OWASP 25th Anniversary Virtual Conference (September)

Operational Technology (OT) environments face a critical paradox: sophisticated attacks like TRITON, CRASHOVERRIDE, and INCONTROLLER routinely target multiple facilities, yet operators remain blind to cross-site attack patterns due to strict privacy regulations, competitive secrecy, and an inherent lack of trust. The current "share after detection" model—where threat intelligence is exchanged only after a breach is confirmed—creates a deadly information asymmetry. Attackers see the entire battlefield, while defenders fight isolated skirmishes.

This talk introduces a cryptographic framework that flips this paradigm to "share to detect." Aligned with OWASP's focus on Privacy Controls and IoT/OT Threat Intelligence, this session will demonstrate how multiple OT sites (refineries, power plants, water utilities) can collaboratively identify globally significant threats before individual sites recognize them as localized attacks. Crucially, this is achieved without exposing sensitive operational data, process telemetry, or revealing which facility discovered the threat.

By deploying autonomous "hunter agents" at historian databases and SCADA systems, the proposed architecture leverages commutative encryption and secure multi-party computation (SMC). It safely answers the question: "Is this anomalous PLC behavior a coordinated, industry-wide attack?"

We will walk through a practical scenario demonstrating how an alliance of sites can collectively validate a suspicious Modbus command sequence. We will show how a weak signal—appearing at only 15% local prevalence—can be cryptographically verified as a global Indicator of Compromise (IoC) active across 87% of participating sites. This validation triggers an immediate, coordinated defense while mathematically guaranteeing that Site A never learns Site B's process parameters, alarm rates, or asset inventory.

Target Audience: Security architects, OT/ICS defenders, and threat hunters looking to implement privacy-preserving intelligence sharing without centralizing sensitive telemetry.

Attendees will learn:

The Pitfalls of Centralization: Why traditional, centralized threat intel sharing and data lakes fail in highly regulated OT environments (and the lessons learned from those failures).

Applied Cryptography for Blue Teams: A functional breakdown of the cryptographic primitives enabling "origin-anonymous" threat artifact exchange.

Practical Deployment: How to deploy autonomous threat-hunting agents directly within existing ICS historian infrastructure.

Measurable Impact: Real-world attack scenarios where cryptographic collaborative detection provides 10-100x faster response times.

As generative and agentic AI rapidly enters security workflows, practitioners face a difficult choice: leverage AI to enhance efficiency, or risk exposing sensitive data to systems that weren’t designed with security in mind. For me, as a security engineer and pentester, this challenge is especially important - pentesting often involve confidential data, proprietary code, and high-impact vulnerabilities that cannot leave controlled boundaries.

In this talk, I would like to share my own practical lessons learned from designing and deploying AI agents specifically for security testing use cases. When building your own agent for security testing purposes, you often face a lot of issues, related to privacy, data protection, efficiency and cost-optimization. In my talk we’ll explore how to build AI agents with strong guardrails from the ground up: isolating execution environments, minimizing data exposure, utilizing obfuscation practices without a negative impact on performance, implementing secure prompt handling, and enforcing strict boundaries between sensitive inputs and model interactions. I’ll also cover architectural patterns that enable safe augmentation of pentesting workflows without introducing new attack surfaces or compliance risks and what is more important, do not cost you an arm and a leg.

Attendees will gain insights from practical experience into how to safely integrate AI into daily workflows, whether they are building internal tools, experimenting with agentic systems, or securing AI-enabled applications. This session is designed for security professionals, developers, DevOps engineers and everyone who want to utilize the power of AI without turning it into a new source of security risks.

The goal is simple: build AI agents that work for you, not against you.

Every time we set up an MCP server, something felt off. Adding one is as simple as adding a JSON entry that points to a third-party process. Restart your client, and that server's outputs now flow directly into your agent's context — treated with the same trust as your own instructions. It can access whatever you've granted it — files, API tokens, tool outputs — with no verification that it's still the same code you originally approved. There are no signature checks, no permission reviews, and no clear way to know if what you installed today is still what's running next week.

That gap in trust is what this talk is about.

MCP servers are starting to show up everywhere as a way to extend AI agents with external tools. Unlike traditional plugins, they run inside the agent's workflow, which means they can see task context and credentials passed between tools.

Through live demos, we'll show two attack paths:

- A rogue server that looks legitimate from day one
- A remotely hosted server that operates correctly until a server-side update changes its behavior with no client notification and no re-authorization prompt

In both cases, nothing is "exploited" in the traditional sense. These attacks work because of the system's design. We demonstrate that the same malicious server is running in both Anthropic Claude Desktop and Visual Studio Code, showing this isn't tied to a single client but to a broader architectural issue.

You'll see how an attacker could exfiltrate sensitive data, access credentials, and observe or even influence multi-step agent workflows.

Then we'll walk through what you can actually do about it. That includes server allowlisting, version pinning, monitoring outbound connections from agent processes, auditing permissions, and treating MCP updates the same way you treat third-party code changes.

We'll close with a few things the ecosystem still needs to fix, such as signed updates, better visibility into permission changes, and stronger guarantees for plugin integrity.

Distributed systems increasingly face security and privacy risks as data flows across services without sufficient visibility or enforcement. Regulatory actions have highlighted how combining user data without informed consent can lead to exploitative outcomes, reinforcing the need for real-time, security-driven controls rather than retrospective audits. This session presents a privacy-aware infrastructure that embeds compliance and security enforcement directly into distributed architectures.

The framework uses Policy Zones and metadata-driven controls to segment data flows and enforce purpose limitations across services. Automated classification pipelines assign sensitivity attributes at ingestion, enabling consistent enforcement as data moves through systems. Template-based policies and simplified APIs support scalable implementation while maintaining strong governance controls.

Machine learning techniques enhance detection capabilities by classifying sensitive data, identifying cross-service violations, and detecting anomalous patterns in data movement. Methods such as entity recognition, clustering, and temporal anomaly detection enable continuous monitoring of complex, distributed environments.

A provenance-aware auditing layer provides traceability of data lineage and processing history, supporting verification and forensic analysis. These controls help prevent unauthorized data combinations and ensure that usage aligns with declared purposes across system boundaries.

The session also examines enforcement across microservices and multi-jurisdiction deployments, highlighting patterns that strengthen system security while maintaining compliance. This approach provides a practical blueprint for building secure, privacy-aware distributed systems aligned with modern application security principles.

Your AI agent works great in the demo. Then you deploy it and it hallucinates a refund policy that costs you $10K, or exposes customer data, or just loops endlessly burning tokens.

This session explores how to build AI agents you can trust in production using Amazon Bedrock AgentCore and the Strands Agents SDK.

We’ll walk through a layered approach to agent safety that spans guardrails at multiple levels, including input validation, output filtering, and action approval, along with observability patterns that make agent behavior transparent and auditable.

You’ll also see how multi-agent architectures can be designed so agents steer and check one another, and how security policies combined with deliberate prompt design reduce risk across the system.

We'll walk through a reference architecture that combines these layers, and you'll learn how each layer can catch failures.

You should have basic familiarity with LLMs and AI agents. You'll leave with architectures pattern you can adapt and a clearer picture of what can go wrong and how to address common issues with AI agent trust and reliability.