Security BSides Prague 2026: Full Schedule

It is an annual, community-driven information security conference held in Prague. The event provides a platform for cybersecurity professionals, enthusiasts, and researchers to share knowledge, exchange ideas, and discuss the latest trends in the field. It’s a unique opportunity to connect with like-minded individuals, expand professional networks, and stay informed about the ever-evolving cybersecurity landscape.
More info at www.bsidesprg.cz

arrow_back View All Dates

10:10 CEST

Breaching The Perimeter: The Forgotten Attack Vector That Always Works

Friday April 24, 2026 10:10 - 10:55 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Physical security failures still open the door to serious breaches. We show how attackers gain access, exploit trust, and bypass controls using real-world scenarios, including a live server-room door assessment, and provide concrete steps to harden facilities, meet regulations, and reduce risk.

Speakers

Jiří Vaněk

Co-founder, Red Teamers

Jiří Vanek is an security consultant with over 20 years of experience encompassing IT, Management, and Ethical Hacking. He has led Red Team engagements, relishes in physical intrusions, and has first-hand experiences of successful intrusions and successful detections for clients... Read More →

Chris Cowling

Red Teamers

Friday April 24, 2026 10:10 - 10:55 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

10:10 CEST

The Agents of Chaos: AI Driven Malware Generation

Friday April 24, 2026 10:10 - 10:55 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

AI agents are catching wind in offensive security, now it's the time to focus on malware. An agent that is incharge of the malware creation process directly.
From the spark of the idea, comparing different models, prompts, and results, to the challenges we faced, improvements, and actual testing.

Speakers

Arad Donenfeld

Attacks and Exploits Developer, SafeBreach

Arad Donenfeld is an attacks and exploits developer in SafeBreach, and has a background in security research from several roles (including Deep Instinct, where this research was conducted). With his strong foundations of development, security, and operating systems internals, Arad... Read More →

Friday April 24, 2026 10:10 - 10:55 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

11:00 CEST

Abusing the Ordinary: New COM-Based Windows Attack Vectors

Friday April 24, 2026 11:00 - 11:45 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

This talk explores Windows COM infrastructure from an offensive perspective, presenting COM hunting methodologies and several previously undocumented attack techniques that enable stealthy code execution and sensitive data access through legitimate system components.

Speakers

Marco Balzarin

SentinelOne

I'm a Security Engineer specializing in offensive security research within Windows environment. Over the years, I have worked extensively in red teaming, penetration testing, reverse engineering, and malware analysis and development. During this time, I have supported organizations... Read More →

Friday April 24, 2026 11:00 - 11:45 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

11:00 CEST

Forked and Owned: Taking Over GitHub Repositories via a single Pull Request

Friday April 24, 2026 11:00 - 11:45 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

GitHub Actions is broken. Attackers can now enjoy an RCE-as-a-service vector that can lead to significant downstream effects. In this talk, you will learn how I managed to compromise the repositories of Google, Microsoft and other Fortune-100 companies, simply by creating a pull request from a fork.

Speakers

Ari Marzuk

Senior Security Researcher, Microsoft

Ari Marzuk (also known as MaccariTA) is a Senior AI Security Researcher at Microsoft with nearly a decade of cybersecurity experience. He previously worked for Salesforce, NSO Group and the Israeli Military Intelligence. In 2025, Ari published "IDEsaster" revealing 25 new CVEs in... Read More →

Roi Nisimi

Orca Security

Roi Nisimi is a Principal Security Researcher at Orca Security with over a decade of experience in vulnerability research and offensive cybersecurity. He honed his skills during six years of service in the Intelligence Corps of the IDF, where he achieved the rank of Lieutenant before... Read More →

Friday April 24, 2026 11:00 - 11:45 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

11:50 CEST

1 Click, 0 Warnings: Hijacking Mic, Camera & GPS via Browser UI Blindspots

Friday April 24, 2026 11:50 - 12:35 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Browsers lie. Permission prompts show your trusted domain while hidden iframes hijack camera, mic, or GPS. This systemic flaw enables surveillance at scale. I’ll demo real exploits, dissect failed defenses, and reveal why even Fortune 500 portals remain vulnerable.

