All gone! We are officially SOLD OUT of White Participant Badges. Donor and Super Donor are still available here: events.humanitix.com... Conference schedule is live: bsideslv.org/schedule

If AI is 70% accurate on each step of a 10-task investigation, 97% of cases end up incomplete. Closing that gap revealed something worse: the AI was cheating. See Leo Meyerovich @ [un]prompted during #BSidesLV on Mon Aug 3 @ 11:00.

First-time security managers get handed a team and no instructions. This talk covers the full lifecycle: hiring, onboarding, Agile for security teams, performance management, and managing up. See Anshu Gupta @ Hire Ground during #BSidesLV on Mon Aug 3 @ 11:00.

They got RCE and exfiltrated secrets across Google, Datadog, Vercel, and multiple Fortune 500 environments, all through AI agents in CI/CD pipelines. The attack path was a GitHub issue. See Mackenzie Jackson and Rein Daelman @ [un]prompted during #BSidesLV on Mon Aug 3 @ 17:30.

Thank you Ultra Security for being our BSides Bus sponsor 🚌 Running Wed, Aug 5th - Sun, Aug 9th. Check out bsideslv.org/shuttle for the full schedule. Interested in learning more about Ultra Security’s opportunities? Visit ultra.security/careers

A decade of GM's bug bounty: from spreadsheets to Auto-Triage. What worked, what failed, and what they wish they'd known earlier. See Jacob Martinez, Aakash Krishana, Christopher Walter, and Jason Brown @ Common Ground during #BSidesLV on Tue Aug 4 @ 18:00.

When one AI agent tells another to take an action, the receiver has no way to verify the sender is who it claims to be. TLS and bearer tokens don't solve agent identity. Cryptographic DIDs do. See Becki True and Steve Jarvis @ Common Ground during #BSidesLV on Tue Aug 4 @ 11:00.

Rust is the red team language of choice. Nearly every production obfuscator targets C/C++ or PE/ELF images. Lyra is the first cargo-native LLVM IR obfuscator built specifically for Rust. See Rafael Felix & João Pedro Tricta @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 18:00

Pre-swag fundraising is now closed. However, during the show, you can get merch with a drop-ship options directly from Custom Ink and at the Merch Table in Middle Ground!

Permissive JSON parsing and SQL inner joins are standard ETL practice. In a vulnerability pipeline, they're also silent filters that delete Shadow IT assets before anyone sees them. See Divyesh Batra and Dustin Niehues @ Ground Truth during #BSidesLV on Mon Aug 3 @ 17:00.

Your SIEM isn't ignoring firewall logs because your team isn't paying attention. It's ignoring them because EPS licensing makes full ingestion unaffordable. FLASI was built to fix that. See Manuel Montes de Oca @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 15:00.

GoDaddy manages millions of domains across hundreds of AWS accounts. This is the inside story of how they stopped triaging subdomain takeover and started eliminating it. See Jai Sharma, Thomas McCarthy, and Akhil Sharma @ Breaking Ground during #BSidesLV on Mon Aug 3 @ 14:00.

Prompt injection can become operationally irrelevant. Not by building better filters. By designing AI systems correctly in the first place. See Emily Choi-Greene @ [un]prompted during #BSidesLV on Mon Aug 3 @ 15:00.

Thank you Spektrum Labs for being a Double Down sponsor 🎲 Come check out their table August 3rd–5th! Interested in learning more about their company? Visit spektrum.ai/our-visi...

251 flaws across five C2 frameworks, and 28 takedown chains. Turning attacker infrastructure against the operator running it is not theoretical. See Vitaly Simonovich @ Breaking Ground during #BSidesLV on Mon Aug 3 @ 18:00.

AI lets you prototype security tooling faster than ever. It also ships agent sandboxing gaps, access control gaps, and unsecured features faster than ever. Speed is not the same as progress. See Kane Narraway @ [un]prompted during #BSidesLV on Mon Aug 3 @ 17:00.

