OWASP Global AppSec EU 2026 Vienna

OWASP Global AppSec EU 2026 Vienna

arrow_back View All Dates

8:30am CEST

Coffee/tea Expo Hall X1

9:00am CEST

Opening Remarks Hall D (Level -2)

9:15am CEST

Keynote: We Live in the Future: The Death and Rebirth of Application Security Hall D (Level -2)

10:00am CEST

AM Break in Expo Hall Expo Hall X1 Bob the Breaker: Welcome to the Jungle! (Sponosored by Nokod Security) TBA OWASP Official Store: Come explore books, games and merch (or Explore CyberSec Games, OWASP books and official merch)

10:05am CEST

Cybersecurity Awareness Card Game : Let's Play Room -2.92 (Level -2) DDoS your friends Room -2.92 (Level -2) From Prompts to Payloads: Exploiting the AI-AppSec Intersection Room -2.92 (Level -2) Hunting Critical CVEs: A Hands-On, Pick-Your-Own Exploitation POD Room -2.92 (Level -2)

10:30am CEST

When Museums Get Hacked: OWASP Top 10 Lessons from Heists Room -2.82 (Level 2) When AI Attacks AI: Inside the Self-Propagating Botnet Built on Compromised AI Infrastructure Hall K1 (Level -2) DOMination - Abusing the Permission Model in Web Extensions Hall G1 (Level -2) From ASVS to APVS: What Changes When You Treat Privacy as a System Property? Hall D (Level -2) Keep It Between Us: Manipulating Humans for Better AppSec (Ethically) Hall K2 (Level -2) Your Localhost Is Lying to You: Trust Boundary Failures in Enterprise SSO Hall G2 (Level -2) Hands-On AI Security Assessment with OWASP AISVS (Workshop) Room -2.33 (Level -2) OWASP Certified Secure-Software Developer (Call for Contributors) Room -2.33 (Level -2) OWASP CycloneDX Sunshine: see CycloneDX SBOMs come to life & chat with them (Workshop) Room -2.33 (Level -2)

11:00am CEST

From Maturity to Mastery: Accelerating Software Security with OWASP SAMM Room -2.82 (Level 2)

11:30am CEST

Using OWASP SAMM and OWASP DSOMM together in practice Room -2.82 (Level 2) Infrastructure Doesn’t Lie: Using Infrastructure Signals to Detect Shadow AI Built Applications Hall K1 (Level -2) Q-Day is Cancelled: Practical Strategies to Defeat 'Harvest Now, Decrypt Later' Hall G1 (Level -2) Phishing for Passkeys - An Analysis of WebAuthn and CTAP Hall D (Level -2) Enforcing Application Security Policies at Scale: Lessons from an Enterprise Rollout Hall K2 (Level -2) Effort is All You Need: Testing LLM Applications in the Real World Hall G2 (Level -2)

12:15pm CEST

Lunch in Expo Hall Expo Hall X1 AI for Code Security in Modern Codebases Room -2.92 (Level -2) Context & Cringe - Application Privacy through Play Room -2.92 (Level -2) OWASP JuiceShop: Come and pwn me Room -2.92 (Level -2) Teaching Security Concepts Using Physical Analogies Room -2.92 (Level -2)

1:15pm CEST

OWASP Mobile Application Security (MAS) Project Updates Room -2.82 (Level 2) The OG OWASP Top 10 Might Be Back Thanks to Agentic Browsers Hall G1 (Level -2) AI-Generated Code vs Human Code. Who Really Writes More Vulnerabilities Hall D (Level -2) Security Champions: Lessons from Opposite Trenches Hall K2 (Level -2) What Our Pen Tests Never Found — And How Attackers Did Hall G2 (Level -2) CHAMELEON-REN: Advancing the OWASP Web Application Honeypot Project with Adaptive, Education-Sector (Workshop) Room -2.33 (Level -2) Finding strange things in binaries (Workshop) Room -2.33 (Level -2) Let's Play: OWASP Cumulus (Workshop) Room -2.33 (Level -2)

1:45pm CEST

Cloud Native Web Application Firewalls - How OWASP Coraza is coming to Kubernetes world Room -2.82 (Level 2)

2:15pm CEST

Updates on the OWASP Automated Threats Project Room -2.82 (Level 2) Marketplace Takeover: One Bug Away from Pwning 10 Million Developer Machines Hall K1 (Level -2) How to (Not) Isolate Untrusted Code in Scripting Languages Hall G1 (Level -2) Teaching AI Agents Like Guide Dogs: A Progressive Trust Framework Hall D (Level -2) Using CTFs as a Community of Practice Content Machine Hall K2 (Level -2) Trust No History: Why Every "Remembered" Interaction is a Potential Backdoor Hall G2 (Level -2)

2:30pm CEST

CfP/CfTs for the Newcomer: How To Write A Good Submission Hands-On: Building Security Guardrails for AI-Generated Code Room -2.92 (Level -2) The Old But Unforgettable Key Room -2.92 (Level -2) “2001: Agentic Odyssey” When threat modelling meets HAL, agentic AI, testing and safety engineering Room -2.92 (Level -2)

2:45pm CEST

OWASP Nettacker Project Room -2.82 (Level 2)

3:00pm CEST

PM Break in Expo Hall Expo Hall X1

3:15pm CEST

From Maturity to Mastery: Accelerating Software Security with OWASP SAMM (Workshop) Room -2.33 (Level -2) Hack Your Own Dockerfiles (Before Someone Else Does): Hands-On Container Security with OWASP DockSec (Workshop) Room -2.33 (Level -2) Shaping International Security Standards: Get Involved with OWASP's ISO Working Group (Call for Contributors) Room -2.33 (Level -2)

3:30pm CEST

OWASP GenAI Security Project (Placeholder) Room -2.82 (Level 2) From Safety to Policy: Enforcing Organizational Rules in LLMs and AI Agents Hall K1 (Level -2) The TPM and You - How (and why) to actually make use of your TPM Hall G1 (Level -2) Why IAM Remains a Challenge and What We Can Do About It Hall D (Level -2) Insecurity as Code: How Modern Software Scaled the Attack Surface Hall K2 (Level -2) Rewriting DAST Playbook: AI Agents and the Future of Web App Security Hall G2 (Level -2)