OWASP Global AppSec EU 2026 Vienna: Grid

Expand

Foyer D (Level -2)

8:15am
8:30am
8:45am
9:00am

Coffee/tea 8:30am - 9:00am

Expand

Room -2.11 (Level -2)

8:45am
9:00am
9:15am
9:30am
9:45am
10:00am
10:15am
10:30am
10:45am
11:00am
11:15am
11:30am
11:45am
12:00pm
12:15pm
12:30pm
12:45pm
1:00pm
1:15pm
1:30pm
1:45pm
2:00pm
2:15pm
2:30pm
2:45pm
3:00pm
3:15pm
3:30pm
3:45pm
4:00pm
4:15pm
4:30pm
4:45pm
5:00pm

Private BOD Meeting 9:00am - 5:00pm

Expand

Room -2.11 (Level -2)

7:15am
7:30am
7:45am
8:00am
8:15am
8:30am
8:45am
9:00am

Private Board Meeting 7:30am - 9:00am

Expand

Expo Hall X1	Hall D (Level -2)	Hall G1 (Level -2)	Hall G2 (Level -2)	Hall K1 (Level -2)	Hall K2 (Level -2)	Room -2.15 (Level -2)	Room -2.33 (Level -2)	Room -2.82 (Level 2)	Room -2.92 (Level -2)	Terrace G of Austria Center

7:30am
7:45am
8:00am
8:15am
8:30am
8:45am
9:00am
9:15am
9:30am
9:45am
10:00am
10:15am
10:30am
10:45am
11:00am
11:15am
11:30am
11:45am
12:00pm
12:15pm
12:30pm
12:45pm
1:00pm
1:15pm
1:30pm
1:45pm
2:00pm
2:15pm
2:30pm
2:45pm
3:00pm
3:15pm
3:30pm
3:45pm
4:00pm
4:15pm
4:30pm
4:45pm
5:00pm
5:15pm
5:30pm
5:45pm
6:00pm
6:15pm
6:30pm
6:45pm

Coffee/tea 8:30am - 9:00am

Lunch in Expo Hall 12:15pm - 1:15pm

PM Break in Expo Hall 3:00pm - 3:30pm

Networking Reception in Expo Hall and OWASP Jeopardy! 4:15pm - 6:45pm

Opening Remarks

Keynote: The Reinvention of Software Engineering 9:15am - 10:00am

AI Explainability Score Card 10:30am - 11:15am

Authorization Is Where Your App Goes to Lie 11:30am - 12:15pm

The Map of Artificial Treasures: What to Automat... 1:15pm - 2:00pm

Human Rights Threat Modeling 2:15pm - 3:00pm

AI and the Threat Modeling Manifesto: Conflicts,... 3:30pm - 4:15pm

Builders & Breakers Part II: Securing Agentic AI... 10:30am - 11:15am

The OWASP Top Ten 2025 11:30am - 12:15pm

Retiring CVE Chasing: Defending Against Applicat... 1:15pm - 2:00pm

Beyond the Chatbox: Implementing Guardrails for... 2:15pm - 3:00pm

The Devil is in the Defaults - what to do about... 3:30pm - 4:15pm

Scanning Agentic AI Systems: Beyond Traditional... 10:30am - 11:15am

Developing Effective Security Testing Skills wit... 11:30am - 12:15pm

This Build can Break You - Evil Runners and eBPF... 2:15pm - 3:00pm

Boiling the Ocean for Signal: Lessons from High-... 3:30pm - 4:15pm

Why Isn't the Fix in My Container? Tracking CVE... 10:30am - 11:15am

Actionable Continuous SBOM Diffing 11:30am - 12:15pm

One IDE to Rule Them All - Securing Your Supply... 1:15pm - 2:00pm

From 0 to SLSA Level 3: A Practitioner's Field G... 2:15pm - 3:00pm

Pragmatic least-privilege for cloud and Kubernet... 3:30pm - 4:15pm

Why AppSec Fails at Scale (and How to Fix It) 10:30am - 11:15am

Admission of Guilt: I Exploited a Parking System... 11:30am - 12:15pm

The Velocity Paradox: Why Slow is Smooth and Smo... 1:15pm - 2:00pm

Taming the AppSec Data Deluge 2:15pm - 3:00pm

Agile Development and IT Security – From Conflic... 3:30pm - 4:15pm

Private Board Meeting 1:30pm - 2:30pm

OWASP Leaders Meeting 3:15pm - 4:15pm

OWASP masCon - Int...

