BREWTCON 2026 - Mixing Formats and Communities

I've heard about BREWT and their meetups for quite a while. I've known some of the folks organizing these events. This year, I had the opportunity to finally participate in their community conference BREWTCON and at the same time I had the honor to give the opening keynote. Many thanks to the organizing team of Kristof Van Kriekingen, Geert van de Lisdonk and Andreas Faes for making this happen and trusting me to kick off the event!

BREWTCON differed from other conferences I've been at by deliberately mixing two formats. We spent the first half of the day with a pre-scheduled program of talks. The afternoon was reserved for an open space where participants co-created the schedule right in the moment. Lunch and dinner allowed for proper socializing and networking. 

This conference also brought people from various communities together. I've met folks from the local BREWT meetups, yet also from SoCraTes Germany, FroGS Conf and Agile Testing Days. I really appreciated that while the conference mainly targeted testing and quality folks, we had other roles in the room as well, like developers, architects and more.

 

Scheduled Talks

Besides the keynotes, the conference offered two tracks so people could choose what topic intrigued them most. Maybe even get inspired for sessions to propose at the later open space. 

• Keynote "Stop Judging and Tear Down Your Gates – Make Humans the Strongest Link in Security" by me. This was the premiere of this brand-new talk that's been brewing for a while now. While I believe the talk is transferable from security to several roles like testers and architects, I was curious whether it would resonate with the BREWTCON audience. Seems it did, though! Really appreciate the feedback received and am already looking forward to giving this one again. 
  
• "Testers Against Nature: The Case for Unnatural Thinking" by Ewald Wassink. Ewald pointed out how critical thinking naturally requires a lot of energy by design of our brain. We have to challenge our own biases intentionally and that comes at a cost. Yet the message was clear: we need to practice our thinking skills or we will lose them. The key practice Ewald recommended is to make use of specific Socratic questions and build a routine to ask them every day. I also appreciate that he made it very clear that we need to take good care of our brains. 
  
• "From sceptics to builders: AI powered Testing" by Lotte Rombaut. Lotte shared the story of how her company came up with a custom-made AI agent to support testing activities. She was clear about the advantages of where it helped them, but also about the issues it caused. Costs are the main worry - while it helped them, there was no money to be made with it. 
  
• "From Complex Configurations to Tester-Friendly Test Plans" by Isha Pathan. Isha painted the picture of a complex system covered by a massive amount of regression tests across various components. They struggled with pinpointing the cause of failing tests. What helped them was to build a custom test data portal. 
  
• Keynote "The Fear Factor in Software Testing" by Suzanne Kraaij. This was a really great presentation where I just kept nodding along as I've seen what Suzanne described way too often. Have you also faced the situation when suddenly everyone started fearing they missed important parts, so they kept testing, trying to reduce uncertainty and their fear of the unknown to a point way beyond reason? When testing becomes the goal instead of delivering value? As Suzanne pointed out, this is causing more harm than good. We need to bring the fear out in the open and ask about impact, evidence, assumptions and the information people might miss - and then guide them back to risk-based testing. 
  

 

Open Space 

After a nice lunch and some good conversations on company cultures and how adjacent teams in the same company can work in vastly different ways, it was time to introduce people to the open space format. Lots of folks proposed sessions so the schedule filled up pretty quickly. It's always great to see that magic happen at open space conferences! At first, you might worry whether the time slots would even be filled - until suddenly there's no slot available anymore and you have the difficult task of choosing which sessions to attend.

• "Capture the Bugs" by Joep Schuurkes. "Capture the Bugs" is an application created by Maaret Pyhäjärvi and Ru Cindrea to allow testers to test their own testing skills. As a test target they offer E-Primer built by Alan Richardson. This was a truly fun session with everyone contributing a lot of ideas and finding issues together. I won't spoil things for you, just test it out yourself.
• "What are the limits of the Socratic method?" by Sasha. Originally, I wanted to take a break. I only went to the session's room because the coffee machine was located there - and then stayed for the conversation. It wasn't as philosophical as intended by Sasha and yet people gathered a lot of insights into where the Socratic method would not be appropriate and what other options we may choose instead, especially to help people learn. A key insight: people have to want to learn and for that get out of their comfort zones.
• "Public disclosure of vulnerabilities - to fear or to embrace?" by me. While it's not fully applicable yet, the European Cyber Resilience Act (CRA) has already put specific reporting obligations in place. They affect companies who put software products on the EU market that run on customer infrastructure. Those obligations include the public disclosure of exploitable vulnerabilities identified that made it to production. A lot of companies are still unaware of all the implications, may try to keep hiding their shortcomings, or even rather stop testing in order not to become aware of issues. On the bright side, the CRA finally serves as leverage to get our stuff in order and good practices applied. Like investing in our capability to deliver updates quickly and advising everyone what to do in case they have a vulnerable product version running.
• "Casual online testing hangout sessions". The facilitator wondered whether there would be interest in a remote space for the community to meet, hang out and learn together. The people coming to the session clearly confirmed that there is! While such online community spaces already exist, there can always be more that may attract different kinds of folks. The BREWT people were up for it and first steps already took place to make it happen. Loved the initiative people took! 
• "Small things - big impact" by Gabrijela Hladnik. What a great session full of valuable insights! Gabrijela asked people to share anything that makes a huge impact for them or others, in private or professional life. People showed up and contributed lots of little things that truly make a difference. We ended up with a whole compilation including classics like the Pacman rule for groups standing in circles to keep some space open for people to join the group with ease and waving your hands as silent applause instead of the rather overwhelming cacophony of clapping. People also brought ideas that were new to me, like activating auto-decline for focus time blockers in calendars (brilliant idea!), declining 30-minute meetings unless they are worth investing two hours for everything including preparation and follow-up, or expressing your energy freely so others can build on it.

After the conference closing, dinner was served. The food was nice and the evening full of insightful conversations and experience exchange. A small group around Elizabeth Zagroba, Joep Schuurkes, Sasha, Sanne Visser and her partner chose to extend the communing in a bar over a couple of more stories. A perfect ending for a great community conference!

HUSTEF 2026 - Finally Made It

HUSTEF was on my list of conferences to go to for quite a long time. Lots of people raved about it and I was curious to experience it for myself. This year, I finally made it there!

It all started with getting invited to the review board, helping out with evaluating proposals so that the program committee could make an informed decision. So I thought, why not submitting sessions myself and see if I'd also get a chance to speak? And it worked! I consider myself fortunate to have been selected among the many papers submitted.

Time flew by this year, and now it was time to travel to the beautiful city of Budapest. A long but comfortable train ride, some time to settle down and rest at the hotel, then I met Micha Kutz for dinner. Always nice to catch up with long-time friends from the community! 

Tutorial Day

The first day was reserved for full-day and half-day tutorials. I gave my workshop "Secure Development Lifecycle Applied – How to Make Things a Bit More Secure than Yesterday Every Day" as a half-day tutorial at one of the sponsoring companies who kindly provided their office space for it.

