RBLN West 2026

The Underground Set Up

Exhibitors set up their Underground tables and get ready to connect with attendees ahead of First Pour.

First Pour: Welcome & Networking

Pick up your badge, get settled, grab a drink, and start connecting. The Underground will be open to explore, giving you an early chance to meet industry partners and fellow security practitioners before the main program kicks off.

Theme: Breaking the System

Security is changing fast, and the old playbooks aren't always keeping up. Day One at RBLN West takes a closer look at what's breaking, what's being challenged, and what needs to change. From AI and emerging threats to offensive security and the realities of defending systems in production, we'll bring together the people building, breaking, and securing what's next. Real problems. Honest conversations. No easy answers.

Coffee and Networking

Grab your badge and coffee. Check out the Underground exhibits.

Underground Exhibits

Open all day. Think less trade show, more operator playground. The RBLN Underground brings together cutting-edge companies, interactive experiences, and the technology driving the next wave of disruption.

Opening Remarks

Kick off RBLN West with a welcome from the organizers, a look at what to expect, and an introduction to the conversations shaping the future of cybersecurity, AI, offensive security, and modern defense. Get ready for two days of real-world insights, candid discussions, and connections with the people building, breaking, and securing what's next.

Fireside Chat: When AI Becomes the Attacker: Are We Ready for What Comes Next?

Dr. Neil Daswani ,Shane Shook,Vimal Suba,Erez Yalon

Breaking the Rules: The Security Executive Playbook Wasn’t Built for AI

Larry Letow,Bil Harmer,Aaron Brown,Nicole Grinstead

The security playbook was built for a world of applications, infrastructure, identities, and human users. AI is changing the rules. As AI moves from experiment to infrastructure, product, and workforce, security leaders are being forced to rethink how they manage risk, enable the business, and build security programs that can keep pace. The challenge is no longer simply securing AI. It is figuring out how security itself needs to change. Larry Letow, CEO of TachTech, brings together three security leaders operating at very different points on that frontier: an AI-native company moving at extraordinary speed, a developer platform where security has to scale with the product, and one of the world's largest platforms navigating security, safety, identity, and emerging AI technologies at massive scale. What assumptions are no longer holding up? Where does more control actually create more risk? What should be automated, delegated, or eliminated? And when AI can build, act, and make decisions, how does security evolve from a gatekeeper to an enabler? This is a candid conversation about the rules worth keeping, the rules worth rewriting, and what it takes to build and secure an AI-enabled business without slowing it down.

Break and Networking

Fireside Chat

James Foster,Josh Kamdjou

AI is raising the stakes for both attackers and defenders. The organizations that succeed will be the ones that separate real capability from hype, rethink traditional security operations, and put AI to work without taking humans out of the equation.

Uninvited Guests & Unchecked Agents

Jorge Zelaya,Lasse Andresen

Imagine you're throwing a party. You want people to show up, have fun, and enjoy themselves. But before you open the doors, you probably want to know who's coming, who invited them, which rooms they're allowed into, and who's keeping an eye on things. Now imagine some of your guests can invite other guests, hand out keys, and make decisions on your behalf, all without asking you first. That's increasingly what we're doing with AI agents inside the enterprise. So the question isn't whether we should throw the party. The party is already happening. The question is whether we're prepared to host it safely.

Networking Lunch

Take a break, grab some lunch, and connect with fellow attendees, speakers, and sponsors. This is a casual networking lunch designed to keep conversations going and create new connections across the community. Visit the exhibit area while you’re here and take time to engage with our partners.

Technical Talks

Three tracks. Three different angles on what happens when security meets the real world. •AI & Autonomous Systems: Salon A Explore how AI is changing the attack surface, defense strategies, and the way security teams operate. •Offensive Security & Hacking: Salon B Get into how attackers actually break things, from new techniques and vulnerabilities to what defenders can learn from the offensive side. •Defense, Infrastructure & Resilience: Salon C Look at how organizations are building, securing, and testing infrastructure designed to withstand real-world attacks and disruption.

