CLOUD VILLAGE @ DEF CON 34 7th Aug - 9th Aug 2026

Cloud Village is an open space to meet folks interested in offensive and defensive aspects of cloud security.

ABOUT

Cloud village is an open space to meet folks interested in offensive and defensive aspects of cloud security. The village is home to various activities like talks, workshops, CTFs and discussions targeted around cloud services.

If you are a professional who is looking to gain knowledge on securely maintaining the cloud stack and loves to be around like-minded security folks who share the similar zeal towards the community, Cloud Village is the perfect place for you.

Cloud Village will be in-person at DEF CON 34, Las Vegas Convention Center from 7th August to 9th August 2026

Hope to see you all there!

Speaker Schedule

💡 Talks: 18 | ⚡️ Lightning Talks: 2 | 🔨 Tool Demos: 5 | 🎙️ Panels: 4

10:00-10:10

Opening note

+

Kick off to the DEF CON 34 journey.

10:10-10:50

💡 Talk: Seth Art
New AWS IAM Attack Paths and the Framework to Exploit Them

+

Speaker: Seth Art

Abstract:

In cloud environments, the path from low-privilege foothold to full account takeover often runs through IAM privilege escalation. This talk introduces over a dozen newly discovered escalation paths spanning services that have never appeared in public research: AWS Batch, Amazon Braket, Amazon Managed Apache Flink, Amazon GameLift, Health Omics, and more.

We'll walk through exploiting the most interesting paths in depth, including cross-account variants and attacks that require delivering malicious code payloads to trigger escalation. Then we'll introduce Pathrunner, a new open-source Metasploit-style framework built specifically for IAM privilege escalation, and show how it makes chaining these complex, multi-hop attacks practical during a real engagement.

Speaker Bio:

Seth Art is a Security Researcher & Advocate at Datadog. Prior to joining Datadog, Seth created and led the Cloud Penetration Testing practice at Bishop Fox. He is the author of pathfinding.cloud, an AWS IAM privilege escalation library, and has published many open source tools including Pathfinding-labs, IAMVulnerable, BadPods, and CloudFoxable, and is the co-creator of the popular cloud penetration testing tool, CloudFox.

10:50-11:30

💡 Talk: Elzer Pineda & Jose Rivas
Tokens and PRT: Advanced Attacks and Persistence in Microsoft Entra ID

+

Speakers: Elzer Pineda & Jose Rivas

Abstract:

Is MFA and Conditional Access a real security guarantee? In this technical session, we will demonstrate how endpoint compromise allows an attacker to bypass traditional identity barriers in the cloud. The talk focuses on exploiting vulnerabilities in Microsoft Entra ID, breaking down an advanced attack chain:

• Device Code Flow: Abuse of authentication flows for initial access (Demo with Entraith).

• PowerShell Hijacking: Process interception to obtain session tokens (GrabTokenAzureAD).

• Sliver BOF Extraction: Use of Beacon Object Files (BOF) for stealthy exfiltration of tokens and the Primary Refresh Token (PRT) from memory, evading anti-malware defenses.

• MFA Bypass and Intune: Custom tools were developed to extract local PRTs, bypass Intune device management controls, and circumvent MFA. The entire process was automated through the open-source tool https://github.com/bl4cksku11/entraith, enabling attacks via device code flow, token renewal, email and app inspection, token exfiltration, and persistence generation.

Speaker Bio(s):

Elzer Pineda

Regional Pentester and Cybersecurity Consultant, Elzer Pineda is an active member of the Red Team executing strategic consulting projects and advanced penetration testing engagements. His career has been focused on Threat Research for private and government organizations across the region. He is a Dojo Community Ambassador and Professor at the Universidad Tecnológica de Panamá (UTP). His experience has taken him to share technical research at Ekoparty, BSides Latam Peru, BSides Panamá, DOJOConf, PwnedCR, and OWASP Latam. Offensive security certifications: OSWE, OSEP, OSCP, OSWP, CRTP, CRTO, and CRTL.