I've given this workshop plenty of times already and it's always super interesting to see different kinds of groups engage with the material in their own way, based on their own experience. I'm also very happy to see that the concept does work out with most folks, coming from very different backgrounds! This time I had mostly people working in testing and quality roles as they are the main audience for HUSTEF. I really enjoyed seeing them work through the exercises, ask questions, share their own related stories, and generally having fun doing so.

And then a truly special thing happened. The tutorial was over - yet participants didn't leave. They stuck around. They waited for each other having a bio break, they kept talking. They all left the location together, heading back to the city center, planning to have lunch together - and invited me in! That was too good an opportunity to decline, no matter how tired I was or what else I needed to tackle in the afternoon. We had a lovely lunch together, sharing even more experiences - what could be a better start for the conference?

At some point, I needed to head back to the hotel and do final preparations for the next day. Then it was time for speakers dinner. I met Sonja Nešić on the way to the restaurant, a lovely chance to catch up with each other. The dinner place was literally on a boat, yet I got lucky that it was firmly anchored and did not move in any perceivable way. I already had the experience of having speakers dinner on a boat in the past and I can only tell you it's not a great idea if you have motion sickness. The place's acoustics unfortunately couldn't handle the noise well and I struggled a lot with processing my environment, barely hearing what people said and straining my voice to make myself heard. On the bright side, the food was excellent and I had really great company. For example, I just loved catching up with Clare Norman and Jitesh Gosai, talking about light and deep topics, and finding out that all three of us are scripting our talks. I'm in good company!

Conference Day 1

The first conferencing day arrived and it was packed with amazing talks - it was a true challenge to pick which sessions to witness live. Also, I had to skip two slots in order to be ready for my own talk and then catch my breath right after. It was a pity to miss Nicole van der Hoeven's keynote "Asimov’s Zeroth Law of Robotics: Observability for AI" this way, I was really looking forward to it. Also, I would have loved to see Micha Kutz's talk "WTFM: Where’s the F****** Manual⁈ – Why we avoid writing documentation, why we shouldn’t, and how to keep it useful with minimal pain". Good thing the talks were recorded and I can catch those I missed later on - even though it's never the same as experiencing them live on-site.

• Keynote "Beyond Vibe Coding: What It Actually Takes to Build with AI and Stay Accountable" by Kristoffer Nordström. Well, AI tooling usage can found around many corners these days. Yet what does it really take to get good value from it, how to build software with these tools and still know exactly what you're doing and especially why? Kristoffer shared his story and what he found made the difference. I really liked the following of his takes: When building becomes cheap, we need judgment in the room. 
  
• "The art of getting out of the way: Facilitation for quality professionals" by Clare Norman. Loved that Clare shared her insights on such an underrepresented and yet so crucial topic. Lots of invaluable advice, brilliant presentation! I especially loved her emphasis that facilitation is all about listening and supporting everyone in the group in doing their best thinking together - and that includes generosity and fairness. 
  
• "The Rubber Duck that talks back" by Benjamin Bischoff. Benjamin pointed out that we had hype cycles before AI tooling, like search. And all the shortcomings that come with new technology, hyped or not. He also shone a light on how we can use our skepticism for good. Benjamin encouraged us to make use of our brains, apply discipline and differentiate unnecessary from necessary friction. 
  
• "AI applications security puzzle" by Maryia Tuleika. Maryia told a story on how security concerns evolved over the years, while some are still remaining alike. Especially for current AI tooling, how do we secure them? She points out that we should rather focus on the system and constrain the tools we have at that level. I really liked her take: "Don't ask only whether you can trust AI - build and test for the moment you can't." Maryia based her talk on detailed research in the space, gathering insights from the community - worth a read, and I'm honored to be among the people she consulted. 
  
• "Out of Security Exception – What to Do Without an Expert to Secure Your Software" by me. I presented what engineering teams can do themselves to improve their product's security posture without having a security expert at hand. I've given this talk already at BSides Luxembourg this year, yet in a longer and more detailed form. This time I needed to cut it down to the essentials to fit the time slot. It seems the message came across nonetheless!
  
• "How quality is created, maintained and lost in complex software systems" by Jitesh Gosai. I've seen Jit present many years ago and was already back then impressed by both his presentation skills and by how much his point of view overlaps with mine. His talks and thoughts just resonate a lot with me, so I had to check out this one as well. He walked us through the famous CrowdStrike outage that made the world stop turning for a bit, and what we can learn from it. It was a great reminder that complex failures never have a single root cause and they require us to acknowledge and improve the socio-technical system. 
  
• Keynote "Could Personas Be Your Insight Superpower?" by Steve Watson. Are personas still relevant or needed in the age of fancy AI tooling? Steve says yes, and I agree. He presented how we can use them in a meaningful way and demonstrated the pitfalls when creating actually insightful personas without missing out on what's relevant for our target user group. As he shared, the risks are in the gap between our assumptions and our users' reality. 
  

I truly appreciate the lunch breaks were decently long to get some rest and also socialize. I had the chance to briefly speak with Vitaly Sharovatov - always a pleasure, ever since we met at NewCrafts Paris 2024. Same with Sérgio Freire and Mazin Inaad! Would have loved to catch up more with each of them.

What I thoroughly enjoyed was the opportunity to have a quiet and relaxed dinner with Heather Reid, Léna Nyström and Rachel Kibler. We had discovered the perfect place for it as well, with delicious food, calm atmosphere and awesome service. For me it was an utterly needed chance to take a break for a little while before the pressure will be on again the next weeks.

Conference Day 2

The final conference day came with yet another bunch of awesome talks.

• Lean Coffee with Gáspár Nagy. I thoroughly enjoy lean coffee sessions, and yet I did not plan to join this one. That being said, I had arrived early enough at the venue, so I decided to just join in. We had insightful conversations on the usage of AI for slides, how spending money on tokens that goes to foreign companies destroys our local economies, how everyone turning into a vibe coder and wanting to bring their projects into production causes a huge problem and how to navigate it.
• Keynote "Now You See Me" by Heather Reid. What can I say. Awesome content, awesome delivery. More people need to hear this. Heather talked about what makes upper leadership not see what people achieved, while they themselves feel it's clearly there to see. Perspectives matter and we all only have our own viewpoint available. Making things visible in ways that allow others to see things is crucial for any career - no matter if you have a leadership title or not. 
  
• "'As is' is not a requirement – it’s failure in a fancy suit" by Léna Nyström. I loved how Léna walked us through three cases in her career where it seemed people wanted a copy of what's been built before. Yet is it ever a true copy? Of course not. It needs to be modern. Some things aren't relevant anymore. No one has the complete picture. Did anyone even ask what's actually needed or what wasn't working well with the old solution? We should listen to this signal of "It should work as is" and find out what questions are unasked. 
  