Agentic AI with Cloud Credentials: The Attack Surface Nobody's Governing Yet

Ajay Kumar Govindaram,Harshit Kohli

•A threat model for agentic AI that maps agent capabilities to ATTACK-style techniques — permission escalation, lateral movement, data exfiltration through tool-use chains •Three specific detection signatures that distinguish autonomous AI agent behavior from human operators and traditional compromised credentials •Architectural patterns for blast radius containment when AI agents operate across account boundaries — what "least privilege" actually means for an entity that can reason about its own permissions •A practical framework for evaluating which agentic workflows are safe to deploy without human-in-the-loop gates vs. which ones need kill switches •Why current AI governance (model cards, responsible AI frameworks) is insufficient for operational security of deployed agents — and what to replace it with

Mo Vulns Mo Problems: Responsible Disclosure & Irresponsible Maintainers In The AI Era

Moshe Siman Tov Bustan

Attendees will learn how a proper security disclosure process works, including best practices for finding the proper secure channels to communicate with maintainers, and what to do when open source vulnerabilities affect real production environments. Attendees will learn how to validate if an open source project is likely to contain vulnerabilities, if its maintainers are not treating security disclosures properly, and if they should avoid using a specific open source project because of that. Attendees will gain insights from our research that they can use to decide on their internal security bounty programs, patching, vulnerability criticality and incident response time - our research will contain the average time to patch open source code, average number of publicly disclosed vulnerabilities, average number of security programs per repository and more. Attendees will learn how to properly communicate disclosures from both a researcher and a maintainer perspective, while also learning about core elements that define critical vulnerabilities, such as command execution primitives and information exposure bugs that can hide in plain sight.

AI‑First Enterprise Architecture: Turning Pilots into Production

Rakesh Pal,Tanvi Desai

• How to recognize why your AI pilots are not scaling and which architectural gaps are to blame. • A concrete reference model for an AI platform that can serve many use cases across the enterprise. • Patterns for integrating AI services with your existing microservices, data lake/lakehouse, and identity/security stack. • Practical SLOs and observability signals for monitoring AI systems in production (quality, drift, and cost). • A staged roadmap to evolve from ad‑hoc AI projects to a governed, reusable AI platform.

When Both Sides Have Agents: Attacker Engineering at Machine Speed

Vincent Passaro

• How to turn a human adversary taxonomy into a system agents can reason over, while preserving the relationships between tactics, techniques, evidence, classification and provenance. • How to put deterministic architecture around probabilistic reasoning, with explicit knowledge states, validation gates, provenance requirements and independent review before generated intelligence enters the canonical framework. • How to build the loop in both directions, applying the taxonomy to real systems and code while allowing agents to identify gaps and propose new intelligence without contaminating the source of truth. • The failure modes to expect when agents handle adversary intelligence—manufactured consensus between same-vendor models and silent failures that look like clean results—and the evaluation criteria to define before trusting any agentic result.

Pod-tential for Disaster: Hacking Kubernetes from Pod to Cluster

Scott Miller

Throughout the session, you’ll see exactly how bad actors chain these configuration flaws to move laterally, escalate privileges, and ultimately breach critical components. We’ll wrap up by discussing straightforward fixes and best practices that can thwart such attacks in your own deployments. Whether you’re a security pro or just getting started with container orchestration, you’ll come away with a clear understanding of how Kubernetes implementations get hacked—and how to keep them secure. If you want to grasp container security by breaking it first, this talk is for you.

Envisioning a Future State Cybersecurity Program (Public Sector) 2028

Paul Grabow

Public sector programs are trying to fight today’s attacks with yesterday’s organizational operating models. I will outline a near‑term, achievable future‑state model for public sector cybersecurity that fully leverages data science/Gen AI technologies, backed by strong governance and leadership. I will connect emerging tools with frameworks like NIST NICE, CSF, and ISO 27001 to present a notional future state program with AI technologies as infrastructure. I will end with a "call to action" to collectively work towards building optimal Future State Program in the year 2028.

Break and Networking

One Scan Is Not a Security Assurance: Stochastic False Negatives in LLM Vulnerability Scanning

Petr Šimeček

•Why a single LLM scan result is a sample, not a verdict, and how to quantify that with pass@k and overdispersion instead of point estimates. •How to build a cost-aware scanner portfolio: when to repeat, when to diversify, and why the strongest model is often the worst reliability-per-dollar choice. •Which pipeline stages actually earn their cost (repeated passes, skeptical triage) and which intuitive additions don't (generated context, deeper triage rounds). •Where the current capability floor sits: web-app bugs commoditizing, stateful C infrastructure still requiring humans, fuzzers, and stronger analysis; and how to route work accordingly. •A public 95-CVE benchmark and evaluation harness you can run against your own scanner in an afternoon.