OWASP masCon - Let's get frooky: Structured Mobile DA... 10:35am - 11:25am

OWASP masCon - Unveiling The Internals From Mult...

OWASP masCon - Recent Mobile App Security Incide...

OpenCRE.org: Uniting all standar... 10:30am - 11:00am

OWASP AI Testing Guide in Practi... 11:00am - 11:30am

OWASP AI Security Verification S... 11:30am - 12:00pm

OWASP ModSecurity 1:15pm - 1:45pm

OWASP KubeFIM: Detecting File In... 1:45pm - 2:15pm

Evil User Stories Modeling: Ensu... 2:15pm - 2:45pm

OWASP MCP Top 10: When AI Agents... 2:45pm - 3:15pm

OWASP AI Exchange Showcase 3:30pm - 4:00pm

Hands-On: Building Security Guardrails for AI-Generated Code 10:05am - 12:05pm

Teaching Security Concepts Using Physical Analogies 10:05am - 12:05pm

The Old But Unforgettable Key 10:05am - 12:05pm

“2001: Agentic Odyssey” When threat modelling meets HAL, agentic AI, testing and safety engineering 12:15pm - 2:15pm

Hunting Critical CVEs: A Hands-On, Pick-Your-Own Exploitation POD 12:15pm - 2:15pm

Cybersecurity Awareness Card Game : Let's Play 12:15pm - 2:15pm

From Prompts to Payloads: Exploiting the AI-AppSec Intersection 2:30pm - 4:30pm

DDoS your friends 2:30pm - 4:30pm

AI for Code Security in Modern Codebases 2:30pm - 4:30pm

Context & Cringe - Application Privacy through Play 2:30pm - 4:30pm

Women in AppSec Breakfast (Sign up Required) 7:45am - 8:45am

Expand

Expo Hall X1	Hall D (Level -2)	Hall G1 (Level -2)	Hall G2 (Level -2)	Hall K1 (Level -2)	Hall K2 (Level -2)	Room -2.33 (Level -2)	Room -2.82 (Level 2)	Room -2.92 (Level -2)	TBA

8:15am
8:30am
8:45am
9:00am
9:15am
9:30am
9:45am
10:00am
10:15am
10:30am
10:45am
11:00am
11:15am
11:30am
11:45am
12:00pm
12:15pm
12:30pm
12:45pm
1:00pm
1:15pm
1:30pm
1:45pm
2:00pm
2:15pm
2:30pm
2:45pm
3:00pm
3:15pm
3:30pm
3:45pm
4:00pm
4:15pm
4:30pm