• "Looks Perfect. Runs Fine. Completely Wrong. A Live Hunt." by Christine Pinto. Christine took us on the investigation of an incident where all things came together so that a bunch of AI tools enabled attackers to exfiltrate data and demand ransom from a company. Based on the audience response it seems the message landed - supply chain attacks using AI tooling are way too common these days to stay inactive. 
  
• "Quality Signals on Pull Requests: How We Stopped Shipping Bugs Without Slowing Delivery" by Marco Andrade. Marco shared an all too well-known story of flaky end-to-end tests. He pointed out what the underlying issues were and what steps they took to make sure they got actual feedback and hence value from these tests. Marco warned people not to become the gatekeeper and scapegoat but have teams trust their pipelines. 
  
• Keynote "You’re not really ready for AI (but testing can help)" by Callum Akehurst-Ryan. I really appreciate that Callum shared his personal story and showed vulnerability on stage - we need to see more of such good examples. These are the cases we all can learn the most from. Callum shared how much AI amplified all the dysfunctions that already existed before in the teams and how that ended up badly for his organization and him personally. He emphasized that we can't just demand attention from people who don't have capacity to listen. We have to roll up our sleeves, make things better ourselves, and hence become part of the solution. 
  
• "The Tale of Two Pipelines: Why Your CI/CD Can’t Fix Cultural Debt" by Chris Armstrong. Technical debt oftentimes isn't technical at all. It's rooted in a lot of other types of debt, deeply human ones. Chris presented how it doesn't matter if your engineered delivery pipeline is fast if your team can't actually get things through due to other types of debt. He also showed how such debt can look like and what to do about it. The core: optimize for flow. 
  
• "When Your AI Testing Partner Lies to Your Face: Detecting and Defeating Completion Theater" by Dragan Spiridonov. Dragan addressed how AI tooling can claim to offer confidence, yet there's either no evidence for it or the evidence indicates a different situation. He shared how you can spot this and what to do instead not to let ourselves be swayed by AI. Now, Dragan didn't only give this talk, but also a full-day tutorial and a masterclass. People clearly appreciated what he shared, in the end he won the conference's best presentation award! Check out his experience report on the conference as well. 
  
• "The Quality Nervous System" by Kevin Pyles. Kevin presented a different approach to solve the overwhelm of too much data, getting flooded while still not knowing whether you can release a new software increment. He compared it to the human nervous system which also has to deal with huge amounts of data points and signals and transform them into meaningful output at scale. He also demonstrated how quality as a living capability could look like. 
  
• Keynote "Rethinking the Automation in Testing Principles" by Richard Bradshaw. Richard looked back 10 years ago when he and Mark Winteringham came up with a set of principles to achieve more effective testing through the help of automation. He contrasted them with today's world, presented revisions made and why (check out the reasoning in Richard's own words). The principles in their new form are staying relevant and keep serving as an invaluable tool to use our thinking skills and help make better software - focusing on intent and judgment. "If you can't answer why something exists or should exist, change it." Hear, hear! 
  

Conferences have a way to start slowly, make you forget how time flies by, and suddenly they're over. That's what happened here as well. Good thing we could prolong the community spirit for a while on the last evening. I joined a great dinner initiated by Kristoffer Nordström, with Cassandra H. Leung, Chris Armstrong, Marta Firlej, Mateusz Holewski and Richard Bradshaw. Later on, we were joined by Alex Cusmaru, Jamina Pöllänen and Gek Yeo. We moved on to a bar and stayed until it closed - it was finally time to end the evening. What can I say. Amazing food, amazing company. The best part of every conference. Thanks everyone for making this such a perfect end for my first HUSTEF!

Well, it wasn't quite over for me yet. I still had one day in Budapest. My chance to sleep in, go for a walk, do a bit of sightseeing. Truly ending the conference with another great dinner and conversation together with Jamina Pöllänen. Time to go home, time to share my experiences. Thank you everyone who made this conference a pleasure to be at!

BSides Luxembourg 2026 - True Community Spirit

With BSides Luxembourg, my conference year 2026 officially started. And what a kickoff it was! What an inspiringly insightful, community connecting event. We've built fond memories together and this instance will most definitely not be my last one.

Speaking in Luxembourg, how come? Well, it all started with a sketchnote. As usual during on-site conferences, I also took sketchnotes at BSides Munich 2025 and published them on Mastodon. One of the organizers of BSides Luxembourg, Claus Cramon Houmann, saw them and expressed his wish to see me at their event. That brought it to my attention in the first place. I checked out their website and things looked really intriguing!

As I try to get to conferences mostly by speaking, I checked out their call for papers. To my pleasant surprise, they offered financial support to reimburse costs occurring with speaking, aka travel and accommodation (mind me, I'm not speaking of a honorarium here). That's the normal bar I have for conferences, and I'm used to expect this from the many tech events I've been to. Sadly, this doesn't seem to be as common for cybersecurity conferences. Usually, I don't submit without that offer as I’m paying out of my own pocket otherwise – and many underrepresented folks have way less privilege than I have. Hence financial support is a green flag I’m actively looking for, indicating that the conference cares about inclusion and diversity. [Side note: That being said, I do understand that some community-driven non-profit conferences really cannot afford offering financial support (yet). I also am willing to meet them where they are - yet I can only support so many community conferences a year this way. Also, just inquiring about reimbursement often reveals a lot about where the organizers currently are, so I can make a way better informed decision for myself whether I'd like to continue with them or not.]

Back to BSides Luxembourg. I decided to go for it and hope for the best. For real, I caught myself time and time again the last months, hoping that I would get accepted - I had a feeling this would be awesome, and I really, really wanted to get in. The first round of speakers were revealed - I was not among them. I continued to hope. Then the email arrived - clarifying what financial support I would need! If they could make this happen, I would be in. I honestly loved this transparency from the start, as it made me trust this would be good for real.

Well, as you can see, I made the program indeed. My latest workshop and a brand-new talk got accepted. We also agreed that an older talk would serve as backup talk in case any speaker won't be able to make it. You can't imagine just how happy I was! Until I realized how close it was to the conference already. That was beginning of March. The conference took place beginning of May. I just agreed to a brand-new talk. Aaaaahhhh!!! This was cutting it awfully close to my taste. Especially given I knew what else was happening during these two months. Then I learned that even more and more had to happen during these exact two months as well. Literally everything all at once at the same time. Two travels, creating yet another brand-new conference talk with a dear co-speaker (and figuring out what works for us doing so), editing the latest novel of my best friend, preparing for all other upcoming conferences with due dates, oh and I also happen to co-organize my own conference, right? Of course we had certain immovable due dates during this exact time frame. All of this costing enormous amounts of hours and hours and hours.