Speakers

Armaan Pathan

Katim LLC

Armaan Pathan is a Senior Security Engineer at KATIM with deep expertise in application security, penetration testing, and bug bounty hunting. Over the past 10+ years, he has uncovered and responsibly disclosed critical vulnerabilities at leading tech organizations including Google... Read More →

Friday April 24, 2026 11:50 - 12:35 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

11:50 CEST

Mad data science for practical C2 detection - the talk

Friday April 24, 2026 11:50 - 12:35 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Are you understaffed and never have enough time for threat hunting? Do you have a C2 beaconing problem on your network? You wish your middle name was automation or machine learning? Well, look no further! This talk can fit so much data science for C2 detection! *slaps roof of PowerPoint slide deck*

Speakers

Eva Szilagyi

Consultant, Alzette Information Security

David Szili

Principal consultant, Alzette Information Security

David Szili is a principal consultant at Alzette Information Security, an information security consulting company based in Europe. He has more than ten years of professional experience in various areas like penetration testing, red teaming, security monitoring, security architecture... Read More →

Friday April 24, 2026 11:50 - 12:35 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

13:35 CEST

Beyond classic detections: unlocking the full potential of EDR telemetry

Friday April 24, 2026 13:35 - 14:20 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Your EDR collects far more data than its built-in rules use. We'll show how to turn raw telemetry into custom detections for AD attacks like DCSync, lateral movement, and recon that default rules miss. We'll even explore if AI can help build new rules. The methodology applies to any modern EDR.

Speakers

Dylan Guerville

Red Team Tech Lead, Intrinsec

Friday April 24, 2026 13:35 - 14:20 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

13:35 CEST

Painless IOS App Pentesting

Friday April 24, 2026 13:35 - 14:20 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

IOS security is getting tighter, and many mobile pentesters feel locked out as there is no jailbreak for the latest versions. Entitlements are stricter than ever and traditional dynamic analysis has become much harder. However, modern iOS pentesting isn't dead - it just requires a smarter approach.

Speakers

Khayal Farzaliyev

Founder, Shaman Red Team

I’m an Application Security Engineer with over three years of practical experience across web and mobile penetration testing, secure software design, and vulnerability research - along with several CVE discoveries. I’m currently pursuing a PhD focused on Intrusion Prevention Systems... Read More →

Friday April 24, 2026 13:35 - 14:20 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

14:25 CEST

Uncovering SAP BTP Attack Vectors, Before Someone Else Does!

Friday April 24, 2026 14:25 - 15:10 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Think SAP BTP is secure by design? Think again. In this red team–driven talk, we’ll break into BTP using misconfigurations, over-permissioned services, vulnerable Kyma flows, and Cloud Connector shortcuts. Real attack paths. No fluff. Just cloud-native chaos, with demos.

Speakers

Waseem Ajrab

Head of Security Advisory, NO MONKEY GmbH

Waseem Ajrab, a seasoned cybersecurity professional, leads cybersecurity initiatives at NO MONKEY, focusing on SAP environments globally. With expertise in SOC, network security, and penetration testing, he fortifies critical systems through strategic vision. Waseem is a key contributor... Read More →

Friday April 24, 2026 14:25 - 15:10 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

14:25 CEST

What an "Exploitable CVE" Really Means: Moving Beyond CVSS Scores

Friday April 24, 2026 14:25 - 15:10 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Most CVEs never become real risks. We explore what makes a vulnerability truly exploitable by examining the economics of offensive research, the limitations of scoring systems, and the conditions required for exploitation. Attendees will learn why exploitability is discretional and how to prioritize

Speakers

Eryx Paredes

Staff Security Engineer, Lyft

Eryx is an enthusiast in Cybersecurity and OpenSource. Currently working as Staff Security Engineer at Lyft he leads the vulnerability management program, handling the strategy to identify and fix code, infrastructure and endpoint vulnerabilities at scale. His career includes roles... Read More →

Friday April 24, 2026 14:25 - 15:10 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

15:15 CEST

Decoding Chinese State-Sponsored Cyber Activity: Behavioral Models for Early Detection and Effective Threat Hunting

Friday April 24, 2026 15:15 - 15:40 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Key Takeaways: A structured approach to behavioral attribution for Chinese state-sponsored activity Case studies illustrating persistent behavioral patterns across varied campaigns Practical behavioral models that can be deployed by any security team to support threat hunting and early detection

Speakers

Nathaniel Jones

Darktrace

Drawing on his extensive background in both government and private sector cybersecurity, Nathaniel brings a global perspective to threat analysis and defense strategies. Prior to Darktrace, he spent 7 years at the U.S. Cybersecurity and Infrastructure Security Agency (CISA), where... Read More →

Friday April 24, 2026 15:15 - 15:40 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

15:15 CEST

LLMs for Vulnerability Fixing: Hype or Reality?