Jose Rivas

Jose Rivas is an Offensive Security Researcher and Red Team Operator at A-LIGN, specializing in adversarial simulations, Active Directory attack paths, and physical security assessments. Co-founder of Zero Trust Offsec, an offensive security research group focused on vulnerability exploitation, emerging attack techniques, and responsible disclosure, and Founder of DCG Panama, Panama's first official DEF CON chapter, where he leads a community dedicated to red team operations, and adversarial tradecraft. A recognized voice in the Panamanian security community, Jose has spoken at BSides Colombia, BSides Panama, OWASP Panama, and DOJOConf. With certifications including CRTO, eWPT, eCPPT, and CompTIA PenTest+, he brings a threat-actor mindset and a strong commitment to advancing offensive security knowledge across the region.

11:30-12:10

💡 Talk: Saksham Agrawal
From Pipeline to Cloud Control

+

Speaker: Saksham Agrawal

Abstract:

Azure DevOps service connections are a core part of modern pipelines, allowing teams to interact with Azure and other external systems seamlessly. While they make deployments faster and easier, they also introduce an attack surface that is often overlooked in real-world environments.

In this research, we explore new attack paths showing how even limited access within Azure DevOps pipelines can be leveraged to escalate privileges and compromise cloud environments. By taking advantage of over-scoped service connections and certain platform behaviors, an attacker can chain together small gaps to achieve significant impact, including gaining subscription-level access.

These findings were reported to Microsoft and acknowledged through MSRC, highlighting a deeper issue in how DevOps integrations are secured. Rather than being just a configuration problem, this reflects a broader gap that organizations need to understand when designing their cloud security approach.

Speaker Bio:

Saksham Agrawal is a Senior Security Consultant at NotSoSecure, specializing in AWS and Azure security. His work focuses on discovering new attack paths in cloud environments and helping organizations understand real-world risks. He enjoys building tools, exploring cloud internals, and sharing his findings with the security community.

12:10-12:50

💡 Talk: Pujita Sahni & Geoff Sweet
Security at Machine Speed: How Autonomous AI Agents Are Changing Cloud Defense

+

Sponsored by: AWS

Speakers: Pujita Sahni & Geoff Sweet

Abstract:

Attackers are using frontier AI to compress the time between finding a vulnerability and exploiting it. Manual triage and human-in-the-loop remediation cannot keep pace. The answer is autonomous security that works at machine speed.

This talk covers the continuous AI-powered security loop and how autonomous agents are changing three SOC functions:

Autonomous triage. Agentic AI systems trained on real security decisions separate real threats from noise with high accuracy, reasoning across logs, configurations, reachability, and history. What takes analysts hours, these systems handle in seconds.

Validated remediation. The latest AWS security enhancements discover vulnerabilities, validate exploitability in sandboxes, and fix confirmed exposures with increasing autonomy. We walk through the journey from human-approved fixes to fully autonomous remediation.

Continuous offensive testing. AI agents that proactively test your applications throughout the dev lifecycle instead of once a year. Customized pen testing across your whole environment. We show what this looks like when an AI chains attack paths across services in real time.

The full loop. Discovery feeds triage, triage feeds remediation, remediation closes the gap before attackers exploit it. Integrated through AWS Security Hub with the tools you already use.

Real demos. Real attack paths. Walk away knowing where this technology stands and what first steps look like.

Speaker Bio(s):

Pujita Sahni

Pujita Sahni is a Delivery Consultant specializing in cloud security, risk, and compliance at AWS. In her role, she is responsible for architecting IAM governance frameworks and security automation solutions that enable organizations to implement secure cloud migrations and shift security left within enterprise environments. She brings a broad technical background across identity and access management, vulnerability management, infrastructure-as-code security, and DevSecOps practices, providing a comprehensive view of how security platforms are built, automated, and maintained across enterprise cloud environments.

