BSidesSF 2025: Full Schedule

11:15am PDT

Enhancing Secret Detection in Cybersecurity with Small LMs

Saturday April 26, 2025 11:15am - 11:45am PDT

Dive into the challenges of LLMs in cybersecurity as we explore the process of fine-tuning an LLM to handle the task of secret detection in code and be efficient enough to run on any laptop.

Can LLMs with low inference times pave the way for new detection methods that were previously overlooked?

Speakers

Danny Lazarev

Erez Harush

Saturday April 26, 2025 11:15am - 11:45am PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

12:00pm PDT

Resilience in the Uncharted AI Landscape

Saturday April 26, 2025 12:00pm - 12:30pm PDT

AMC Theatre 11

So you've just battled a dragon: how quickly and effectively can you fight the next one?

We dive into Resilience by Design for an AI chat/search product — based on considerations like disaster recovery, availability, foundational security, etc., while meeting audit/compliance & privacy regulations.

Speakers

Ranita Bhattacharyya

Head of Security GRC and PM, Unity 3D

Ranita has many years of experience leading pivotal teams in the Security Risk Management, Governance / Ops and Certifications / Compliance domains. Today armed with with tangible examples and actionable plans at BSides, Ranita is going over Resilience in AI products, agents and... Read More →

Saturday April 26, 2025 12:00pm - 12:30pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

1:30pm PDT

Threat Modeling Meets Model Training: Web App Security Skills for AI

Saturday April 26, 2025 1:30pm - 2:00pm PDT

AMC Theatre 11

New specializations have emerged in this AI-adoring age, but where does that leave security practitioners? Good news: If you know web application security, you can secure AI uses too. This talk examines normal web app security issues relevant to any LLM-based app — and the handful unique to AI.

Speakers

Breanne Boland

Product security engineer - security partner, Gusto

Breanne Boland is a product security engineer with the Security Partnerships team at Gusto. Before moving into security, she was a site reliability engineer and an infrastructure engineer, working in healthcare and govtech. Prior to that, she was a professional writer, and she still... Read More →

Saturday April 26, 2025 1:30pm - 2:00pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

2:15pm PDT

One Search To Rule Them All: Threat Modelling AI Search

Saturday April 26, 2025 2:15pm - 2:45pm PDT

AMC Theatre 11

Enterprise AI search tools like Glean and Guru aggregate all your company’s data into a single, easy-to-navigate interface. Think of it as Google, but for juicy, sensitive corporate information. In this session, we’ll explore effective threat modelling and controls when deploying these tools.

Speakers

Kane Narraway

Kane is a technical engineering manager with an unwavering passion for all things IT security. With over a decade of experience in building (and breaking) corporate networks. Kane dabbled in the realms of IT, red teaming and DFIR before going on to lead the enterprise security teams... Read More →

Saturday April 26, 2025 2:15pm - 2:45pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

3:00pm PDT

Everyday AI: Leveraging LLMs for Simple, Effective Security Automation

Saturday April 26, 2025 3:00pm - 3:30pm PDT

AMC Theatre 11

Anyone can build simple LLM–based tools that streamline security tasks. Join us to learn how, with short prompts and very little code, you can do more with less by automating IAM, threat detection, and vuln management workflows. Get tips and prebuilt, used-in-prod examples to play with on your own.

Speakers

Matthew Sullivan

Dominic Zanardi

Saturday April 26, 2025 3:00pm - 3:30pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

3:45pm PDT

Using AI to Discover Silently Patched Vulnerabilities in Open Source

Saturday April 26, 2025 3:45pm - 4:15pm PDT

AMC Theatre 11

We monitored public changelogs of popular open-source projects to detect unreported security fixes. We found 600+ vulnerabilities, 25% high or critical, with most never being reported. We achieved this by using dual LLM models to monitor change logs and verify the result with our security engineers.

Speakers

Mackenzie Jackson

Saturday April 26, 2025 3:45pm - 4:15pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

4:30pm PDT

AI Won’t Help You Here

Saturday April 26, 2025 4:30pm - 5:00pm PDT

AMC Theatre 11

With "AI" advancements, we also experience potential overuse and a deterioration of trust. In this talk, we’ll discuss how AI has been abused (rather than used), challenges deploying AI in specific scenarios, and the different available approaches (hint: not all AI is GenAI) to address problem sets.

Speakers

Ian Amit

CEO, Gomboc.ai

Saturday April 26, 2025 4:30pm - 5:00pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

5:15pm PDT

Mind vs Machine: The Role of Human Psychology and AI in Security Culture

Saturday April 26, 2025 5:15pm - 5:45pm PDT

AMC Theatre 11

Security policies must consider human psychological traits for effectiveness. We'll contrast this with security needs for Non-Human Identities and argue that AI has its own "psychological traits" requiring tailored approaches to secure systems against AI-specific threats.