What an absolutely stressful time. I knew it would be worth it, it was worth it, and yet. I cut and canceled everything I could (okay, not as ruthlessly as I would have loved to due to my inner people pleaser, and yet as much as I could possibly do). I halted my personal challenge. Friends and family didn't really see me during this time. The only thing I did not cut was movement - I even increased it because it was a one-time-too-good-to-possibly-true offer. I also didn't want to repeat my mistake to cut on exercise as I did the last years - and I had dearly paid for it as this resulted in losing range of movement, strength and general quality of life. I had just reclaimed some very basic capabilities I would not give up again anytime soon.

All in all, this was such a close call. Massive kudos to the folks who joined the dry run of my new talk, giving me just the constructive and tangible feedback I needed, allowing me to revise it heavily and cut it to the first version it had to become. Everything was close-knit to the very last moment, even finishing last tasks on my travel to Luxembourg. Anyone who knows me for a while, knows that this is absolutely not me. I'm the over-preparer par excellence, and while I've gotten pretty good at keeping things "good enough", this was unheard of. But hey, I made it. Still wonder how, but I made it.

Alright, fast forward to the conference! Here's how it went.

 

Arrival Day

My travel required to change trains several times - and to my pleasant surprise, it worked out. I arrived well in time to do another dry run of my brand-new talk and also prepare last things for my workshop. Most speakers had come together in a Signal group which made it easy to find a bunch of folks to go to dinner with together. I make use of such opportunities whenever I can as they allow getting to know a few people in a smaller setting before the conference starts.

Putting faces to names or aliases from the chat was great. I even uncovered I've already met one of the speakers already back at New Crafts 2024! The tech world is small, the conference speaker world even smaller. We enjoyed a lovely dinner and conversations on all kinds of topics together before it was time to prep for the next day.

 

Workshop Day

My own workshop "Secure Development Lifecycle Applied - How to Make Things a Bit More Secure than Yesterday Every Day" was scheduled for the morning just before lunch. We had a nice group of folks from all kinds of backgrounds coming together to learn and practice. The session worked out pretty well and my duty was done for the day! Things were off to a good start.

The lunch break was decently long to enjoy the food, have conversations with participants and also get some rest before the afternoon. I've decided to join "How to Read Code to Find Vulnerabilities" by Louis Nyffenegger. I was curious about this workshop due to a few reasons. First, I've been part of a code reading club a while ago, actively practicing techniques to understand code snippets and exchanging insights. Second, reading code was a big part of my previous role as a quality engineer, and still is as security engineer, with the specific focus on security. Third, I was keen on learning how Louis teaches code reading, as this is a topic I want to share further myself, and also given he's the founder of PentesterLab and I liked their style of conveying knowledge and skills. Long story short, it's been a really interesting workshop indeed! He shared a bunch of advice on what to look for when reading code and how to train this skill. We ran lots of exercises together on finding flaws in various code snippets, dissecting what made these insecure and how to build things in a secure way. Both detection and also knowing how to do better is such a crucial skill to hone. As the cherry on the top, Louis gave away copies of his book "CVE Archeologist's Field Guide: Methodology and lessons from 10 vulnerability analyses" - so much appreciated!

Right afterwards, I managed to get into the session "Dismantle The Bomb" by Stijn Tomme. This was designed as an escape game like scenario - and way too much fun to spoil what happened in this session! Let's just say: it's been the very first time I've seen a key being cut, a potato battery lighting up an LED, and cutting wires to deactivate the bomb. We had a really nice group to solve the riddles and puzzles together - teamwork for the win! Anyone having a chance to catch this session, go for it. We had a massively good time with this well-designed game, used our collective skills in new ways and came in touch with things that are not as common. Perfect for the afternoon - energy was really high afterwards.

Time for me to go back to the hotel and practice my talk for the last time, then head for the speakers dinner. The organizers were so kind to make this happen for us and we enjoyed lovely Vietnamese street food together - much appreciated! That kind of opportunity is usually great to connect with other speakers, learn about their passion topics and values, and just have a good time. As usual, we also discovered a few first-time speakers among us and shared experiences; we're all in the same boat and new folks are very welcome to realize they are not alone with struggles like last-minute preparations, coping with nervousness, and more. It was a great evening and things were ready for the conference days.

 

Conference Day 1

If you had seen the program for this conference, you probably understood my massive struggle to decide which sessions to attend live. There were the main conference tracks, as well as an AI village, a detection engineering village, a lockpicking village and a car hacking village. So many amazing sessions to choose from! In addition, talks were hosted across not only one building, but two - without many breaks in between to get from A to B, which really made a difference in my choices. Fortunately, most talks had been recorded and I will still have a chance to catch up. Some talks, however, were not recorded, so I tried to prefer them where I could. Also, as usual at on-site conferences (as shared already above), I did sketchnotes for almost all talks I attended.

• "Things Fall Apart: Allying Cybersecurity and Diplomacy against Authoritarian Disorder" by Luc Dockendorf. I was a bit late for this opening talk by Luxembourg's Cybersecurity and Digitalisation Ambassador, so I chose not to sketchnote it. I did, however, really appreciate the clarity in addressing the current planetary, geo-political and social challenges we face. What a strong opener for the conference!
• Keynote: "Identity Security Just Exploded" by Wendy Nather. Wendy presented what makes identities for authentication such a challenge, back in the days, and especially nowadays given AI agents. Lots of problems that never got solved (like delegation) are multiplying now. What we can do right now is to make sure our fundamentals are covered. 
  
• "What Does Threat Modeling Solve for AI Security?" by Nathan Pembe. Nathan made a great point how threat modeling can not only help to make pentesting efforts a lot more targeted, it also helps fill the gaps to implement security controls for audits in the age of AI. I really appreciated his down-to-earth call to focus on realistically reachable attack paths and separate those from noise.
  
• "Beyond the Prompt: A Framework for Agentic AI Attack and Defense Strategies" by Jeremy Snyder. Jeremy walked us through the major risks that AI agents introduce. It's not only about the agent itself or the model used, but we need to consider the whole architecture including interfaces to retrieve incoming data as well as the output created. This talk was full of awesome questions to ask!
  
• "Cloud Misconfigurations: Poke Poke, Breach" by Kat Fitzgerald. This was a talk that was not recorded - hence I asked Kat afterwards if she consented to me publishing my sketchnote of her talk. Fortunately, she agreed! This was a really cool talk about how misconfigurations just keep coming and showing up in various (way too known) shapes and forms. All the classics included. The solution: policy as code to provide safe guardrails! No chasing, instant feedback, actual clarity.
  
• "Managing Uninvited Guests: Securing Open Source Dependencies" by Frithjof Hoffmann. Originally, this talk was meant to be given together with Kadi McKean who unfortunately couldn't make it. This was an ever-green reminder to evaluate which dependencies we really want to build on and which ones to keep out. SBOMs can help find vulnerable packages, while we also need to acknowledge that scans can be flawed. 
  