Offensive AI agents are strong at chaining vulnerabilities once inside. 62% of failures stall at exploitation. Enumeration is weak. Reporting is weak. Benchmarks don't measure any of that. See Rachel Benson @ Ground Truth during #BSidesLV on Mon Aug 3 @ 18:00.

App-layer encryption on consumer IoT devices looks solid until you hook OpenSSL with Frida and pull the AES keys straight out of memory. Two Chinese adult toy apps, same hardcoded key pattern underneath. See Mansoor Ahmad @ Common Ground during #BSidesLV on Tue Aug 4 @ 15:30.

Your resume gets filtered before a human sees it. The structure that gets past ATS and the framing that works on human reviewers aren't the same thing. This talk covers both. See Rupinder pal Singh and Morgan Hess @ Hire Ground during #BSidesLV on Mon Aug 3 @ 18:00.

"60% of small businesses fail within six months of a breach" is a vendor pitch staple with no solid evidence behind it. The Destroyed by Breach project went looking for what actually happened. See Adrian Sanabria @ Common Ground during #BSidesLV on Tue Aug 4 @ 10:00.

Thank you @BofA_Careers for being a Coffee Bar sponsor ☕ Interested in learning more about their company? Interested in learning more about their company? Visit careers.bankofameric...

Thank you @nudgesecurity.bsky.social for being a Double Down sponsor 🎲Come check out their table August 3rd–5th! Interested in learning more about their company? Visit www.linkedin.com/com...

CloudShell abuse falls between vendor and org responsibility, so neither side monitors it well. C2 provisioning, cryptomining, exfil, and persistence at scale across AWS, GCP, and Azure. See Jenko Hwong @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 11:30.

One bot kept CVEs at zero for three months. Another couldn't fix flaky tests at all. The difference between AI that works and AI that doesn't is whether it can see the actual problem. See Aldo Salas @ Common Ground during #BSidesLV on Mon Aug 3 @ 14:30.

Defense research is poorly aligned with the latest advances in attack capabilities. The most critical intersections of AI and cybersecurity are the most understudied. See Fred Heiding @ [un]prompted during #BSidesLV on Mon Aug 3 @ 18:00.

Human vishing is unprofitable at US wages. AI vishing is already profitable. The risk isn't superhuman persuasion. It's industrial-scale automation of scams that already work. See Fred Heiding and Simon Lermen @ Ground Truth during #BSidesLV on Mon Aug 3 @ 10:00.

A thermostat that exposes hundreds of building controls from a single overlooked service is a network segmentation failure. OT and building automation protocols are where the backplane gaps live. See HD Moore @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 14:00.

Deploying a persistent bootkit before the system has a chance to defend itself: full attack chain from reversing a vulnerable EFI component to abuse in a real scenario on Windows and Linux. See Alejandro Vazquez Vazquez @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 17:00.

Ten S/MIME vendors. Privacy-invading trackers, unreadable privacy policies, and at least one that couldn't generate a valid certificate. The market for encrypted email certs is broken. See Tobias Mueller @ Breaking Ground during #BSidesLV on Mon Aug 3 @ 11:00.

Thank you @yeswehack for being a happy hour sponsor! 🍹 Tuesday drinks on them 😉 Interested in learning more about their company? Visit www.welcometothejung...

Privacy, surveillance, and free speech from EFF leadership. Interactive, audience-driven, no scripted answers. See Rory Mir, Haley Pedersen, Cindy Cohn, Kenyatta Thomas, and Alexis Hancock @ Common Ground during #BSidesLV on Tue Aug 4 @ 14:00.

Burned-out staff, no trust, and a hostile news cycle. Rebuilding a security program after compromise starts with the people still there, not the controls that failed. See Cat Self @ Common Ground during #BSidesLV on Mon Aug 3 @ 16:00.

No malicious attachments, no detection flags, inbox placement guaranteed. Cross-tenant abuse of trusted cloud workflows is the initial access vector defenders aren't watching for. See Priyank Nigam @ Breaking Ground during #BSidesLV on Mon Aug 3 @ 15:00.

