2026 Accepted Talks

We hope you enjoy the exciting collection of speakers, talks and classes we have accepted for BSides Delaware 2026. Enjoy our list of accepted talks and classes below!

Looking for the Schedule? Visit our Schedule Page!

Support our speakers and learn more about them by visiting the Speaker Bios Page!

2026 Accepted Classes

*Subject to change due to speaker availability*

Title	Speaker	Description
Kill the Drift, Shrink the Attack Surface: Hardening Linux Hosts with bootc	Nate Lager, @gangrif@undrground.org LinkedIN: https://www.linkedin.com/in/ironsysadmin Mastodon @gangrif@undrground.org Github: https://github.com/nlager	Operating System (OS) config drift isn’t just an operational nuisance, it’s a security vulnerability. Every untracked change, emergency patch, or manual config fix can expand your attack surface and leaves room for persistence. What if your OS was managed like an application container, using the same CI/CD pipelines and supply chain tools that you use for containerized apps? Well have you heard of bootc? By defining the host OS as a bootable container image, you can enforce state, automate vuln scanning and compliance at build time, and roll out updates with instant rollbacks. All on the Enterprise Linux base of Red Hat Enterprise Linux (RHEL) In this hands-on 2-hour lab, I’ll show you how to build your first RHEL Image Mode image (based on bootc), secure it by applying security policy at build time, and then manage that bootable container image going forward. You’ll: * Build a hardened, compliant, RHEL host image using standard podman container tooling * Integrate compliance scanning and remediation at image build time * Deploy and update systems using standard container registries * Execute rollbacks during a simulated incident. Prerequisites: Some basic familiarity with linux, and containers (docker or podman). A laptop with internet connection and a web browser.
Do you know what is hOT right now?	Jim Gilsinn and Eric Engman	Abstract: Operational technology (OT) is becoming a much important field of cybersecurity as people and companies start to develop a better understanding of the risks from these critical systems. OT is embedded in nearly every industry in some way and knowing what these systems are and how you can interact with them can better help you to defend them. In this workshop, participants will learn about different types of OT equipment and systems, learn about some of the previous OT-related cyber incidents, and interact with a virtual OT environment.