Speakers

Anubha Nagawat

Ashutosh Gupta

Saturday April 26, 2025 5:15pm - 5:45pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, General

11:30am PDT

When AI Goes Awry: Responding to AI Incidents

Sunday April 27, 2025 11:30am - 12:15pm PDT

AMC Theatre 11

This talk details challenges in incident response for AI systems, including insufficient logging, visibility, and accountability, as well as the risks of data exposure and prompt injection. We examine a case of RAG-enabled LLM and propose triaging strategies and improved IR practices for mitigation.

Speakers

Eoin Wickens

Director of Threat Intelligence, HiddenLayer

Eoin Wickens is the Technical Research Director - Field at HiddenLayer, where he both researches and speaks about security for artificial intelligence and machine learning. He has previously worked in threat research, threat intelligence and malware reverse engineering and has been... Read More →

Marta Janus

Principal Researcher, HiddenLayer

Marta is a Principal Researcher at HiddenLayer, focused on investigating adversarial machine learning attacks and the overall security of AI-based solutions. Prior to HiddenLayer, Marta spent over a decade working as a researcher for leading anti-virus vendors. She has extensive experience... Read More →

Sunday April 27, 2025 11:30am - 12:15pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, Deep Dive

1:15pm PDT

AI's Bitter Lesson for SOCs: Let Machines Be Machines

Sunday April 27, 2025 1:15pm - 2:00pm PDT

AMC Theatre 11

We've been forcing AI to imitate human analyst workflows, but what if that's holding both machines and humans back? Through real-world experiments at Anthropic, we'll show how letting AI tackle security problems its own way can allow humans to focus on the nuanced work machines can't do (yet).

Speakers

Jackie Bow

Technical Staff, Anthropic

A Jackie-of-all- trades, master of some, Jackie seems to be physically unable to stop returning to threat detection and response. Her 15 years in the industry have been spent across multiple disciplines including malware analysis, reverse engineering, infrastructure and product security... Read More →

Peter Sanford

Sunday April 27, 2025 1:15pm - 2:00pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, Deep Dive

2:15pm PDT

Securing AI Agents: Exploring Critical Threats and Exploitation Techniques

Sunday April 27, 2025 2:15pm - 3:00pm PDT

AMC Theatre 11

Our talk will focus on securing autonomous AI agents by addressing their unique threats. We will dive into threat modeling of real-world autonomous AI systems, model poisoning attacks with hacking demos, and then explore advanced prompt injection techniques and mitigation strategies.

Speakers

Naveen Konrajankuppam Mahavishnu

Mohankumar Vengatachalam

Sunday April 27, 2025 2:15pm - 3:00pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, Deep Dive

3:15pm PDT

How to Tame Your Dragon: Productionizing Agentic Apps Reliably and Securely

Sunday April 27, 2025 3:15pm - 4:00pm PDT

AMC Theatre 11

Taming dragons is risky—so is deploying agentic apps. Like dragons, they’re unpredictable, with threats like hallucinations, non-determinism, vast input spaces, and attacker prompt injections. We show how open-source tools tame the beast, so you can confidently deploy AI agents in production.

Speakers

Thomas Vissers

Blue41 | KU Leuven

Thomas Vissers specializes in the dynamic intersection of cybersecurity and AI. He packs 10 years of experience in developing and operating production-grade AI security systems. Previously at Cloudflare, he served as an engineering leader for data-driven security products, scaling... Read More →

Tim Van hamme

co-lead Blue41, PostDoc, Blue41, DistriNet, KU Leuven

Tim Van hamme is a computer scientist specialized in AI security and behavioral analysis, leading research at KU Leuven's DistriNet on secure and trustworthy AI adoption. As co-lead of Blue41, he bridges rigorous academic research with industry applications, helping organizations... Read More →

Sunday April 27, 2025 3:15pm - 4:00pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, Deep Dive

4:15pm PDT

GenAI Application Security: Not Just Prompt Injection

Sunday April 27, 2025 4:15pm - 5:00pm PDT

AMC Theatre 11

As generative AI adoption grows, its interconnected components — agents, vector databases, and LLMs — introduce complex security risks. This session examines these concerns, offering actionable strategies to secure agent interactions, protect models, and fortify data workflows.

Speakers

Ahmed Abugharbia

Cyberdojo

Sunday April 27, 2025 4:15pm - 5:00pm PDT
AMC Theatre 11 AMC at Metreon

Presentation, Deep Dive