DPRK-attributed campaigns placed fake personas inside real companies. They passed interviews, collected paychecks, and accessed sensitive systems. How to spot them before you hire. See Michael Reimsbach and Rishi (@rxerium) @ Common Ground during #BSidesLV on Tue Aug 4 @ 15:00.

EPSS is widely used and frequently misapplied. One of its creators walks through what the model was actually built to do, what data drives it, and where practitioners get it wrong. See Jay Jacobs @ Ground Truth during #BSidesLV on Mon Aug 3 @ 14:00.

Real APTs have used BYOVD attacks to disable EDR and antivirus using kernel-mode techniques. This talk reverse engineers the driver vulnerabilities that made those campaigns possible. See Diego Tellaroli @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 14:30.

It's almost time! BSidesLV has a special track this year, Monday only. [un]prompted is bringing you AI practitioner talks covering development and security. Their schedule is online at: bsideslv.org/schedule Badges are almost gone, so don't miss out: events.humanitix.com...

Heads up! The badges for BSides Las Vegas this year are almost gone. Only a few remain. If you were waiting to reserve yours, now is your last chance. Reserve your badge here: events.humanitix.com... Conference schedule is live: bsideslv.org/schedule

Thank you @intruder_io for being a happy hour sponsor! 🍹 Monday drinks on them 😉 Interested in learning more about their company? Visit careers.intruder.io/...

Most AI security hype is old risks in new clothes. Some of it is genuinely different. This talk separates the two fast, myth-busts overstated narratives, and skips doom and jargon. Join Samantha Swift and Dave McKenzie @ Common Ground during #BSidesLV on Tue Aug 4 @ 17:00.

95 engagements, 1,265 terminal sessions, 6,001 commands recorded. Operators don't follow a kill chain. They spiral between credential access and discovery an average of 12 times per engagement. See Bobby Kuzma @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 11:00.

Resumes filtered by automation, entry-level roles demanding senior experience, and interviews that end in silence. Two veterans explain how to stop being invisible in a crowded market. See John Stoner and Joshua Mason @ Hire Ground during #BSidesLV on Mon Aug 3 @ 17:00.

Keyless authentication was supposed to reduce credential risk. Three attack paths later, it's an under-detected persistence vector that most cloud defenders aren't logging at the tier that matters. See Jie Wu @ Breaking Ground during #BSidesLV on Mon Aug 3 @ 10:00.

360-degree surveillance marshaled by both companies and governments isn't a future scenario. Cindy Cohn has spent 30 years at EFF fighting it and she's here to explain what comes next. See Cindy Cohn @ Common Ground during #BSidesLV on Mon Aug 3 @ 11:00.

Building teams, hiring, burnout, boardrooms, and constant change. Three CISOs with different backgrounds, one room, no prepared answers. Bring your questions. See Kris Rides, Jeff Bryner, and Yonesy Nunez @ Hire Ground during #BSidesLV on Mon Aug 3 @ 14:00.

It's the first memory forensics framework for Go binaries that recovers what static tools miss: C2 endpoints, encryption keys, and execution state. See Hala Ali and Andrew Case @ Breaking Ground during #BSidesLV on Mon Aug 3 @ 10:30.

Thank you @runsybil for being a Dealer's Choice sponsor 🏆 Interested in learning more about their company? Visit www.runsybil.com/car...

Agents run thousands of third-party plugins & the trust model is "read the README and hope." Tool descriptions are executable prompts. Tool parameters are executable code paths. See Abhijeet Kumar, Varun Wadhwa, and Xia Hua @ Common Ground during #BSidesLV on Tue Aug 4 @ 11:30.

Scammers use predictable milestones to move victims toward payment. An LLM-driven honeypot engaged them for weeks, navigating each step to map exactly how pig butchering operations work. See Ariana Mirian @ Ground Truth during #BSidesLV on Mon Aug 3 @ 11:00.

It started with a quiet foothold in a CI/CD runner. From there: IAM workflows, cloud control planes, and the organization's own security tooling turned against them. Domain Admin, no malware required. See Yoann DEQUEKER @ Breaking Ground during #BSidesLV on Tue Aug 4 @ 10:00.