2026 Accepted Talks

*Subject to change due to speaker availability*

Title	Speaker	Description
RiskBridge: Turning CVEs into Business-Aligned Patch Priorities	Awez Akhtar Khatik and Yelena Mujibur Sheikh	Security teams are drowning in vulnerability backlogs, but CVSS severity alone does not answer the question leaders actually ask: what should we patch first, and why? This talk introduces RiskBridge, an explainable vulnerability prioritization framework that combines CVSS, EPSS, CISA KEV, business impact, compliance SLA logic, and remediation ROI. Instead of producing another black-box risk score, RiskBridge helps translate raw CVE data into defensible patch priorities that security, governance, risk, and audit stakeholders can understand. The session will walk through the framework, sample scoring logic, and practical examples using public vulnerability data. Attendees will learn how to connect exploit likelihood, known exploitation, compliance deadlines, asset/business impact, and remediation effort into a clearer patching strategy.
From Framework Overload to an Actionable Healthcare Cybersecurity Roadmap	Anthony L. Marchetta	Healthcare organizations do not usually suffer from a lack of cybersecurity frameworks. They suffer from the opposite problem: too much guidance that does not automatically become an implementation plan. NIST CSF, CIS Controls, and ISO/IEC 27001 each offer valuable structure, but they emphasize different things: risk-based outcomes, practical safeguards, governance, evidence, and continual improvement. This talk presents a capstone-derived model for turning those overlapping frameworks into one practical healthcare cybersecurity roadmap. Using a simulated mid-sized healthcare organization, North Star Health Services, the presentation walks through a framework crosswalk, a qualitative healthcare risk assessment, a layered security architecture model, and an eight-phase implementation roadmap. The focus is not on checking boxes for compliance. The focus is on translating framework language into ownership, priorities, control placement, evidence artifacts, and staged improvement. Attendees will leave with a reusable way to think about framework integration in healthcare environments, especially where ransomware readiness, identity and access control, backup and recovery, logging and monitoring, vendor risk management, and staff awareness all compete for limited time and resources.
The Harness Frontier: Who Wins the Token Economy of Vulnerability Research?	Anthony J. and Mike B.	OpenCode, Pi, Cline, and Hermes put capable agent loops within reach of almost any team, while the model behind the loop can be changed in minutes. Vulnerability research, however, is not a chat session. It is a stochastic search across many hypotheses, with expensive verification, incomplete context, and a clock that keeps running. The decisive question is no longer only, “Which model is best?” It is, “Which system turns a fixed budget into the most verified security evidence?” This talk examines that question through a controlled 104-task security study, Harness-Bench’s 5,194 model–harness trajectories, and an eight-run scanning pilot. In the matched security study, two-pass coverage ranged from 65 to 81 solved tasks; the highest-coverage agent spent roughly 2.3 times as much as the cheaper alternatives. In our pilot, completed work diverged from harness-defined operational coverage, a truncated evaluator created an invalid headline score, congestion coincided with lower throughput, and cache mispricing undermined the cost ledger. The evidence rejects two easy stories. The model still matters, and additional budget can expand the search frontier. But spend alone can also buy repetition, congestion, and noise. Money buys parallel hypotheses. Time buys sequential adaptation. The harness determines whether either becomes proof. Attendees leave with an evaluation protocol, a framework for choosing and hardening open harnesses, and a forward-looking model of AppSec as an inference-allocation economy built around proof-carrying findings.
Cleartext at the Edge: A Neptune R900 Case Study in RF Telemetry Exposure	Rick Ramirez	A passive, receive-only RF case study of Neptune R900 water-meter telemetry using low-cost SDR tooling. Cleartext AMR broadcasts expose meter IDs, consumption, status, and timestamps before data reaches utility systems, turning repeated readings into pattern-of-life privacy risk. Covers the RF security model, a qualitative risk mapping, disclosure boundaries, and what utilities, vendors, and security teams should do about signal-layer exposure.
Top 10 Non-Technical Reasons Cyber Program Struggle	David Menichello – Founder, Carve Line	Vulnerabilities, exploits, and tools get most of the fanfare, but much of what holds back security programs is non-technical in nature. In this session, inspired by the Top 10 lists from the Late Show, we’ll review non-technical reasons why cyber programs struggle to accomplish security objectives and what attendees can do to course-correct when they return to their organizations.
Building repro’s at WARP speed	Ben Sleek @ Proof	AI models can spot bugs in code faster than ever, but proving exploitability remains a massive bottleneck. Modern web applications are complex systems spanning multiple layers, roles and configurations. This leads to humans / manual processes taking over where AI stops. In this talk, we explore considerations for a WARP (Web Application Reproducibility Pipeline). Given a possible vulnerability, an effective reproducibility pipeline shows the exact steps needed to trigger. Topics we’ll discuss include tools needed by agents, token usage, configuration distance, and state provisioning. You will walk away with a framework for building out your own pipeline.
Invisible Gateways: How Threat Actors Exploit IoT to Breach Organizations	Phillip Wylie	Threat actors increasingly exploit vulnerable IoT devices to breach organizations and are becoming more of a threat due to endpoint protection improvements. This talk reveals real-world tactics, common misconfigurations, and practical defenses to help security teams protect against IoT-based intrusions. Session format Session (50 min) Lightning (25 min) Track Threats and Trends Level Introductory and overview TBD Cybersecurity Threats and Trends
