This fast-paced 4-day course will make students familiar with reverse engineering Linux malware, starting off with a dense walk through of Linux OS internals and Linux binary analysis techniques, before jumping right in with common Linux malware. Quickly we'll work our way to advanced samples, targeted malware, Linux software protection techniques and packers. We will cover Go malware, Rust, and C++ samples, and explore recent rootkits targeting Linux.

The TEEPwn experience takes an offensive perspective and dives into the darker corners of TEE (Trusted Execution Environment) security. It’s designed with a system-level approach, where you will experience exploitation of powerful vulnerabilities specific for TEE technology. Moreover, it’s hands-on, well-guided and driven by an exciting jeopardy-style game format.

Join the esteemed senior security researcher and endpoint security engineer, as she takes you along a deep dive into the internals of the Windows 11 Operating System.

Covering Windows 11 “26H2”, the upcoming “27H1/2”, and Server 2025, you’ll unravel the secrets of how GRU bootkits, PLA software supply chain implants, NSA backdoors, and other kernel and firmware malware work. You’ll learn how they, and others, abuse various system functionality, obscure mechanisms, and data structures, in order to do their dirty work, and how you can too defend against it!

This is a four-day crash course in rapid prototyping for hardware hacking. You'll build upon the basics you already covered in an introductory hardware hacking course and will design and assemble, from scratch, multiple malicious hardware implants.

Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers from Jay Beale, who has led development of the Kubernetes CTF at DEF CON, Bastille Linux, the Center for Internet Security's first Linux security benchmark, and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters.

Modern reverse engineering increasingly relies on automation, custom tooling, and agent-assisted workflows. But these approaches quickly run into limits when binaries actively resist analysis through control-flow obfuscation, virtualization, mixed Boolean-Arithmetic, and other transformations. This training teaches the practical deobfuscation workflows needed to break such protections and to make automated reverse-engineering workflows effective on real-world targets.

The course will present an in-depth description of the techniques implemented in modern malware to evade defenders and security products (such as AV, IPS, IDS, EDR), and how attackers design and operate their implants in order to ensure a prompt redeployment after a detection or a public disclosure by researchers or security vendors.

This class is designed to introduce students to the most effective tools and techniques for applying cutting edge deep learning based artificial intelligence to cybersecurity tasks. By leveraging AI driven automation, students will explore new ways to enhance security workflows, improve threat detection, and optimize vulnerability research. We will take a deep dive into modern AI architectures, focusing on how deep learning models can assist in areas such as reverse engineering and vulnerability research. Students will learn to solve real world cybersecurity challenges, integrating AI driven solutions into their daily operations. The course will provide hands-on experience with advanced agent driven security automation techniques. Through practical exercises, students will gain proficiency in using AI to automate security tasks. By the end of the course, attendees will have the skills and knowledge to incorporate deep learning based AI solutions into their cybersecurity workflows, enhancing both efficiency and effectiveness.

Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers from Jay Beale, who has led development of the Kubernetes CTF at DEF CON, Bastille Linux, the Center for Internet Security's first Linux security benchmark, and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters.

Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers from Jay Beale, who has led development of the Kubernetes CTF at DEF CON, Bastille Linux, the Center for Internet Security's first Linux security benchmark, and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters.

Reverse engineering can have a brutal on-ramp. Binary Curious makes it more approachable. In this two-day, hands-on course, students use Ghidra together with hosted and local AI to explore unfamiliar software, make sense of decompiled code, recover useful names and structure, follow significant behavior, compare related code with BSim, and verify AI-generated claims against actual program evidence. The course is designed for security practitioners who understand basic programming concepts but do not need years of reverse-engineering experience. Students work in individual lab environments and finish by applying the complete workflow to a mystery binary and producing an evidence-supported technical assessment.

LLMs and classic SAST both find real bugs in your code. They also both produce noise, and they miss different things. This training is about building a pipeline that gets more out of each.

We start with why simple prompting underdelivers, then take SAST apart (sources, sinks, taint propagation) so you know where it misses and why. From there: using LLMs to improve SAST output, using context to improve LLM-driven scanning, and combining the two.

Then the hard part: cutting false positives with existing test frameworks, fuzzing harnesses, live test systems, and skeptical triage against source alone. We finish with remediation.

By the end of the training, you'll leave with a working pipeline design you can adapt to your own codebase and toolchain, not just a mental model of the ideas.