Make It Unprofitable: Red-Teaming Anti-Scraping Defenses in Production at Scale

Malya Jain

Defenses are just assumptions until an adversary -- or your own red team -- tests them for real. This is a "show me, don't tell me" session: a repeatable red-team lifecycle for scraping, resilience scorecards (time-to-detect, time-to-enforce, evasion-success, account-survival), and a threat-economics model that measures success by the adversary's cost-per-record rather than vulnerability counts -- proving that a shipped fix isn't a validated fix. It maps directly to your Offense/Defense, Infrastructure Under Pressure, and Next Era of Security themes.

The Clock is Ticking

Dr. Aaron Kemp

The quantum era will be defined by those who prepare. Proactively building a quantum-resistant foundation is essential for protecting your organization and securing your place at the forefront of innovation. This talk will explore how organizations can move from awareness to execution with a structured approach to assessing risk, planning migration, and securing the organization for the quantum era.

Going Dark: Making MCP Servers and LLM Endpoints Unreachable to Everything Except an Authorized Agent

Galeal Zino

1. A reproducible pattern for making any MCP server or LLM endpoint unreachable until an authenticated, authorized identity connects, built entirely on open-source tooling you can pull the same day. 2. A working mental model for why moving authorization before reachability shrinks the attack surface that scanners, tool-poisoning attacks, and stolen API keys all depend on. 3. The failure mode that matters: why a revoked identity killing a call for lack of a path is architecturally different from a rejected credential, and why that difference changes the exploitation math. 4. An honest map of the trade-offs — what going dark defends against (exposure, discovery, lateral movement, secret sprawl), what it does not (a compromised authorized agent, prompt injection inside an authorized session), and where the added plumbing costs you. 5. The war-story version: what actually broke while building the demo, and what those failures taught me about the pattern's real edges.

I own your "internal" domain… Weaponizing name collisions at scale

Philippe Caturegli

What happens when your internal domain name is actually registered and operated by someone else? You start leaking credentials, email gets misrouted, deployment pipelines pull code from untrusted places, and most of the time, you don’t even notice for years. With over 1,200 new TLDs introduced over the past decade, many organizations are unknowingly using internal domain names that now exist as valid, publicly registrable FQDNs that they don’t own and never thought to claim. Name collision itself is not new. It has been documented as a theoretical risk since 2013. But no one has studied it at scale, or answered simpler questions: how could threat actors identify a potential collision and what would be the impact if they claimed a colliding domain and operated it? We analyzed nearly 39 million SSL certificates and over 9.5 million services to surface internal names leaking onto the public internet, found more than 92,000 colliding domains that nobody had registered. We then decided to claim 200 of them. Over two years, those domains passively recorded more than 11 billion DNS requests. And when we started answering some of those queries, web requests, email, credentials, auth tokens, build artifacts and much more started flowing in. The affected organizations ranged from police departments and airports to Fortune 500 companies, enterprise software vendors, and critical infrastructure. We’ll walk through how these collisions were discovered, what happened after claiming the domains, why organizations kept leaking data for months/years, and what happened when we tried to report it. Between radio silence and legal threats, the disclosure process turned out to be almost as revealing as the technical findings themselves.

The Truth, The Whole Truth and Nothing but the Truth About Cybersecurity

Dr. Louis DeWeaver

• If they have drunk the Kool-Aid aka have they fallen victim to cybersecurity misconceptions and lies. • Why technology is the real problem. • Why zero trust is the only way.

The Coverage Failure in Autonomous Pentesting

Yacine Souam

• Harnessing AI to actually have coverage during an AI pentest. • The difference between a run that looks like a pentest and one that is one: how to tell them apart when the output is a plausible-looking report either way. • What it takes to trust the findings: verification and multi-user execution as design requirements.

32 Submitted, 2 Accepted: The Six Gates That Kill a Vulnerability Report

Kartik Ganesh

1. A taxonomy of the most common reasons vulnerability reports get closed, with real examples rather than hypotheticals. 2. Six gate-questions that disqualify a non-finding in under a minute. 3. The single property shared by findings that actually get accepted: a control that is supposed to block the attack, shown to be bypassable. 4. A defender-side application: triaging inbound reports faster by pattern-matching the same noise. 5. The case for publishing your failure rate: honest post-mortems make you a sharper researcher than a highlight reel does.

