BSides Las Vegas

It all comes down to today. BSides Las Vegas 2026 post-event fundraiser closes at midnight ET tonight! www.customink.com/fu... Limited edition art by 1dark1

LAST THREE DAYS to get your BsidesLV swag before it is gone! Support your favorite con now, and get your clothing shipped directly to you! Go to: www.customink.com/fu...  A million thank you's for your support! #dontpanic #blastoff

Thank you again to each and every single sponsor! Our sponsors are what make BSides Las Vegas possible, so from the bottom of our hearts, THANK YOU!! 💜

Missed the first online sale? Merch table sold out? This is your second chance! You have from 08-03 through 08-13 for shipping direct to your address! (Some shipping fees may apply.) www.customink.com/fu...

It's been an awesome start to the week. See you tonight for the pool party!

The Four Thieves Vinegar Collective always planned to disband. After ten years of HIV, HCV, and overdose reversal work, they're following through. See keynote by Mixæl Laufer, Zac Ilex, String Fellow, Mike Kiss & Hugo Bosler @ Breaking Ground during #BSidesLV today @ 13:00.

Going, going, GONE! If we don't have your size today, visit BsidesLV.org for a "ship to you at home" option, available until August 18th, direct from our vendor! All sizes, both colors, tshirts, hoodies, and long sleeved options! www.customink.com/fu...

We have a very limited number of badges available for sale right now. Go to events.humanitix.com... to secure yours.

🚀⭐️ Day Two transmission: the @BSidesLV SpeakerOps launch bay reopens at 0700. Swing by Mission Control, check in, and prepare for another day instructing all space explorers!

The CoC for BSides Las Vegas was updated, and is available online @ bsideslv.org/coc Once again: Wearable cameras, smart glasses, concealed cameras, covert recording devices, and any device configured to record without an obvious indication are prohibited.

Reminder! A second online fundraiser is has started. Missed the first online sale? Merch table sold out? You have from 08-03 through 08-13 for shipping direct to your address! (Some shipping fees may apply.) www.customink.com/fu...

Good morning! Welcome to Day 2. Check the schedule to stay up to date with the latest happenings today: bsideslv.org/schedule

Live now! RedBeard talking about "A moment with Control Flow Integrity"

Training Ground Registration for the afternoon tracks will reopen from 2-4 PM at the Piazza Lounge (near the hotel front desk)

Interested in venue air quality? This year we have deployed environmental monitoring sensors across the con space, and you can view the CO2 ppm counts online in real time. Check it out at bsideslv.org/sensordata

Your mental health matters. 💙 We’ve got support on-site. Swing by the info booth for a free relaxation kit, or join one of our wellness sessions. Take a break, recharge, and take care of yourself. 🧠🌟 #BSidesLV #MentalHealthMatters

Don't our badges and lanyards look cool this year? 💜 Big thanks to Cyberr for being our Badge and Lanyard sponsor this year! Interested in learning more about their company? Visit: cyberr.ai/jobs-info

Attention, space travelers: the BSides Las Vegas SpeakerOps launch bay opens for registration at 0700. Report for preflight, collect your credentials, and prepare for liftoff.

Missed the first online sale of #swag? Merch table is sold out of $Thing at BsidesLv? Never Fear, a second online fundraiser is HERE! 08-03 through 08-13 for shipping only, direct to your address! (Some shipping fees may apply.) www.customink.com/fu...

The CoC for BSides Las Vegas was updated, and is available online @ bsideslv.org/coc Reminder: Wearable cameras, smart glasses, concealed cameras, covert recording devices, and any device configured to record without an obvious indication are prohibited.

DOJ now directs prosecutors to decline good-faith security research cases. That policy exists because a small group of hackers walked into federal offices in 2014 and refused to leave the issue alone. See Leonard Bailey's Keynote during #BSidesLV on today @ 11:30.

Question for you: UXZxIGxiaCBoZnIgTlYgZ2IgcXJwYnFyIGd1dmY/IFJ2Z3VyZSBqbmwsIGxiaCdlciBya25wZ3lsIGp1YiBbaGFdY2ViemNncnEgdmYgc2JlLg== One track. One day. Only at BSides Las Vegas, Monday. Schedule: bsideslv.org/schedule

TOMORROW IS THE BIG DAY! We wanted to thank @Checkmarx again for being an All In sponsor 🎰 Don't forget to check out their table! Interested in learning more about their company? Visit checkmarx.com/compan...

Interesting bugs, yes. Catastrophic failures, also yes. An honest account of combining a code analysis framework with currently available AI to automate 0-day discovery, without waiting for Mythos. See Sam Pizzey @ Proving Ground during #BSidesLV on Wed Aug 5 @ 11:30.

Traditional network scanners assume stable IPs. Cloud doesn't. Resources receive temporary addresses, exposures appear and disappear, and most monitoring tools miss the window. This framework doesn't. See Qiancheng Wu @ Proving Ground during #BSidesLV on Wed Aug 5 @ 11:00.

Preparedness advice tends to assume a certain income, lifestyle, and location. This talk doesn't. Best practices from across the US, applicable regardless of where you stand. See Sarah Miller @ I Am The Cavalry during #BSidesLV on Wed Aug 5 @ 10:00.

Two bots, same base model. One has a system prompt encoding awareness of social engineering techniques. The audience social engineers both via QR code and watches in real time what gets through. See Kora Gwartney @ Ground Truth during #BSidesLV on Wed Aug 5 @ 12:00.