Geoff Sweet

Geoff Sweet has nearly 30 years of technology experience, starting from the late 90's during the dot-com boom. Geoff has worked in many verticals including Gaming, BioTech, Retail, and financial SaaS. He has held several titles through his career such as Systems Architect, Network Architect, and most recently Security Architect. These experiences have helped him to develop robust experiences in Infrastructure Security. Geoff left the customer side to come to AWS in December of 2019. He left SAP where he lead a small security team responsible for monitoring and doing Incident Response for nearly 10,000 cloud accounts over several cloud providers. Geoff has a proven record of speaking to customers in both small and large format settings. He is engaging, entertaining, and communicates in a way that assures everyone understands. Geoff's background is in Electrical Engineering and Mathematics and continues to use that knowledge to support his customers. He also has a deep fondness for all things automotive and extensive experience building and fabricating vintage cars.

12:50-13:20

🔨 Tool Demo: Ariz Soriano
PurpleLoop: Closing the Loop Between Detection Rules, Log Schemas, and Purple-Team Validation

+

Speaker: Ariz Soriano

Abstract:

The problem -

Sentinel deployments rot. Mid-market SOCs run 80 to 300 analytics rules, and a large share haven't fired a true positive in 90 days. Many reference tables or columns that don't exist in the tenant because the rule was copied from a Microsoft post written for a different topology. The public Azure-Sentinel repo ships new content weekly and almost nobody reconciles against it. One layer deeper, Log Analytics ingests 20 to 80 tables per tenant, and most teams have never audited which have any coverage and which are dark. And almost nobody validates that the rules they do have actually fire against the techniques they claim to cover.

What PurpleLoop is -

PurpleLoop is an LLM-augmented detection-engineering workflow built on one insight: rule authoring, coverage analysis, and purple-team validation are the same job, and they should be one tool. It does four things, none individually novel, never previously combined into one workflow:

- Reviews deployed rules by diffing against the live Azure-Sentinel repo and community libraries, flagging drift, dead operators, missing siblings.

- Suggests new rules from your actual workspace schema, not Microsoft's reference topology. A rule needing DeviceProcessEvents isn't suggested if MDE isn't onboarded.

- Generates purple-team scenarios and validates rules against them. The tool runs an atomic-style simulation, checks whether the rule fires, and patches the KQL if it doesn't. The loop closes itself.

- Builds a detection-gap map that distinguishes "no rule for this" from "no telemetry for this." Most coverage tools miss the second category.

Why an LLM? -

The LLM provides the connective reasoning between the pieces. It is not in the codegen path. PurpleLoop reasons in a Sigma-inspired intermediate detection representation (IDR), and a deterministic compiler renders to KQL. The queries that run on your workspace are produced by code we wrote, not by pattern completion. Hallucinated columns and invented operators are eliminated at the compiler boundary, not at the prompt boundary.

What attendees take home -

A working open-source tool installable in minutes, a reusable methodology not bound to Sentinel, and prompt-engineering patterns for security workflows where correctness matters. The talk argues the case, demos the tool live against a real tenant, and hands the code to the room.

Speaker Bio:

Ariz Soriano is a Senior Content Engineer at TryHackMe, where he creates advanced challenges revolving around red and blue teaming. He draws on nearly a decade of industry experience across Red Teaming, Penetration Testing, and Incident Response to turn the tradecraft he uses on live engagements into practical, interactive learning content.

His path through the field is what gives his content its edge. He started on the defensive side as a SOC analyst and IR lead before moving fully into offensive security, where he's spent the last five years red teaming. Most notably, he built the Red Team at Theos Cyber from the ground up, recruiting and training operators, designing red team infrastructure and tooling, and establishing the methodology and playbooks behind the team's APT simulation and purple teaming engagements. That dual perspective shows in his work: his offensive scenarios are grounded in how defenders actually detect and respond, and his blue team content reflects a real attacker's mindset.