• "Out of Security Exception - What to Do Without an Expert to Secure Your Software" by me. This was the premiere for my brand-new talk. For anyone who missed it, it was recorded so you can still check it out once it's published. Unfortunately, there was no immediate feedback feasible as the next talk started right after mine. Yet all in all, I'm quite content with how it went and people seemed happy enough as well. 
  
• "The Forgotten Fingerprint: DNS Based OSINT Techniques for Product & Service Discovery" by Rishi. This talk looked at TXT records in specifics and how they could be used in threat hunting and hence accelerate incident response. Rishi demonstrated both OWASP Amass and Nuclei as two of the main tools you can use to start your discovery today. 
  
• "Turnkey Code – Enhancing Secrets Management in Large Scale Organizations" by Diogo Lemos. Diogo presented an interesting case study of what they learned when building a proper secrets management platform. They needed to control the noise and consider the whole lifecycle - including rescanning safely without overwriting human triaging decisions. 
  

That was the last session for the day. Participants gathered, enjoyed good food and conversations together, sharing their insights of the day with each other. Then it was time for "Security Impress Karaoke" hosted by Kirils Solovjovs. Basically PowerPoint Karaoke but using OpenOffice Impress, with slides sourced from Cybersecurity talks. Lots of folks accepted the challenge to present random slides thrown together and combine them in a way that's concise and hilarious at the same time! Good fun.

 

Conference Day 2

The final conference day started tired and early, as it's usually the case for me the longer a conference goes. And yet, I wouldn't miss it and didn't regret it one bit.

• "The High-Performance Fuel for Social Engineering (Now in AI Flavors!)" by Glen Sorensen. Glen showcased how much data companies are collecting about us. They claim to have legitimate interest, yet do they really? What's considered justified, by whom? The problem here is that all this data is used for highly effective social engineering attacks. Having LLMs at hand, this danger became even more imminent. Glen shared lots of things we can do to reduce our own attack surface.
  
• "Spyware: The Invisible Threat" by Julien vander Straeten. Really interesting talk on spyware as a specific type of malware. Its goal is to persist on the device, deep in the lower layers, and exfiltrate all kinds of data. Lots of countries buy spyware, including 14 EU countries - and quite a few of those also produce their own. Spyware is expensive, though, so attacks are highly targeted.
  
• "Confound and Delay: Honeypot Chronicles from the Digital Battlefield" by Kat Fitzgerald. Yet another talk by Kat that was not recorded - so once again I asked her if I could publish my sketchnote, and luckily, she gave her okay for this one as well. This was a really cool talk on what you can learn through deception, offering attackers a realistic enough trap to observe their behavior. What they try to do. Including hilarious attempts! Honeypots can not only reveal how attackers operate but also predict production threats. 
  
• Lightning talk "Good things can happen at conferences" by me. Well. This was not planned at all! Hence there's no proper abstract either. Here's the background story: On the workshop day, I shared with Claus as organizer of BSides Luxembourg that I am co-organizing the Open Security Conference (short osco). He instantly offered us their partnership - something I was just about to ask them as well. Super cool and kind! And then he shared there might be still a lightning talk slot available and asked whether I'd like to share a bit about osco. I usually don't do lightning talks at all, yet this one I felt would be feasible - it's pretty easy to talk about my own conference after all, I've done that plenty of times already. I kept this option in mind and inquired the next day whether the slot would still be free. Organizers shared it wasn't clear yet until the following day, but at best I would be ready for it. So at midnight I sat down and drafted a script. I knew I could just do a shameless plug - yet I wanted to give people more of a real message than just the mere promotion of our event. So I thought, what if I told the story how osco came to be? In general, how good things happened at conferences? I would have had plenty of examples on that matter, yet I decided to focus on three events. One, conceptualizing osco at SoCraTes 2023. Two, meeting my now manager at the first osco edition and only weeks after getting hired by him. Third, our freshly made partnership at BSides Luxembourg. Now I had my script ready to go. The last conference day came, and during the lunch break just before the lightning talks, I asked again if that slot would still be free. It was indeed! Just 15 minutes before the talks started, mine was added to the program. Then I realized, everyone else had slides - I had planned to just tell my story. But one supportive slide would be great indeed as a visual support. So I put our logo on one slide. A QR code next to it. That would do. Finished just a minute before going on stage! My whole speaking experience paid off in that moment. I went on stage and told my story. I made it. Later people came to me to tell me how much they loved the idea of osco and how good this talk was. For me as a recovering perfectionist and over-preparer, this whole feat was a real achievement unlocked! It seems I hit a note there. I'm already very curious if I'll ever learn what people took with them in the end. But well. Here's the script as I prepared it, and only slightly adapted when telling the story live.

  This is a true story on how good things can happen at conferences. 
  
  The year is 2023. I'm not yet working in security. I'm part of an engineering team, building products hands-on together. 
  
  I'm at a tech conference, called SoCraTes. It's a special kind of conference, as its program gets created right at the beginning of the conference - by the participants. The format is called an open space. It's designed in a way that everyone can contribute and everyone can learn in the ways they want at that moment in time, about the topics they want to learn about at that moment in time.
  
  So I'm at that open space conference, where I get to have a say on the program. I have a clear focus topic: I want to learn more about application security. Oh cool, there's a person who works in security and is also curious to learn more from other participants. His name is Claudius.
  
  Claudius and I, we agree to host a session together on usable security. Lots of folks join our session and we learn from each other. It's energizing. Claudius and I find we work well together, so we decide to host a workshop. Another success! Inspiring.
  
  We sit at lunch, and Claudius shares his idea with me: he wants to start a new conference. A security one. In the open space format. He feels that that's currently missing in the security community. I was hooked! And I added: Yes, a community-driven, non-profit conference - for everyone interested in cybersecurity, no matter their current roles or skills. Breaking down barriers and gatekeeping. I believe we all can learn from each other. 
  
  The idea of osco was born - the Open Security Conference. 
  
  We find further co-organizers on our journey. We find participants who love the idea. The idea becomes reality.
  
  Good things can happen at conferences.
  
  The year is 2024. We have the first edition of osco. Small. People love it. Many will return the following year. 
  
  And I? I also enjoy our conference. I'm sitting at dinner next to Rudi, who talks about his security team at his company. It sounds like a good place. Little do I know that I'm sitting next to my now manager, just 3 weeks before I will get laid off from my former company. Yes, I co-organized a conference and I got a job thanks to it. In application security. 
  
  Good things can happen at conferences.
  
  Fast forward to 2026. Our organizer team is preparing to host the third edition of osco on November 5th to 8th, in Germany, close to Frankfurt am Main.
  
  I'm here, at BSides Luxembourg. I talk with Claus and the other organizers. I share about osco - and our two conferences partner up. 
  
  Good things can happen at conferences.
  
  If an opportunity presents itself to you, seize it. It might come with the person right next to you, at lunch or dinner. Look out for them. 
  