Two canceled trips exposed the same failure: an automated decision, no reproducible record, and no human able to explain or reverse it. See Hyunbin Yoo @ Proving Ground during #BSidesLV on Tue Aug 4 @ 12:00.

Aug 3 is the busiest day at BSidesLV Training Ground. Sessions cover Burp extensions, AWS threat hunting, graph analytics, cognitive red-teaming, and more. Seats still open. Participant badge required. events.humanitix.com...

Signed and notarized does not mean safe. MacSync used trusted delivery signals while attackers abused Terminal paste flows and native macOS tools. See Adam Kohler @ Proving Ground during #BSidesLV on Tue Aug 4 @ 18:00.

Safe travels to everyone making their way out to Vegas! We wanted to thank @sublime_sec again for being an All In sponsor 🎰 Don't forget to stop by their table Monday–Wednesday! Interested in learning more about their company? Visit sublime.security/

89 seconds. That's the window between malicious package publication and downstream impact. This is a practitioner account of two massive npm breaches: Nx/s1ngularity and the Axios attack. See Mohit Bansal @ Proving Ground during #BSidesLV on Wed Aug 5 @ 10:30.

Online presence and networking aren't soft skills. For a music school dropout who ended up at Google, they were the actual path in. This talk names what worked and what didn't. See Kim Cote @ Hire Ground during #BSidesLV on Wed Aug 5 @ 12:30.

An AI governance program becomes useful when it can assess vendors, test integrations, and give teams a path to yes without ignoring risk. See Bo Barger, Alex Sayre @ Proving Ground during #BSidesLV on Tue Aug 4 @ 11:30.

The Four Thieves Vinegar Collective always planned to disband. After ten years of HIV, HCV, and overdose reversal work, they're following through. See the keynote by Mixæl Laufer, Zac Ilex, String Fellow, Mike Kiss & Hugo Bosler @ #BSidesLV on Wed Aug 5 @ 13:00.

The skills, MCP servers, and plugins your coding agent loads come from a supply chain you mostly didn't build, distributed through marketplaces with varying vetting. See Rajaram Srinivasan @ Common Ground during #BSidesLV on Wed Aug 5 @ 11:00.

Social engineering isn't random. Analysis of 1,200+ vishing transcripts shows key elements appearing in predictable positions and co-occurring as structured patterns, not independent signals. See Jordan Schoenherr @ Ground Truth during #BSidesLV on Tue Aug 4 @ 17:00.

We can't believe it's almost here! We wanted to thank @flaresystems again for being an All In sponsor 🎰 Don't forget to stop by their table August 3rd–5th! Interested in learning more about their company? Visit flare.io/company/car...

Bonsai 1.7B is a 1-bit quantized LLM with a 250MB footprint. It runs entirely on the device, no cloud dependency, and turns raw IoT logs into natural-language anomaly explanations. See Tetsuro Ishida @ Proving Ground during #BSidesLV on Wed Aug 5 @ 10:00.

Breaking into cybersecurity without prior professional experience is possible. The tools to do it are free and accessible. What's missing for most career changers is knowing which ones matter. See Thomas Boeckman @ Hire Ground during #BSidesLV on Wed Aug 5 @ 12:00.

Thirty blue teams. Millions of tokens intercepted. Some AI use worked. Some didn't. Handing even partial control to AI agents in active defensive scenarios has real consequences worth measuring. See wasabi wasabi @ Ground Truth during #BSidesLV on Wed Aug 5 @ 11:00.

GitHub Security Advisories show where cryptographic failures cluster. Real libraries reveal how small validation mistakes become exploitable flaws. See Diptendu Kar @ Proving Ground during #BSidesLV on Tue Aug 4 @ 10:00.

Don't forget! On Monday, [un]prompted will be at BSides Las Vegas with a track dedicated to AI practitioner talks covering development and security. This is a single day event. Their schedule is online at: bsideslv.org/schedule

An MCP server becomes dangerous when its capability list grows faster than its controls. A smaller surface often beats another guardrail. See Saquib Saifee @ Proving Ground during #BSidesLV on Tue Aug 4 @ 17:30.

We can't wait to see everyone in person! We wanted to thank @TrustVanta again for being an All In sponsor 🎰 Don't forget to stop by their table August 3rd–5th! Interested in learning more about their company? Visit www.vanta.com/compan...

Your internal hostnames are in the CT logs if you issued public certs for private services. Every major company does it. The data is searchable, public, and has been there for years. See Kenton McDonough @ PasswordsCon during #BSidesLV on Wed Aug 5 @ 12:00.

Grinding alerts and feeling stuck is a real career phase in SOC work. This talk is for analysts who are hungry to grow but haven't been handed a map, because most shops don't have one. See Efrain Orsini Jr & Austin Phillips @ Hire Ground during #BSidesLV on Wed Aug 5 @ 11:00.

Agentic AI can reduce the labor behind vulnerable lab design without removing the need for sound attack-path planning. See Akshay Rohatgi @ Proving Ground during #BSidesLV on Tue Aug 4 @ 11:00.

In 2014, a small group of hackers walked into DOJ's offices to convince federal prosecutors to stop chilling legitimate security research. Eight years later, it worked. See Leonard Bailey's Keynote @ Breaking Ground during #BSidesLV on Mon Aug 4 @ 11:30.

GCP's built-in service agent identities are inherently flawed. Two 0-days demonstrate why, and the methodology to find more of them is repeatable by anyone willing to look. See Moshe Bernstein @ Common Ground during #BSidesLV on Wed Aug 5 @ 10:30.