At TryHackMe, he focuses on creating advanced challenges across topics like threat hunting, detection engineering, and penetration testing, translating complex techniques into hands-on rooms that teach by doing. Outside of his content work, Ariz is a conference speaker who is passionate about building red team tooling, optimizing offensive workflows, and sharing knowledge with the wider security community.

13:20-14:00

💡 Talk: David Fiser
The Hidden Cost of Agentic Connectivity

+

Sponsored by: TrendAI

Speaker: David Fiser

Abstract:

During our extensive research on MCP servers, we uncovered critical vulnerabilities that pose significant risks to the cloud infrastructure management. These vulnerabilities enable malicious actors to interact with and compromise organizational infrastructure. Alarmingly, while some MCP servers had implemented protective measures against such misuse, these measures were often flawed, allowing for trivial bypasses.

In this presentation, we will underscore the necessity of comprehensive visibility and robust policy guidelines for every organization. Our analysis of over 19,000 MCP servers reveals substantial gaps and vulnerabilities within the so-called security features of these systems. We will demonstrate how these security features can be bypassed and highlight the real-world implications of these vulnerabilities.

Through active scanning, we identified the same vulnerable MCP server implementations deployed in the wild, confirming that these vulnerabilities are actively exploitable. This underscores the urgent need for organizations to adopt a strategic approach to managing MCP servers.

Our aim is for attendees to understand th e critical importance of AI security beyond mere vulnerability management. Our findings show that even if the MCP server is not vulnerable, default deployments often introduce significant risks to organizational security. We will conclude our presentation by outlining best practices for mitigating the risks associated with MCP servers, ensuring that attendees leave with actionable insights to enhance their organization's security posture.

14:00-14:30

🔨 Tool Demo: Bleon "gl4ssesbo1" Proko
Nebula - 5 years, still kicking *aaS

+

Speaker: Bleon "gl4ssesbo1" Proko

Abstract:

Nebula is a cloud C2 Framework, which at the moment offers reconnaissance, enumeration, exploitation, post exploitation on AWS, but still working to allow testing other Cloud Providers and DevOps Components.

It started as a project to unify all Cloud + DevOps Pentest and Security Techniques for a better assessment of the Infrastructures. It is build with modules for each provider and each functionality. Initially released in April 2021 as a bulk of scripts, it developed into a C2 framework, managed through a teamserver, allowing a team of pentesters to authenticate and access the tool, as well as a MongoDB database to save the results into. Offers modules for reconnaissance, initial access, enumeration, Command and Control, post exploitation, persistence and cleanup in AWS, Azure Graph and Management API, DigitalOcean, as well as a new release for GCP and GWS, Kubernetes and defense bypasses.

Currently covers:

- Public Reconnaissance

- Phishing

- Brute-force and Password Spray

- Enumeration of internal resources after initial access

- Lateral Movement and Privilege Escalation

- Persistence

Ever since I pushed the last update, the tool has changed drastically. Now you will get a teamserver based tool, with a client and server split, authentication to access the tool, user management and a MongoDB database to save the results into.

Speaker Bio:

Bleon is an Info-sec passionate about Infrastructure Penetration Testing and Security, including Active Directory, Cloud (AWS, Azure, GCP, Digital Ocean), Hybrid Infrastructures, as well as Defense, Detection and Thread Hunting. He has presented topics related to Cloud Penetration Testing and Security in conferences like BlackHat USA, Europe and Sector, DEF CON, SANS Pentest Hackfest Hollywood and Amsterdam, as well as several BSides on USA and Europe.

His research include Nebula, a Cloud Penetration Testing Framework (https://github.com/gl4ssesbo1/Nebula) and other blogs, which you can also find on his blog (blog.pepperclipp.com). He is also the author of YetiHunter, DetentionDodger and Ransomwhen (https://github.com/Permiso-io-tools/[DetentionDodger | YetiHunter | Ransomwhen]).