Coffee/tea 8:30am - 9:00am

AM Break in Expo Hall 10:00am - 10:30am

Lunch in Expo Hall 12:15pm - 1:15pm

PM Break in Expo Hall 3:00pm - 3:30pm

Opening Remarks

Keynote: We Live in the Future: The Death and Re... 9:15am - 10:00am

From ASVS to APVS: What Changes When You Treat P... 10:30am - 11:15am

Phishing for Passkeys - An Analysis of WebAuthn... 11:30am - 12:15pm

AI-Generated Code vs Human Code. Who Really Writ... 1:15pm - 2:00pm

Teaching AI Agents Like Guide Dogs: A Progressiv... 2:15pm - 3:00pm

Why IAM Remains a Challenge and What We Can Do A... 3:30pm - 4:15pm

DOMination - Abusing the Permission Model in Web... 10:30am - 11:15am

Q-Day is Cancelled: Practical Strategies to Defe... 11:30am - 12:15pm

The OG OWASP Top 10 Might Be Back Thanks to Agen... 1:15pm - 2:00pm

How to (Not) Isolate Untrusted Code in Scripting... 2:15pm - 3:00pm

The TPM and You - How (and why) to actually make... 3:30pm - 4:15pm

Your Localhost Is Lying to You: Trust Boundary F... 10:30am - 11:15am

Effort is All You Need: Testing LLM Applications... 11:30am - 12:15pm

What Our Pen Tests Never Found — And How Attacke... 1:15pm - 2:00pm

Trust No History: Why Every "Remembered" Interac... 2:15pm - 3:00pm

Rewriting DAST Playbook: AI Agents and the Futur... 3:30pm - 4:15pm

When AI Attacks AI: Inside the Self-Propagating... 10:30am - 11:15am

Infrastructure Doesn’t Lie: Using Infrastructure... 11:30am - 12:15pm

Marketplace Takeover: One Bug Away from Pwning 1... 2:15pm - 3:00pm

From Safety to Policy: Enforcing Organizational... 3:30pm - 4:15pm

Keep It Between Us: Manipulating Humans for Bett... 10:30am - 11:15am

Enforcing Application Security Policies at Scale... 11:30am - 12:15pm

Security Champions: Lessons from Opposite Trench... 1:15pm - 2:00pm

Using CTFs as a Community of Practice Content Ma... 2:15pm - 3:00pm

Insecurity as Code: How Modern Software Scaled t... 3:30pm - 4:15pm

OWASP CycloneDX Sunshine: see CycloneDX SBOMs come to life & chat with them (Workshop) 10:30am - 12:00pm

OWASP Certified Secure-Software Developer (Call for Contributors) 10:30am - 12:00pm

Hands-On AI Security Assessment with OWASP AISVS (Workshop) 10:30am - 12:00pm

CHAMELEON-REN: Advancing the OWASP Web Application Honeypot Project with Adaptive, Education-Sector (Workshop) 1:15pm - 3:00pm

Finding strange things in binaries (Workshop) 1:15pm - 3:00pm

Let's Play: OWASP Cumulus (Workshop) 1:15pm - 3:00pm

Shaping International Security Standards: Get Involved with OWAS... 3:15pm - 4:15pm

From Maturity to Mastery: Accelerating Software Security with OW... 3:15pm - 4:15pm

Hack Your Own Dockerfiles (Before Someone Else Does): Hands-On C... 3:15pm - 4:15pm

When Museums Get Hacked: OWASP T... 10:30am - 11:00am

From Maturity to Mastery: Accele... 11:00am - 11:30am

Using OWASP SAMM and OWASP DSOMM... 11:30am - 12:00pm

OWASP Mobile Application Securit... 1:15pm - 1:45pm

Cloud Native Web Application Fir... 1:45pm - 2:15pm

Updates on the OWASP Automated T... 2:15pm - 2:45pm

OWASP Nettacker Project 2:45pm - 3:15pm

OWASP GenAI Security Project (Pl... 3:30pm - 4:00pm

From Prompts to Payloads: Exploiting the AI-AppSec Intersection 10:05am - 12:05pm

Cybersecurity Awareness Card Game : Let's Play 10:05am - 12:05pm

Hunting Critical CVEs: A Hands-On, Pick-Your-Own Exploitation POD 10:05am - 12:05pm

DDoS your friends 10:05am - 12:05pm

OWASP JuiceShop: Come and pwn me 12:15pm - 2:15pm

Teaching Security Concepts Using Physical Analogies 12:15pm - 2:15pm

AI for Code Security in Modern Codebases 12:15pm - 2:15pm

Context & Cringe - Application Privacy through Play 12:15pm - 2:15pm

The Old But Unforgettable Key 2:30pm - 4:30pm

“2001: Agentic Odyssey” When threat modelling meets HAL, agentic AI, testing and safety engineering 2:30pm - 4:30pm

Hands-On: Building Security Guardrails for AI-Generated Code 2:30pm - 4:30pm

Bob the Breaker: Welcome to the Jungle! (Sponosored by Nokod Security) 10:00am - 2:00pm

OWASP Global AppSec EU 2026 Vienna

Get help with the event