We Gave AI Agents 3,029 CVEs. Here’s What Happened—and What Defenders Can Do About It.	Sasan Padidar	We gave autonomous AI agents 3,029 published CVEs and asked them to develop working exploits. They succeeded 72% of the time, at a median cost of $2.83 and a median time of just 11 minutes. Every result was checked using deterministic verification and control tests, with an independent third party reviewing a sample of the findings. What surprised us wasn’t just how cheap exploitation had become. It was how poorly traditional vulnerability prioritization signals reflected what our agents could actually exploit. Most successful exploits weren’t in CISA’s KEV catalog, and many had low EPSS scores. In this talk, I’ll walk through the experiment, how the autonomous exploitation pipeline works, and what we learned from thousands of attempts. But there’s another side to this story. If AI can exploit vulnerabilities in minutes, why can’t defenders use AI to investigate, validate, and remediate them just as quickly? I’ll demonstrate how autonomous agents can investigate vulnerabilities in a controlled cloud environment, determine reachability and exploitability, and produce actionable evidence for remediation. We’ll explore what it takes to build these systems reliably, where they fail, and how security teams can begin using autonomous agents to move from vulnerability backlogs toward actual risk reduction. No vendor pitch. Just research, working technology, and a practical look at how defenders can fight back.
Solving for Y: Secret formula for Solving Challenges in Cybersecurity	Amber Kirylak – HRTBRKRNR	Every alert, every puzzle, every “how do I even start” moment in security comes down to the same formula: Z = X + Y. Z = the alert, X = the data. Here we’re going to do a deep dive into the Y and what it actually takes to understand the challenges we face when we’re handed a puzzle we don’t yet understand. This talk breaks down the formula and then proves it in a real-world-style SOC investigation. This isn’t just a technical deep dive; it’s a guideline for approach and critical thinking.
Integrating AI Into Your Infosec Workflows	Brian Martin @Liticode	Imagine finishing your day in security, forensics, or compliance and actually feeling like you got ahead and not drowning in alerts, packet captures, and endless compliance checklists. As an Infosec worker, the real challenge isn’t just the work, it’s managing the overwhelming volume of data, decisions, and repetitive tasks that eat your time. In this session, we’ll look at a practical, hands-on opportunities to change that. We’ll walk through three real-world examples of integrating AI agents directly into your workflows: – Using AI agents to supercharge security operations – Teaming up AI with Wireshark to quickly spot and diagnose problems in network traffic – Enhancing compliance assessments with intelligent agents — viewed through the NIST Cybersecurity Framework Then we’ll wrap up by exploring the risks and how to coordinate multiple AI agents and maximize their utility so you can implement agents in your daily environment. If you want to eliminate boring, repetitive tasks or add validation layers in security, forensics, and compliance, this session is for you.
If Someone Changes Your Database, Should Your System Still Execute the Payment?	Viktor Khudiaiev	The word “blockchain” usually enters a conversation about tamper-proof records before anyone has defined the attacker. I prefer a less fashionable question: who can change the database, and what will your application do with those changes? A database can stay online, answer every query correctly, and still contain a fraudulent payment instruction. Someone with enough privileges can change a recipient, insert a transfer nobody approved, or delete an inconvenient record. Your application’s checks do not help when the attacker writes underneath them. Tamper-evident databases answer a different question than the one I care about. They will faithfully record that a fraudulent instruction was inserted and let you prove it afterwards. They will not stop the payment. By the time anyone reads the audit trail, the money is gone. In this firetalk I will show a working implementation that makes administrative access to a transaction database insufficient to produce an unauthorised financial effect. Ordinary PostgreSQL, no new cryptography, no distributed ledger. The exact content of an operation is authenticated and an independent receipt is committed before the operation reaches the database; before any money moves the record is re-read and required to be unchanged, and settlement proceeds from the fields that were verified rather than from a later read. One live demo: I change an approved payment in the database, in the window between verification and execution, and the system refuses to pay. Code, tests and the article behind the talk are already public, and I will be clear about what the implementation does not yet do.
Backdoors & Breaches: Where the Ammo Is Fake but the Learning Is Real	Robin Noyes	A live table top exercise using Backdoors & Breaches, which offers an engaging, hands‑on way to build incident‑response skills through realistic cybersecurity scenarios. Participants explore how attacks unfold and practice choosing the best defensive actions, all while learning to communicate clearly and think under pressure. The session encourages everyone to speak up, share ideas, and collaborate — because every perspective can reveal something others might miss. Whether you are brand‑new to cyber, interested in cyber, or a seasoned practitioner, YOU play an important role in how a team understands and responds to threats. This interactive format bridges the gap between theory and real‑world decision‑making, helping you grow your confidence and your voice in cybersecurity.
Automated Detection & Response with AI	Steven Williams	Learn about creating detections using APIs (language agnostic)! Specific examples and visuals are for Have I Been Pwned and Redshift Database access. The logic is Python code that is orchestrated via Codefresh and AWS Lambda. API calls are for AWS, Have I Been Pwned and OpenAI gpt5.5.