  And if you're curious to learn more about the Open Security Conference? Come to me, get a postcard to spread the word, and become part of our story.
  
  Good things can happen at conferences - and beyond. 
  
  Thank you. 

• "Building Secure AI: Making Threat Modeling a Core Part of Development" Diana Waithanji. This talk was the perfect closure to the conference for me! Diana explained her approach to threat modeling, where I just sat and kept nodding along. Like that there's no one way to do threat modeling. Diana showcased how frameworks like STRIDE are still applicable when it comes to threat modeling AI systems - as one of many possible ways. She involved the audience actively and we heard from several people what they do and how it works for them. She also emphasized the importance of fostering good relationships with engineering teams, involving the whole team and collaborating across roles, as well as making threat modeling sessions high-energy and inclusive. So much this! Diana's talk highly resonated with my own experience. 
  

And that was it. Originally, I had planned my last conference afternoon differently beforehand, with more talks - yet things came different than expected. First with me joining the lightning talks at last notice, and then with me standing by to give my backup talk, as pre-agreed with organizers. In the end, I didn't have to give it, and I used that unexpected time as a lovely chance to catch up with Marina Stephanova, one of the organizers, instead.

Right after the conference ended, there was yet another neat opportunity: Marina invited interested speakers to go sightseeing together and showing us around Luxembourg city! An offer way too good to refuse for sure. We had a lovely group of around 15 people, the weather was perfect, and we enjoyed a nice tour together while learning about Luxembourg's history and people. Afterwards, we had a great dinner together. Once we headed back to the hotel, how could it be differently, the last core of us ended up in the hotel lobby. Just really good company (thanks to Ellis Stannard and Leonardo Wolff Takemasa Fernandes!), deep conversations in the middle of the night (extra special thanks to Diana Waithanji and Sonia Seddiki!), while tasting fiery hot snacks from India (huge shout-out to db here!). What could be better. 

 

Returning Home

The next day it was time to depart, saying thank you to everyone one more time, and take my memories with me. I realized how tired I was, and while that made it a more complicated ride home than it would have needed to be, I did arrive safely and roughly in time.

My heart was full and brimming of the community spirit I just experienced. Lots of folks I met for the first time where it was just easy to connect with each other. Some people I even met the second time; the world is small! What a pleasant surprise. And not to forget all the care that organizers put into all the little details, always ready to help out and solve things or make them at least better, always appreciative of feedback. Special kudos to the team for making this whole event such a welcoming and inclusive experience, I really felt that I belonged. Their choices how to craft this space for community showed in everything: representation among the speakers, reflected in the participants joining, the options in conference T-shirt fits and range of sizes, the food offer, the choice of language. Everything. It clearly showed their continuous intentional effort and it paid off. 

Looking back, this was such a good conference. The smooth organization, the speakers and participants from all kinds of backgrounds, the variety of super interesting topics, the space to connect with each other and stay connected. Can only recommend you checking this one out next year! It won't be my last BSides Luxembourg for sure. I'll cherish the memories we've made together and the kind feedback this community provided.

2025 - The Year in Review

What a year! Just like many others do, I use the end of the year to look back at what happened and acknowledge both achievements and struggles. I've written lots of those reviews over the years and this practice helps both present and future me see how things evolved over a longer timespan. So, without further ado, let's get to it.

 

Professional

• The biggest change of 2025 for me was that I've started at a new company in a new role. It's now nearly a year that I've been working at DocuWare as a security engineer in a central enabler team focusing on product and cloud security. This kind of role change was and is huge for me. Especially as I realized that I didn't only dare try something different. I could indeed contribute a lot of the experience, knowledge and skills I've built up over my career in this new, more focused area. At the same time, there's a lot more to learn and grow into, and I love that I continue to be very intrigued to do so. 
• For the first time, I've done third-party product assessments for security myself instead of asking our security team. Well, now we are the security team! It's been a really nice topic to get hands-on very early on the new role.
• I've done threat models and security reviews before for my own teams. This year, however, I've done them for and with a bunch of our engineering teams - which required building up a lot of context in very little time, again and again. I love that my teammate and I continuously experimented with even better ways to do threat modeling and make it a beneficial experience for everyone.
• In a cross-team collaboration, we've provided a convenient pipeline template to scan for vulnerabilities that teams could plug in easily and quickly to get going. It's been picked up widely and the feedback received was pretty good throughout the year.
• I've conceptualized our very first security champion program, we refined it in our team, and we managed to get buy-in from stakeholders very quickly. Another personal achievement here was that I've repeated the same presentation for all our team leads of all domains - 7 times in 2 days in 2 languages. Personal high score! The potential champions are currently learning about the pilot we want to run so they can make an informed decision whether they'd like to opt in from the start. Next year will be super interesting in this regard.
  
• We've grown a lot in the team, individually and as a team - even a lot quicker than I've observed this with other teams before. And it shows, we're having way different conversations now than we had beginning of the year. Everyone is sharing transparently, acting as sounding boards, truly collaborating - I just love seeing this. We've become more resilient, faster in our feedback, a lot more intentional and strategic in what we spend our time on and how we approach situations. I'm very grateful for my team including our manager so we can continue to improve together! 

 

Community

• I've paused speaking at conferences during the first half of the year to start at my new company without overloading myself or overburdening my new team. Therefore, I've only spoken at 3 conferences during the last months this year, including once more at a new conference in a country I haven't spoken before. Until now, I've had 110 speaking engagements overall, 51 of them conference sessions, given at 28 conferences, in 13 countries. Truth be told, I'm still amazed at such numbers, and I need to see them in front of me every end of the year to realize this actually happened.
• Sadly, I had to cancel my very first speaking engagement this year due to sickness that I just couldn't spread further at a conference. Hence, I didn't make it to my first Øredev - yet. On the other hand, I got super fortunate that this was indeed the very first case I had to cancel an engagement since I've started public speaking in 2017!
• I co-curated my first dedicated conference track - the security testing deep dive track at Agile Testing Days, together with  Kristof Van Kriekingen and Santhosh Tuppad. I loved that we could give the stage to lots of awesome folks and offer the audience a whole variety of insights this way!
• So far, I've given lots of workshops at conferences - yet this year I managed to give my first one at a security conference at BSides Munich!
  
• I acted as session chair for the first time at BSides Munich - trying to do sketchnotes at the same time. Phew, that combination was tough, yet I made it. Definitely a first timer for me.
  
• Including this one, I've written 11 blog posts this year - more than I expected. It didn't feel like I was writing much during the year, probably because I originally planned to write a lot more. Well, reality kicked in and I chose to prioritize other topics, so there was no energy and capacity left for writing much. Yet 11 posts aren't too bad after all.  
• We had the second edition of the Open Security Conference and it was both a big struggle to make it happen and a huge success! I just loved seeing folks enjoy themselves thoroughly in the space we co-created and share their own experiences out loud on social media. Very much looking forward to the third edition next year! Fingers crossed we learned enough as an organizer team to make the third one go smoother.
  