14:30-15:10

🎙️ Panel:
Citizen Developers Can't Defend What They Built: Scaling Security Past the Security Team

+

Panelists: TBD

Description:

The operations, marketing, and finance staff shipping apps on low-code platforms and AI assistants are on track to outnumber your engineers four to one, and almost none of what they ship reaches a security review. When it fails, it fails wide: one default-public setting in Power Apps exposed 38 million records across 47 organizations. So how do they defend what they build, or do they? Push ownership outward with paved roads and policy-as-code, or wall off the blast radius and concede they never will? And when the citizen-built app is the breach, who answers: them, or you?

15:10-15:50

💡 Talk: Muskan Tomar
The Polymorphic Agent: From Cross Agent Escalation to Just in Time Defense on Azure

+

Speaker: Muskan Tomar

Abstract:

A permission error halts conventional malware. AI agents are being assigned standing cloud IAM permissions and the autonomy to use them, a combination that breaks an assumption every existing control depends on. The agent reasons its way to an escalation path through the cloud provider's own IAM APIs. We call this the polymorphic agent. This talk presents research cross-agent privilege escalation between independent AI agents & defense around it.

The attack begins with a single poisoned tool description, rewritten to read like routine compliance guidance. The agent parses the injected text, reasons about it, and grants itself elevated IAM roles. this showcases how a compromised Agent A modifies the role assignments of a separate Agent B, running a different framework in a seperate environment and never issued a malicious instruction, expanding Agent B's authority entirely through authorized IAM calls. This points directly to two risks named in the OWASP MCP Top 10: Privilege Escalation via Scope Creep (MCP02), achieved through Tool Poisoning (MCP03). To test whether this is agent-specific, we ran the attack across three production agents, including LangChain and Claude Code. All three escalated, the pattern is consistent: prompt-layer guardrails are reformable, human approval is socially engineer-able, and telemetry arrives too late.

These results frame two requirements for any workable defense: the escalation must be measurable in real time, and it must be blocked at a point the agent cannot reach. Enforcement has to move to the credential layer, since an agent cannot act on the cloud without first obtaining a credential. This is the gap PrivilegeGuard closes, an out-of-process credential gateway that intercepts DefaultAzureCredential and slots into existing agent deployments with minimal to no code change.

On each token request, it computes the requesting Non-Human Identity’s Blast Radius Score (BRS): the fraction of the cloud resource surface reachable by that identity across a two-hop IAM graph traversal, providers reachable under current role assignments plus those reachable after a simulated roleAssignments/write self-escalation. PrivilegeGuard evaluates BRS and its rate of change against an Open Policy Agent (Rego) policy and denies an anomalous, high-blast-radius request before the escalated role is usable.

The takeaway is architectural: cross-agent escalation follows from giving probabilistic, goal-driven agents standing IAM credentials, not from any single agent or framework, and it widens as agents gain access. We deliver the attack on real Azure identities, and an enforcement model that stops it where the agent cannot follow: the credential layer.

Speaker Bio:

I am Muskan Tomar, a Security and Reliability Engineer at MICROSOFT, where I work at the intersection of Site reliability, Infrastructure Security, and Software Engineering building systems that are expected to never go down, stay secure, and scale quietly in the background. 5X Microsoft Azure Certified , with experience working on architecting and modernising, securing cloud platforms and reducing operational toil through automation, AI and data driven engineering.

My independent research focuses on AI agent security and cloud identity, and how autonomous agents change the threat model for systems we trust to stay locked down. An enthusiastic learner who champions collaborative cloud and security research, I enjoy untangling complex systems and eliminating single points of failure. Outside work, I love to travel and paint.