Friday April 24, 2026 15:15 - 15:40 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Large Language Models seem ideal for fixing vulnerabilities, but how effective are they really? This talk explores how context, knowledge bases, and inference strategies impact LLM-based remediation, separating real progress from pure hype.

Speakers

Edouard Viot

CTO & Cofounder, Symbiotic Security

Edouard Viot is the co-founder and CTO of Symbiotic Security, an American-French startup specializing in AI-assisted code security. A passionate entrepreneur at the intersection of cybersecurity and innovation, he designs tools that help developers write more secure code through integrated... Read More →

Friday April 24, 2026 15:15 - 15:40 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

16:05 CEST

From Input to Impact: Prompt Injection in Production Pipelines

Friday April 24, 2026 16:05 - 16:30 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Prompt injection is no longer a chatbot trick, it allowed us to hack Google. As AI agents enter CI/CD and build systems, untrusted input becomes an execution vector. This talk reveals real-world pipeline exploits affecting Fortune 500 firms and explains why prompt injection is a very real threat.

Speakers

Mackenzie Jackson

Developer advocate, GitGuardian

Mackenzie is a developer advocate with a passion for code security. As the co-founder and former CTO of the health tech startup Conpago, he learnt first-hand how critical it is to build secure applications with robust developer operations.
Today as the Developer Advocate at GitGuardian, Mackenzie is able to share his passion for code security with developers and works closely with research teams to show how malicious actors discover and exploit vulnerabilities in our applications... Read More →

Friday April 24, 2026 16:05 - 16:30 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

16:05 CEST

LazarOps: APT Tactics Targeting the Developers Supply Chain

Friday April 24, 2026 16:05 - 16:50 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

LazarOps is the name of an investigation done by Security Joes that uncovers how Lazarus built a network of fake GitHub accounts, malicious coding challenges, and cross-platform tooling to target developers and infiltrate software supply chains.

Speakers

Diogo Machado

Threat Researcher, Security Joes

Diogo Machado has been working in the cyber security field for the past 10 years. Staring in a public company in Portugal, he developed yearly the joy in malware analysis and reverse engineering. From then, he joined Siemens in which he practiced the investigation and response to... Read More →

Friday April 24, 2026 16:05 - 16:50 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

16:35 CEST

Call Me By Your [User]Name: Modern Identity-Centric Attacks

Friday April 24, 2026 16:35 - 17:00 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Forget malware. Attackers are logging in now. Discover the identity-centric attacks, accelerated by AI and used by threat actors like Scattered Spider to bypass MFA and turn trusted processes into their primary weapon. In a world of smart systems, vigilance starts with knowing who you’re talking to.

Speakers

Lucie Kadlecova

CTI analyst & manager, PwC

Lucie works as a CTI analyst and manager in the PwC Global Threat Intelligence team. She was previously a Fulbright visiting scholar at the Massachusetts Institute of Technology (MIT) in Cambridge, USA, and worked at the Czech National Cyber Security Centre. She holds a PhD from Charles... Read More →

Friday April 24, 2026 16:35 - 17:00 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

16:55 CEST

RTFM - Read The Fatal Manual: When Documentation Creates Critical Misconfiguration

Friday April 24, 2026 16:55 - 17:40 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Misconfigurations persist in enterprises despite widespread awareness - with AD CS being the prime example. This talk explores how vendors guide users into deploying critical misconfigurations, a large-scale responsible disclosure journey, and the shared responsibilities between us all.