The Cyber Vortex: The 99% Challenge

Peter Galanis

Cyber risk doesn’t flow in one direction. It is a vortex: the weakest parts of our digital ecosystem absorb attacks, amplify them, and send them back at everyone. What if the best way to protect the fortified few is to build a stronger foundation for everyone? The Cyber Vortex challenges the way we think about systemic cyber risk and the industry’s reliance on more tools, more talent, and more questionnaires. Peter Galanis will show why the exposed base of the economy affects every organization, how AI is accelerating the cycle, and how a standardized, continuously verified foundation can make every security investment we already own work better.

AfterFuse Networking Social

Where the RBLN community comes alive—connect, converse, and build what’s next with the people driving the industry forward. AfterFuse is a high-energy night to unwind, connect, and keep the momentum going with attendees, exhibitors, and speakers. Food and drinks will be provided.

Theme: Operating Under Pressure

Security teams are being asked to move faster, do more, and defend against threats that are becoming harder to predict. Day Two at RBLN West looks at what it takes to operate under pressure, from AI and automation to resilience, compliance, and the realities of keeping critical systems secure in production.

Coffee and Networking

Underground Exhibits

Open all day. Think less trade show, more operator playground. The RBLN Underground brings together cutting-edge companies, interactive experiences, and the technology driving the next wave of disruption.

How to Survive the Future

Corey White

•The attacker’s playbook: how AI and emerging tech are being weaponized right now •The quantum timeline: when current encryption breaks and what it means for every industry •Why “detect and respond” is losing to “predict and prevent” •A survival framework: five things every organization must do in the next 18 months

Hacking the Human, 2026 Edition

Donovan Farrow

Hacking the Human, 2026 Edition examines how cybercriminals exploit human behavior through social engineering, physical intrusion, vishing, phishing, MFA fatigue, and AI-powered deception. Using real-world (video/audio) breach examples and penetration testing experiences, the presentation demonstrates how attackers manipulate trust and urgency to bypass security controls, emphasizing that awareness, verification, and skepticism are critical defenses in today's AI-driven threat landscape.

Break and Networking

The Risk of Yes- Security, Regulation, Compliance and AI

E.J. Hilbert

•AI is not thinking it’s a tool with a series of If-Thens •AI is not taught, it is instructed •Regulations are not specifics •Compliance is subjective •Security is the data holder’s responsibility •Those welding the tool are responsible for the tool •Addressing the concerns of AI use hinge on when we say “Yes” not when we say “No”

Pressure Tested By AI: When "Just Be More Resilient" Isn't the Answer

Dr. Susan Bernstein

Networking Lunch

Take a break, grab some lunch, and connect with fellow attendees, speakers, and sponsors. This is a casual networking lunch designed to keep conversations going and create new connections across the community. Visit the exhibit area while you’re here and take time to engage with our partners.

Startup & Community Conversation: Scaling Under Pressure

Clara Gustafson,Justin Somaini,Aditya Singh,Jennifer Schulze

What does it really take to scale a startup? Join our panel for a candid conversation on moving from early traction to enterprise adoption, breaking into new markets, and navigating the challenges that come with growth. Built for early-stage founders and startups, this session goes beyond advice from the stage. Five startups will each have five minutes to share what they’re building. One by one, founders will take the stage to present their ideas and get real-time feedback from our panel as well as audience members. Part of our Systems Under Pressure theme, this session is designed to challenge ideas, spark new perspectives, and help founders make connections that move their businesses forward.

Break and Networking

Technical Tracks

Three tracks digging into the technologies, attacks, and failures shaping what comes next. •AI, Agents & the Future of Computing: Salon A Explore how AI and autonomous agents are changing the way we build, operate, and secure systems, and what happens when these technologies move into production. •Vulnerability Research & Offensive Security: Salon B Get into the latest vulnerabilities, attack techniques, and offensive approaches being used to find and exploit weaknesses before attackers do. •Systems, Failure & Resilience: Salon C Look at what happens when systems fail, how organizations respond under pressure, and what it takes to build infrastructure that can withstand disruption.

The Hidden Data Plane of AI Coding Agents: Sidecar Exfiltration Beyond the Permission Prompt

Bajram Hoxha

This talk explores the hidden data paths of AI coding agents, including background services, telemetry, indexing, and sidecar processes.

