OWASP Global AppSec EU 2026 Vienna: Full Schedule

10:05am CEST

Hands-On: Building Security Guardrails for AI-Generated Code

Thursday June 25, 2026 10:05am - 12:05pm CEST

AI-assisted development is now responsible for a significant and growing portion of production code. However, most AppSec programs still treat AI as an external input to be scanned after code is written, rather than as a system that can be guided to produce safer code up front.

In this Practical On-Demand session, participants will explore a secure-by-construction approach to AI coding using Cursor-style rules and hooks. The POD is structured around short, repeatable activities rather than a linear workshop.

Speakers

David Archer

Solution Architect, Endor Labs

David is a long-time software practitioner who has spent the last two decades building, breaking, and fixing software across development, product, and consulting roles. After repeatedly seeing security treated as an afterthought in fast-moving teams, he shifted full-time into application... Read More →

Thursday June 25, 2026 10:05am - 12:05pm CEST
Room -2.92 (Level -2)

PODS (Hands-on Activities)

Audience Security Champions

10:05am CEST

Teaching Security Concepts Using Physical Analogies

Thursday June 25, 2026 10:05am - 12:05pm CEST

Room -2.92 (Level -2)

Understanding security fundamentals doesn’t have to be dry or abstract. In this interactive CF‑Pod, you’ll explore the core principles of confidentiality, integrity, and availability through surprising physical demonstrations and simple “magic‑like” activities that make each concept intuitive and memorable.

Each station focuses on one security principle and offers a short, hands‑on challenge that transforms an abstract idea into something you can see, touch, and explain to others. You can drop in for 10–15 minutes, try an activity, and walk away with a clear, practical analogy you can use in real‑world conversations with teammates and stakeholders.

Whether you're new to security or looking for better ways to teach it, this session will give you fun, effective tools for communicating the foundations of secure systems.

Speakers

Mariia Denysenko

Cybersecurity Governance & Training Professional in IT, AI, and OT

Mariia is a cybersecurity governance and compliance professional with experience spanning IT security, AI security, and OT security. She focuses on developing secure processes, enabling teams, and translating complex security requirements into clear, actionable guidance.

Her backg... Read More →

Thursday June 25, 2026 10:05am - 12:05pm CEST
Room -2.92 (Level -2)

PODS (Hands-on Activities)

Audience Security Champions

12:15pm CEST

Cybersecurity Awareness Card Game : Let's Play

Thursday June 25, 2026 12:15pm - 2:15pm CEST

Room -2.92 (Level -2)

Learn the foundations of cybersecurity through a card game.

Participate in a tabletop, technology-free “capture the flag” experience where players gain practical insights into protecting digital information, responding to cyberattacks, and understanding core concepts such as the Cyber Kill Chain and the NIST Cybersecurity Framework.

For less experienced practitioners, the game builds a strong foundational mindset to support their ongoing cybersecurity journey. For more experienced practitioners, it offers a fresh, engaging way to communicate and teach core cybersecurity concepts. This makes cybersecurity more accessible and approachable for others.

Speakers

Michael Novack

Solution Architect, Aiceberg

Michael is a product-minded security architect who loves turning tangled AI risks into clear, practical solutions. As Solution Architect at Aiceberg, he helps enterprises bake AI explainability and real-time monitoring straight into their systems, transforming real customer insights... Read More →

Thursday June 25, 2026 12:15pm - 2:15pm CEST
Room -2.92 (Level -2)

PODS (Hands-on Activities)

Audience Security Champions

2:30pm CEST

Context & Cringe - Application Privacy through Play

Thursday June 25, 2026 2:30pm - 4:30pm CEST

Room -2.92 (Level -2)

Privacy risks are rarely obvious when looking at data, features, or apps in isolation. They emerge through changing context and are impacted by user perception.

In this POD, participants play Context & Cringe, a discussion-driven card game where players build fictional app scenarios using real-world data and features, then judge how those designs feel from a user’s perspective.

Rather than focusing on compliance or checklists, this session helps participants develop intuition for privacy impact by actively creating, debating, and experiencing cringey design choices. The result is a hands-on, low-barrier way to surface privacy risks that are often missed in a traditional security analysis - and a non-adversarial way to introduce uncomfortable topics into team discussions.

Speakers

Avi Douglen

Software Security Consultant, Bounce Security

Avi Douglen is the founder and CEO at Bounce Security, a boutique consultancy specializing in software security, where he spends a lot of time with development teams of all sizes. He helps them integrate security methodologies and products into their development processes, and often... Read More →

Kim Wuyts

Manager Cyber & Privacy, PwC Belgium

Dr. Kim Wuyts is a leading privacy engineer with over 15 years of experience in security and privacy. Before joining PwC Belgium as Manager Cyber & Privacy, Kim was a senior researcher at KU Leuven where she led the development and extension of LINDDUN, a popular privacy threat modeling... Read More →

Thursday June 25, 2026 2:30pm - 4:30pm CEST
Room -2.92 (Level -2)

PODS (Hands-on Activities)

Audience Security Champions

2:30pm CEST

DDoS your friends

Thursday June 25, 2026 2:30pm - 4:30pm CEST

Room -2.92 (Level -2)

interactive DDoS competition - player on player!

Each round players chooses to be an attacker or defender, matches up with an opponent and configures their attack/defense. The attack traffic is run (speed run), scores are given based on attack traffic stopped vs let through, and legit traffic blocked.

Players gain points each round, and there is an ongoing scoreboard. Leading attacker and defender configs are published too, so defenders and attackers can adapt.

The game is played on a webapp so can be accessed via mobile or laptop.

Speakers

Alex Marks-Bluth

Security Researcher, Akamai AppSec

Alex leads teams combining data science and security research in web application security, building security products for Akamai customers.

He enjoys watching and playing cricket, and every year he tries to learn Rust, for at least 2 weeks.
linkedin.com/in/alex-marks-bluth-06a81... Read More →

Thursday June 25, 2026 2:30pm - 4:30pm CEST
Room -2.92 (Level -2)

PODS (Hands-on Activities)