15:50-16:10

⚡️ Lightning Talk: Gil Weizman & Tamir Yehuda
Go with the Flow: Riding GCP Dataflow Shadow Dependency to Cross-Tenant Compromise

+

Speakers: Gil Weizman & Tamir Yehuda

Abstract:

Cloud resources rely on a web of trust that most security teams ignore. Even if you secure access to a resource, you might miss its "shadow dependencies" - the external, system-generated resources required for it to function.

GCP Dataflow is just the latest in a long trail of vulnerable services suffering from this architectural blind spot. What we found is a fundamental flaw in how Dataflow blindly trusts dependencies located far outside its IAM control and security boundaries.

In this talk, we’ll present two novel attack techniques that weaponize unvalidated config files to hijack trusted data pipelines. We’ll also demonstrate a critical cross-tenant vulnerability that extends this issue by enabling manipulation of Dataflow orchestration across tenant boundaries. The issue remains under responsible disclosure and is expected to be fixed before the presentation.

Background: GCP Dataflow and Managed Infrastructure

Organizations running large-scale enterprise data workloads increasingly rely on managed data-processing services, especially GCP Dataflow. Built on Apache Beam, Dataflow executes unified data pipelines while removing much of the operational burden of provisioning cluster frameworks, tuning virtual machines, and scaling infrastructure in response to demand. Teams define the pipeline, and Dataflow provisions and scales the underlying compute resources automatically.

During this orchestration, however, Dataflow pipelines often depend on objects stored in standard cloud storage buckets to control execution, such as code, templates, and environment configuration.

Pipelines routinely ingest and execute files from cloud buckets, including JavaScript or Python User Defined Functions (UDFs) for runtime transformation, structured YAML job templates that define pipeline parameters, and other environment configuration files.

Because these files and their supporting temporary assets are often managed through automated developer pipelines, they can become "shadows": overlooked in routine asset inventories and security posture reviews, yet still critical to the execution of highly trusted cloud workflows.

Key Takeaways

Dismantling the shadow resources blind spot: Understand how automated cloud orchestration creates short-lived access windows that can evade scheduled security scans and routine asset inventories.

Auditing the infrastructure-as-config attack surface: Learn to treat external execution blueprints as active attack surfaces rather than passive configuration files.

Applying defensive best practices: Take away architectural recommendations for designing pipelines that are more resilient to these attack paths.

Session Details

Total duration: 20 minutes

5 minutes: Background on shadow resources and Dataflow mechanics.

10 minutes: Walkthrough of the attack paths and the cross-tenant vulnerability.

5 minutes: Research methodology, defensive takeaways, and detection strategies.

Speaker Bio(s):

Gil Weizman

Gil Weizman is an experienced security researcher with over ten years of expertise across on‑prem, cloud, web, and SaaS security. Gil focuses on threat detection, product security research, vulnerability research and identifying gaps in security visibility across modern environments. Gil specializes in translating real‑world attacker behavior into improved detection and mitigation strategies.

Tamir Yehuda

Tamir Yehuda is a Senior Security Researcher and cloud security team lead at Varonis. He is a full-stack hacker with experience in malware analysis, Windows & AD domains, SaaS applications, and cloud infrastructure. Tamir specialize in IaaS & PaaS research focusing mainly on Azure, GCP, AWS, Salesforce, and ServiceNow. He brings over eight years of experience in various types of security research and red teaming

16:10-16:50

🎙️ Panel:
The New Software Supply Chain Nobody is Securing: MCP

+

Panelists: TBD

Description:

MCP is the USB-C port for AI: one universal socket that lets an agent plug into your source, your SaaS, and the credentials on your developers' laptops. The threat model isn't the mystery anymore; OWASP and the NSA have written it down. The unsolved part is the one USB-C never fixed: what you let plug into the port, and what each thing's allowed to do once it's in. Plug in the wrong server and your own agent becomes the attacker. So what earns the right to connect and should MCP enforce that at the port, or is that on you?