• I've started my very first CTF team together with Mireia Cano and Martin Schmidt, joining our first official CTF competition. We continued practicing throughout the year, even saw each other in real life at a conference for the first time. Just love that we have this small, safe group to learn together by solving security challenges!
• The security card game that Martin Schmidt, Philipp Zug and I are building is still alive, and while we're deliberately keeping the pace slow, the game grew both in concept and in content. We had a chance to showcase it at two conferences this year and gain further feedback and ideas - it's just a celebration in itself that we continue to work on this for so long now despite it being a pure leisure time, slow project. It's one of those rare sustainable ones!
• Last year, Shiva Krishnan and I had started a series of leadership workshops with our very first community cohort. We really struggled to get this going last year, and beginning of this year was no difference. We nearly reached the point to give up and pivot. Yet then our small cohort fully engaged and we actually made this happen! Super proud we did pull through in the end and had impact we hoped for. Even though it wasn't easy most of the time.

 

Personal

• In my volleyball team, we've managed to level up leagues in spring and started in the higher league in fall! Super proud and we're already learning a lot given our new challenges.
• Another volleyball highlight, and an extremely rare one: Together with our senior's team, I've had the honor to join the German senior championships! Yes, it's as wild as it sounds. Well, we got very lucky as there weren't many teams in our region for our age group, and yet: this was a true once-in-a-lifetime event. Playing against former premier league players, or even the dream team of former national team members is truly a unique experience you could only dream of. Acting as a referee for such games is just as well! This was a true rollercoaster of emotions and I wouldn't miss it.
• Over the last years, I sustained several small, but persistent and annoying injuries restricting my range of movement and affecting quality of life. I picked up custom training to help me get back to better shape, and it paid off massively. For example, I can finally kneel again which wasn't possible for nearly the whole year. Also when it comes to a bunch of other areas, I'm super happy that I managed to take care of my health a lot better this year. 
• I finally started to relax a bit again. It didn't work all the time, there were plenty of stressful and packed phases, and yet. The constant tension and anxiousness faded. Lots of people from all parts of life noticed that something changed compared to last year for the better, and it's been very clearly attributable to my change of workplace. I found my optimism again and rediscovered the joy in doing what I'm doing.
• Lastly, I managed to complete another personal challenge. This year's Calm and Steady endeavor was truly very personal. While I still have lots of stuff to work on, I did take things easier and celebrated when I noticed that I've been kinder to myself. I took more time for myself. Sometimes just to do... not much of anything. Or just things that I like doing for no other reason than that I like doing them. The best part here was being on this journey of reclaiming time and catering to our needs together with my best friend aka sister, holding ourselves accountable with each other. If you happen to read this: Thank you so much for all the wisdom shared in tough moments, all the reminders of taking things slower (yes, even slower than that), all the encouragement and reassurance that this is a basic need and not selfishness. I've already shared this with you, yet let me repeat it once more: without you I wouldn't have taken as many interpersonal risks this year and I'm both proud of you and very grateful to have you in my life!

 

Enjoying the Last Weeks of the Year

This year was a really good one for me, and I'm truly grateful. No one can choose what might happen during a year and I've been blessed. Special thanks and kudos go out to all the amazing people who shared my journey this year in little and big ways - you all made it so much better.

Now that it's the end of the year, some chores are coming up that I usually do over the holiday season. There are new conference proposals to draft so I can submit them beginning of the year - I've already preselected conferences I'd like to try my luck with in 2026. Finally, there's my next personal challenge to commit to and pour into written form so I can share it, make it real, and make it happen.

But whatever task awaits, I'm doing my best to enjoy this time of reflection and thinking ahead. And that includes that at times I'm just doing nothing, resting, playing games, exercising, whatever. I'm ready for what's to come in 2026!

BSides Munich 2025 - On First Times

I've been to BSides Munich for the last three years, and it's been a pleasure each time. So while it wasn't my first time to attend the conference, there were other first times to be celebrated. It's been my first time giving a workshop at a security conference. It's been my first time as a session chair for speakers. It's been my first time that I've been together with the other half of my team at a conference. And for one of them it's even been their very first conference! That alone is already making my year. Especially as that specific teammate dove into the full experience, connecting with folks, joining a dinner group in the evening, exchanging experience. Just love it when good things happen.

 

Workshop Day

My day started out with meeting some known and new people on my way to the venue (we all ended up at a slightly wrong address at first, which was rather a connecting experience). On entering the (actual) building, there were more folks to greet. Some from other conferences, some from BSides Munich the last years. Grabbing a quick breakfast, it was time to start learning together.

In the morning, I joined the half day workshop "Cloud-Native Chaos: Hacking CI/CD and Cloud Environments" by Samuel Hopstock and Daniel Schwendner. This was a  really cool session and an actual workshop, fully hands-on and even exploratory! I know it's literally in the name of a "workshop", yet at times they end up as lectures instead of actual interactive hands-on learning sessions. So this was a really nice experience. We formed a group of three to tackle our task: given a practice app, gain full access to the Kubernetes cluster it's running on. The challenge was on! I loved that we had decent time to really try ourselves, not too many spoilers but help when needed. Perfect combination. I'm not going to spoil this workshop and the attack path we discovered, yet we could really make use of leftovers, misconfigurations, and oversights all the way. It was very interesting to see for myself how easy it can be to escape a Docker container to the host. It's different to know about it theoretically and to actually see it and especially to do it yourself. Another aha moment for me was to learn how to upgrade a non-interactive reverse shell to an interactive one - super useful for my next CTF sessions. 

After great conversations over lunch, it was time for the afternoon workshops. First, I joined "Developing Universal AI Agents for Static Code Analysis via MCP" by Sunil Kumar. My own workshop had been moved to a later slot and this one was the only session fitting in before. Good thing it was also on a topic I know I need to learn more about. Admittedly, I couldn't fully focus with my own workshop coming up right afterwards, yet it did showcase how MCP servers are built and configured, and demonstrated how they could be used afterwards. More to dive into for sure.

Then it was time for my own workshop "Secure Development Lifecycle Applied - How to Make Things a Bit More Secure than Yesterday Every Day". It was not set up for a good start - there was no break scheduled in between the two workshops, and people joining both definitely needed some time to breathe. To add to this, I learned about yet another scenario how things can go wrong when presenting. This time, the projector and my laptop both decided to connect shortly at first, but when I attempted to mirror the screen instead of extending it they said enough is enough - we're not working together any longer. Luckily, it's not my first rodeo so it didn't bother me (what a nice surprise to be calm for change), plus showing my screen was anyways only a nice bonus for my workshop. We found a quick solution, and once people were back from their break we could finally start. But well, that definitely cut as around 15min from the already short time. People told me afterwards they definitely wanted more time, it was flying for them! They had fun trying their hands on the exercises and there was more to explore. While some things are not in my hands, I'm taking this as a very positive signal.

