OWASP Global AppSec EU 2026 Vienna: Full Schedule

2:15pm CEST

Evil User Stories Modeling: Ensuring your User Stories in agile playing OWASP Cornucopia

Thursday June 25, 2026 2:15pm - 2:45pm CEST

In this session, I´ll show you how to sreamline the identification of security requirements associated with user stories in agile methodologies Using OWASP Cornucopia. Here you´ll se how to integrate User Stories with Cornucopia Cards and with ASVS as an security requirements and the defects that may arise if the security requirements are not properly considered or implemented. At the beginning ,we will explore two concepts I used to create this different way of playing OWASP Cornucopia and scaling it in agility, complementing the architecture-based threat model: Evil User Stories Modeling and Secure Scrum. All of this to apply the principle Security Just in Time for design a single product backlog that integrates security functionalities and controls into user stories avoiding the creation of a cybersecurity parallel backlog.

Speakers

Max Alejandro Gomez Sanchez Vergaray

Application Security Program Leader, AppSec & DevSecOps Consultant | Risk-driven Security for real-world products | S-SDLC, DevSecOps, Secure Design & Threat Modeling Trainer

I designed and led the application security program during the digital transformation process of one of the largest banks in Latin America, training more than 3,000 people in secure software development, specially in Secure Design using OWASP Cornucopia, another tools for threat modeling... Read More →

Thursday June 25, 2026 2:15pm - 2:45pm CEST
Room -2.82 (Level 2)

Project Showcase (Lightning Talks)

Audience All
Subject Threat Modeling, Gamification
Project Link https://cornucopia.owasp.org/

1:15pm CEST

Let's Play: OWASP Cumulus (Workshop)

Friday June 26, 2026 1:15pm - 3:00pm CEST

Room -2.33 (Level -2)

OWASP Demo Lab - Hands-On Workshop / Small Group Session
Zone 3

In this hands-on session we will demonstrate the threat modeling card game "Cumulus" and show how it can help you start threat modeling your cloud and DevOps processes.

Using a real live example scenario, we will discuss, laugh and increase security. And maybe the winner will even get a prize! :)

Speakers

Christoph Niehoff

Senior Consultant, TNG Technology Consulting

In his role as a Senior Consultant at TNG Technology Consulting, Christoph Niehoff develops software products for his clients on a daily basis. As a full-stack developer, he lives and breathes DevOps, overseeing all steps of the development cycle. The security of the products is particularly... Read More →

Friday June 26, 2026 1:15pm - 3:00pm CEST
Room -2.33 (Level -2)

Project Demo Lab (Hands-on)

Audience All
Subject DevSecOps, Threat Modeling, Gamification
Project Link https://owasp.org/www-project-cumulus/

OWASP Global AppSec EU 2026 Vienna

2:15pm CEST

Max Alejandro Gomez Sanchez Vergaray

1:15pm CEST

Christoph Niehoff

Get help with the event