information about adversary tactics, techniques, and indicators, but much of this knowledge remains underutilized due to the manual effort required to translate narrative reports into actionable detection logic. Security teams must interpret text-heavy reports, extract relevant indicators and behaviors, map them to frameworks such as MITRE ATT&CK, and manually implement detection rules for platforms like Sigma rule format, YARA, or SIEM queries.

Breakout Session 3: Nils Maeckelberghe, Co-Founder & Managing Director of Crimson7

A journey which will allow you to detect and remediate the most sophisticated attacks
Financial institutions operate in one of the most targeted and regulated threat environments worldwide. Security teams are drowning in alerts, overwhelmed by tooling, and stuck in reactive cycles fixing the past and rarely being able to focus on what is ahead. Meanwhile, attacks iterate faster than ever. Intelligence gets shared amongst attackers, tradecraft gets automated, and techniques are continuously refined.

What if defenders operated in the same way?

In this talk, we explore how institutions can combine Cyber Threat Intelligence (CTI), Continuous Purple Teaming, Detection & Response-as-code (DRaC), and Threat Hunting to build a continuously validated detection capability; one that turns shared intelligence into tested controls and measurable defensive coverage, allowing you to move at the Speed of Threat.

Breakout Session 4: (details will follow)

5:20 pm

Short break and change the room to the next Breakout Session of your choice

5:30 pm

Start of the second Breakout Session round

6:30 pm

Dinner & Networking till open end

Nicolas Heiniger
Senior Red Team Operator at Swiss Re

Andra-Irina Vasile
Senior Business Information Security Officer at SIX Group & Founder of Netiquetteers