Speakers

Martin Sohn Christensen

SpecterOps

I am a Security Researcher at SpecterOps, specializing in Microsoft technologies with expertise in Active Directory, identity attack paths, and secure system configuration. I bring a well-rounded perspective on security risks and challenges stemming from a background in system administration... Read More →

Friday April 24, 2026 16:55 - 17:40 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

17:05 CEST

So You Want to Write a Book? Writing About AI Security For No Starch Press

Friday April 24, 2026 17:05 - 17:50 CEST

Lucerna Cinema - AUX @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Ever wondered what it’s like to write a technical book? I’ll share how I wrote an AI security book for No Starch Press—how it started, what made it so different from a PhD, the behind-the-scenes work, and the key lessons I learned for anyone tackling a big creative project.

Speakers

Harriet Farlow

Mileva Security Labs

Harriet Farlow is the CEO of AI Security company Mileva Security Labs, a PhD Candidate in Machine Learning Security, and creative mind behind the YouTube channel HarrietHacks. She missed the boat on computer hacking so now she hacks AI and Machine Learning models instead. Her career... Read More →

Friday April 24, 2026 17:05 - 17:50 CEST
Lucerna Cinema - AUX Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

17:50 CEST

CLOSING BSIDES 2026

Friday April 24, 2026 17:50 - 18:15 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Martin Hron will officially close BSides Prague 2026 with a final wrap-up session marking the end of two days filled with knowledge sharing, technical deep dives, inspiring discussions, and new connections. This closing talk will thank all speakers, partners, volunteers, and attendees who made the event possible, briefly reflect on the highlights of the conference, and encourage the community to stay connected beyond the venue walls. The session will smoothly transition into the evening program, guiding attendees toward the afterparty and the informal afterparty talks that continue the spirit of BSides in a more relaxed setting — because while the conference may be ending, the conversations are just getting started.

Speakers

Martin Hron

Staff Offensive Researcher, BSides Czech z.s. / SentinelOne

Friday April 24, 2026 17:50 - 18:15 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

18:30 CEST

Airport Security! - S01 E008 - Breaking into your baggage

Friday April 24, 2026 18:30 - 18:55 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

When we travel with valuable luggage, we rely on the security of locks, especially those that are TSA-approved. But, are they really? In this talk, we’ll discuss how lock picking techniques, master keys, and bypass methods can compromise the security of TSA-approved locks.

Speakers

Héctor Cuevas Cruz

Senior Managing Security Consultant, Bishop Fox

Héctor is a Senior Managing Security Consultant at Bishop Fox with over 12 years of experience in offensive security, digital forensics, threat hunting, and incident response, and has presented on multiple occasions at international conferences such as DEFCON, Ekoparty, WWHF and... Read More →

Friday April 24, 2026 18:30 - 18:55 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

19:10 CEST

Last night a DJ erased my drive

Friday April 24, 2026 19:10 - 19:55 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

Music and security have much in common. Both require a trigger that sets off a series of events. Music can cause destruction and has been used for torture as well for encryption to bypass censorship. Music is also fun and this talk will be an audio-visual journey through cybersecurity.

Speakers

Mathew Caplan

Director of Professional Services, Orange Cyberdefense

Mathew Caplan is Director of Professional Services for Orange Cyberdefense, based in London, England. He is a highly experienced cybersecurity specialist with over 25 years in the field and a proven record in the implementation of information risk management processes. As a recognised... Read More →

Friday April 24, 2026 19:10 - 19:55 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

20:10 CEST

The Great Train Robbery - Hacking Like It’s 1855

Friday April 24, 2026 20:10 - 20:55 CEST

Lucerna Cinema - MAIN @ Vodičkova 704 /36/110 00, 110 00 Nové Město

In his book “The Great Train Robbery” Michael Crichton details a train robbery in 1855 involving a prostitute and scaling buildings. Although these methods are not included in any letter of engagement, the most famous train robbery of its time has parallels to modern day physical security.

Speakers

Paul Zenker

KPMG

I am a security consultant for KPMG specialising in the fields of AI security and physical security. I have given talks on both topics across conferences in Europe and I am a co organiser of BSides Dresden.

Friday April 24, 2026 20:10 - 20:55 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

10:10 CEST

10:10 CEST

11:00 CEST

11:00 CEST

11:50 CEST

11:50 CEST

13:35 CEST

13:35 CEST

14:25 CEST

14:25 CEST

15:15 CEST

15:15 CEST

16:05 CEST

16:05 CEST

16:35 CEST

16:55 CEST

17:05 CEST

17:50 CEST

18:30 CEST

19:10 CEST

20:10 CEST

Get help with the event