Fooling Coding Agents for Fun and Profit: Security Risks in the Age of Autonomous Development

Jack Cable

A few weeks ago we set out to answer an uncomfortable question about the tools we (and most of our customers) now depend on every day: if someone hands a coding agent a plausible-looking task that quietly points it at malicious code, will the agent run it? Across nearly every coding agent we tested, it did. The trigger wasn't an exotic exploit chain; it was a support ticket any attacker could file. We got frontier-model agents to clone an untrusted repository, execute an attacker-controlled binary, and exfiltrate live secrets out of their "trusted" environments, several of them while running on their vendors' own recommended, safe-by-default settings.

State-Sponsored Actors Are Already Inside Our Grid, and We Still Don't Know What's Plugged In

Chris Gawlik

In February 2024, CISA, NSA, and the FBI confirmed something that once sounded like speculation: PRC state-sponsored actors, tracked as Volt Typhoon, had compromised and maintained persistent access inside U.S. critical infrastructure networks across energy, water, transportation, and communications. The objective wasn’t data theft. It was pre-positioning for potentially disruptive or destructive attacks in the event of a major crisis or conflict with the United States. How real is the threat? What does it mean for the OT industry? And, more importantly, what can operators do about it now?

Forkable Sandboxes: The Runtime Layer for AI Software Factories

Yossi Eliaz

1. Coding agent reliability is mostly a runtime problem that lives underneath the prompt. 2. Concrete isolation and snapshot patterns that contain a misbehaving agent run. 3. How cache design changes once agents, not humans, are the ones triggering builds.

Your SOC Has an AI Problem. It Just Doesn't Know It Yet.

John Stauffacher

Artificial Intelligence is going to revolutionize the Security Operations Center. At least, that's what every vendor pitch deck, conference keynote, and suspiciously enthusiastic LinkedIn post keeps telling us. But what happens when the marketing stops and AI has to survive inside an actual enterprise SOC? In this session, we're cutting through the hype and examining what happens when AI meets the messy reality of security operations: incomplete telemetry, noisy detections, complex environments, overwhelmed analysts, and attackers who don't follow the script. Using real-world enterprise examples, we'll explore where AI genuinely delivers value, from accelerating investigations and enriching threat intelligence to improving detection engineering, automating repetitive workflows, and helping analysts make sense of mountains of data. Then we'll examine where it falls apart. We'll dig into hallucinations, misplaced confidence, missing context, unreliable conclusions, and the very real risks of allowing probabilistic systems to make decisions in environments where being confidently wrong can have serious consequences. More importantly, we'll discuss how to distinguish practical AI capabilities from expensive demonstrations, how to measure whether these tools are actually improving security outcomes, and where human judgment remains nonnegotiable. This isn't another presentation about how AI will replace your SOC analysts. It's a practical examination of what happens when you put AI to work alongside them. No magic. No vendor fairy tales. Just what works, what breaks, and what we've learned along the way.

Bias in Generative AI — When AI Learns Our Worst Habits

Purvi Joshi

How training data perpetuates gender and representation biases in AI systems. Real-world examples of biased outputs in image generation and language models. Practical approaches to detecting and mitigating bias using explainability tools like SHAP and LIME. Takeaways on building more equitable AI systems.

Tokens Are the New Gift Cards: Residential Proxies, AI Agents and the Underground Market for AI Access

Nishith Lakhnotra

Imagine someone who could answer any question you asked, and all they wanted in return was a token. Now imagine someone copying your tokens and selling them for two cents on the dollar. That's happening to AI inference right now: in one incident, stolen AI keys ran up nearly $1 million in charges before anyone caught it. The thieves reach you through the same home internet connections as your customers and as the AI shopping agents you want to let in. So how do you tell an agent from a thief? Volume won't tell you: attackers spread themselves thin across millions of home IPs, and legitimate agents generate traffic by the million. What gives automation away is the gap between what it claims to be and how it behaves. In our data, attack traffic claiming to be ordinary consumers drew on the wrong mix of ISPs, and Meta's shopping agent looked like Chrome but didn't update like it. Fingerprinting finds those gaps. Intent decides what to do about them: failed logins, or spending the moment an account exists. The agents worth welcoming will increasingly prove who they are instead of hiding.

Moving Left and Right of Bang! SECOPS in the Age of AI

David Swift

The Therac-25 Affair

Sean Satterlee

Full of war stories from previous medical device penetration tests, some best practices conveyed to testers and coders as well as designers/engineers, and a Post-Mortem of the entire event including all three patients that died and the 3 other injuries that were sustained while this device was in operation.