The workshops were done and yet not everyone was ready to call it a day. My dear CTF team Mireia Cano and Martin Schmidt, one of my colleagues and I all headed for dinner to extend the conversations and have a nice conclusion for the day. 

 

Conference Day

Already at the beginning of the day, I've met many familiar faces and we all prepared together for a busy day ahead full of talks, conversations and insights. Here are the sessions I attended.

• Keynote: "The art of saying NEIN (in security)" by Martin Brunner. Cybersecurity is a lot about trust, and we need to learn how to say "no" more often, especially from a defender's standpoint. Also, this talk made a new connection across domains: What we have in security with attackers, defenders and victims resembles the drama triangle with persecutor, rescuer and victim a lot. So also here, you can only stop playing the game. In general, Martin encouraged us to be very intentional what you say yes to, what you say not to, and why.
• "Fantastic clear-text passwords and where to collect them" by Stephan Berger. This talk showed up a lot of interesting ways how to get your hands-on passwords on Windows systems. Easily. Honestly, too easily. Stephan reminded us that you often don't need fancy new tools, you just need to take the time instead and get your hands dirty.
• "Structuring (cyber) incident root-cause investigations: a practical walk-through" by João Collier de Mendonca. This was a nice demonstration how incidents look in a very real scenario and what constraints come with it. Like in the medical and healthcare domain. Also, I'm curious to check out the mentioned DFIQ framework of forensic questions and approaches.
• "Trust Issues: How Gen Z Attackers Hack Without Exploits" by Tom Barnea. Tom explained how Gen Z aims for the weakest link: the human. They are hacking trust as this is way easier than hacking systems. Going for everyday unsuspicious tooling and activities which evades traditional defenses is not only smart but also efficient. We need to rethink and change our approaches accordingly. 
  
• "Translating mobile app security lessons to the Flutter stack" by Samuel Hopstock. Having worked with ReactNative apps, I was curious how Flutter differentiates when it comes to security. It wasn't very surprising yet still pretty interesting to hear the answer: Flutter apps are just mobile apps and show the same issues as any other mobile app, so we can use the same approaches to find weaknesses. 
  
• "In Scope, Out of Sight Why NIS-2 Isn’t Landing in German SMEs" by Younes Ahmadzei. A lot of comnpanies are in scope of the new regulation. Nearly none of them are aware of this fact. And even if they are, they still lack understanding on what it actually means to them and what they have to do - such uncertainty can be paralyzing. 
• "Why I Go to the Dark Web Every Day" by Alex Holden. Alex shared super interesting stories on what he learned when trying to gain the trust of cybercriminals, where they work, what they think. He emphasized that if you don’t know what’s going on on the dark web you have to assume the worst in case of breaches (e.g. you won’t notice that an attack is going on and how it ended, if the attacker aborted or pulled through). Also, corporate data is extremely valuable, and it’s everywhere in the supply chain - we tend to forget about this aspect. We better know our enemies and threats to stay ahead. 
  
• "The Perks and Perils of Persistence: AWS Attacker Techniques" by Oisín B. This talk shared lots of tangible actions that attacker will try, how discoverable such attacks are, how we can spot them and what we can do to prevent these paths. It was targeted on AWS, yet the core ideas are transferable to other cloud providers. 
  
• "Turning Off the Internet: Technical Tactics of State-Scale Censorship and Shutdowns" by Reza Sharifi. A lot of people witness shutdowns way more than others - they are reality nonetheless. Censorship thrives where the network is centralized as central points create control points. The tactics and techniques applied differ, however, based on which layer of the stack they target. This talk could have gone easily for a lot longer, there's a lot to talk about on this topic.
• "NTLM reflection is dead, long live NTLM reflection: Story of an accidental Windows RCE" by Guillaume André and Wilfried Bécard. Here's a story of how the researchers found a trivial logic vulnerability allowing authenticated RCE - by accident. They couldn't believe it at first, yet in the end had to emphasize in this talk: high-impact, simple and stable logical vulnerabilities still exist.
• "Cloud IR: A Rapid Guide for AWS, Azure & GCP" by Erblind Morina. It doesn't come to any surprise, yet sometimes we need to hear messages on repeat: lack of logging means limited evidence. Visibility and logging coverage are key for incident response. Erblind encouraged us to start using the incident response cheat sheet of our cloud provider and to check out the Incident Response Hierarchy of Needs. 
  
• Keynote: "Oops, I pwned it again!" by David Elze. I love it when people share failure stories and what they learned from them. We all have failure stories - and some are more epic than others. David shared five situations where things went awry and the lessons they gained from them. Including the last: sometimes we do have to take certain risk that comes with the nature of our job.  
  

For two of these talks, I've also had the honor to support as session host. I tried to find the speakers already beforehand, yet I didn't spot them in the crowd. This meant we could only check in shortly before their talk on what they needed regarding setup, timekeeping, introduction and so on. And then it was already on! Welcoming the audience to the room, having them seated, getting their attention, and having them cheer. Welcoming the speakers to the stage, getting them briefly introduced and then out of their way. During the talk, keeping track of time and signaling notes according to speaker needs. Afterwards, coordinating questions from the crowd, ensuring the program schedule can be maintained. Thanking the speakers, making sure they got what they needed. And a few more things, huge kudos to BSides Munich organizers for preparing a comprehensive cheat sheet upfront for session chairs! They also went the extra mile and prepared both bio notes for the speaker introduction as well as potential fallback questions for each talk in case the audience wasn't ready to engage. All this went pretty well. Once again I found myself in a situation where I was glad to have been doing public speaking engagements for so many years by now, and where the respective skills gained really pay off.

The additional challenge I had: how to do sketchnotes while also being a session chair? Well, I dared to go full in, and it did turn out to be pretty stressful. I also missed parts of the talks and my sketchnotes don't do them justice. But well, I learned that's part of doing sketchnotes anyways. There are constraints and you have to live with them. Whatever you have on paper in the end you have, whatever you didn't note you didn't. It's a perception and interpretation of the talk anyways and you just do what you can do in the specific moment. I also learned over the years that I'm doing this, that no matter whether I like how a specific sketchnote turned out or not, it might still help others and it's usually appreciated by speakers. So I'm sharing them anyways.

The conference day was over super fast, with the packed schedule and lots of conversations and also duties to fulfill. Also on this day, not everyone was ready to leave just yet and instead hang around and stayed for a while, still enjoying each other's company. 

Then it was time to join the organizers and my fellow speakers to go to the speakers dinner. We concluded the day with a really delicious meal among great people. We made new connections, we exchanged our favorite licorice products, conference venue struggles, insights on local security communities, and much more. As you do.

Thank you everyone for making this yet another great conference! Won't be my last BSides Munich for sure.