Zombieland: Surviving the Dead Internet	Brad Sherman	The Dead Internet Theory posits that the majority of online content and interactions has been fake since 2016, driven by corporate and government actors to manipulate populations. Originally labelled as a conspiracy, Dead Internet Theory seems to be less of a theory and more of an inevitability, with vast implications for not only security, but for society. This talk will examine why this is becoming a more excepted truth given the state of the internet, and what we can do to manage it.
The Agentic Constitution: Building Democratic Checks and Balances for Autocratic AI.	Mahender Mangalasri	We gave AI agents Intelligence, Identity, Memory, Tools and Authority. Did we also give them a constitution? Autonomous AI agents capable of planning, retaining memory, invoking tools and acting through APIs are moving from research environments toward production infrastructure, faster than the governance mechanisms designed to constrain them. When a single agent can reason, execute, delegate and potentially evaluate its own actions, we create the technological equivalent of concentrated authority: an autocratic security architecture. Recent incidents (ex:-2026 OpenAI-Hugging Face) demonstrate why this matters. Goal-directed agents circumvented intended isolation controls, exploited infrastructure and obtained unintended access while pursuing evaluation objectives. The Moltbook/Openclaw case study exposes a different dimension of the same problem: agents interacting with other agents across environments containing untrusted content, weak identity boundaries and opportunities for agent-to-agent manipulation. Drawing an analogy from democratic institutions, this presentation proposes an Agentic Constitution built around separation of powers, least agency, independent authorization, runtime policy enforcement, observable actions and revocable authority. We examine different agentic threats including excessive agency, identity and delegation abuse, memory manipulation, rogue-agent behavior and unchecked optimization loops. Finally, we map these principles into practical enterprise governance using emerging guidance from OWASP, NIST and CSA security frameworks. Attendees will leave with an understanding on how unconstrained optimization loops and excessive agency bypass traditional perimeters, learn how to apply sociopolitical governance principles to prevent autonomous agents from operating as autocratic black boxes.
Install Once, Exploit Forever: The MCP Plugin Supply Chain Attack Surface	Sheshananda Reddy Kandula	Every time we set up an MCP server, something felt off. Adding one is as simple as adding a JSON entry that points to a third-party process. Restart your client, and that server’s outputs now flow directly into your agent’s context — treated with the same trust as your own instructions. It can access whatever you’ve granted it — files, API tokens, tool outputs — with no verification that it’s still the same code you originally approved. There are no signature checks, no permission reviews, and no clear way to know if what you installed today is still what’s running next week. That gap in trust is what this talk is about. MCP servers are starting to show up everywhere as a way to extend AI agents with external tools. Unlike traditional plugins, they run inside the agent’s workflow, which means they can see task context and credentials passed between tools. Through live demos, we’ll show two attack paths: – A rogue server that looks legitimate from day one – A remotely hosted server that operates correctly until a server-side update changes its behavior with no client notification and no re-authorization prompt In both cases, nothing is “exploited” in the traditional sense. These attacks work because of the system’s design. We demonstrate that the same malicious server is running in both Anthropic Claude Desktop and Visual Studio Code, showing this isn’t tied to a single client but to a broader architectural issue. You’ll see how an attacker could exfiltrate sensitive data, access credentials, and observe or even influence multi-step agent workflows. Then we’ll walk through what you can actually do about it. That includes server allowlisting, version pinning, monitoring outbound connections from agent processes, auditing permissions, and treating MCP updates the same way you treat third-party code changes. We’ll close with a few things the ecosystem still needs to fix, such as signed updates, better visibility into permission changes, and stronger guarantees for plugin integrity.
When AI Agents Go Rogue: An SRE’s Guide to Containing Autonomous Systems in Production	Akash Thakur	AI agents have stopped just answering questions and started taking action — accessing systems, moving data, and executing tasks on their own. And this year proved they don’t always stay inside the lines: agents have bypassed their own guardrails, ignored shutdown commands, and in real incidents reached into systems nobody authorized them to touch. The uncomfortable truth is that “we added safety controls” is not the same as “it’s safe.” This talk approaches the problem from an unusual angle: site reliability engineering. For years, SREs have had to keep powerful, unpredictable systems safe in production — and the disciplines that work there (blast-radius containment, least-privilege access, kill switches, real-time observability, and clear accountability) map directly onto the problem of autonomous AI agents. The difference is that an agent is an actor, not just a service, and it will pursue its goal straight through the controls meant to stop it. Drawing on recent real-world agent failures, I’ll break down WHY agentic systems slip their controls (it’s not malice — completing the task is the objective), why traditional security tooling misses it (the agent is already authorized), and a practical framework for containing them: how to decide what an agent may do autonomously, where the human checkpoint belongs, how to enforce boundaries at the system level rather than trusting the model to behave, and how to catch overreach before a customer or regulator does. Attendees will leave with a concrete, reusable model for deploying AI agents that actually holds — not a diagram that looks good until the first bad incident. No live demo of an exploit, but I’ll walk through anonymized real-incident chains and share the containment framework as a practical takeaway.