16:50-17:30

💡 Talk: Aravind Sreekanth Pallavoor & Sadhana Sainarayanan
Trust Fall: How Agentic AI Inherits Your Cloud's Worst IAM Habits

+

Speakers: Aravind Sreekanth Pallavoor & Sadhana Sainarayanan

Abstract:

Cloud IAM was designed for two principals: humans and machines. In 2026, a third has arrived: the autonomous AI agent and it plays by neither rule book. AWS Bedrock Agents, LangChain-based orchestrators, and multi-agent pipelines are being deployed with execution roles scoped to whatever the deploying engineer thought was "good enough," inheriting the same over-privileged IAM patterns that have plagued cloud environments for a decade. The difference: agents don't just misuse permissions accidentally. When adversarial manipulations are done, they weaponize them with precision.

This talk dissects the threat model of agentic AI systems from an attacker's perspective with a clear-eyed look at how autonomous agents become cloud privilege escalation engines. Drawing from the OWASP Top 10 for Agentic Applications 2026, MITRE ATLAS, and real-world research including Sonrai Security's AgentCore privilege escalation path and Unit 42's confirmation of autonomous AI-driven cloud attacks, the talk walks through a complete attack chain: indirect prompt injection against an agent's context window → tool misuse via over-privileged Lambda execution roles → IAM policy modification → persistent backdoor creation — all without a single stolen credential.

Attendees will leave with a structured threat model mapped to MITRE ATLAS tactics, a dissection of what AWS CloudTrail catches versus what it silently misses during agent-driven attacks, a breakdown of the three OWASP agentic risks most directly applicable to AWS environments (Goal Hijack, Tool Misuse, Identity & Privilege Abuse), and concrete defensive controls including agent-scoped least-privilege IAM, Bedrock Guardrails limitations practitioners need to know, and human-in-the-loop architectural patterns.

Speaker Bio(s):

Aravind Pallavoor

Aravind Pallavoor is a cybersecurity practitioner with over five years of hands-on experience spanning application security, cloud security engineering, and offensive security research. He holds CISSP, CEH (v11), and AWS Certified Security – Specialty (SCS-C02) certifications alongside a Master of Science in Cybersecurity, Technology and Policy from The University of Texas at Dallas, where he graduated with a 3.82 GPA.

His offensive security background includes web application and API penetration testing, mobile application security, AI chatbot security assessments — including prompt injection and training data poisoning research — and cloud infrastructure security across AWS environments. He has conducted security assessments for global financial institutions and enterprise SaaS organizations, applying frameworks including OWASP, CVSS, MITRE ATT&CK, NIST, PCI DSS, and CIS Foundations.

On the cloud side, Aravind has directly architected and audited IAM environments, deployed and red-teamed compliance automation pipelines, and operationalized AWS Config, Secrets Manager, and CI/CD pipeline security at scale. His research interest at the intersection of agentic AI and cloud identity — the subject of this talk — grew directly from real-world experience testing AI systems for adversarial manipulation and observing how autonomous tool use exposes cloud IAM to a new class of attack surface.

"Trust Fall" represents his synthesis of those two worlds: offensive AI security research applied to the cloud IAM threat model, grounded in published vulnerability research, OWASP's Agentic Top 10 for 2026, and MITRE ATLAS — and delivered without a lab, because the threat model speaks for itself.

Sadhana Sainarayanan

Sadhana Sainarayanan is an AI and machine learning practitioner with deep expertise in autonomous pipeline design, event-driven system architecture, MLOps, and cloud-native AI deployment across GCP and Azure environments. She holds a Google Cloud Certified Professional Machine Learning Engineer certification and a Microsoft Certified Azure AI Engineer Associate certification, alongside dual Master's degrees from Carnegie Mellon University. Her research interests span the security implications of agentic AI systems, NLP pipeline trust boundaries, and the input-validation gaps that emerge when autonomous systems process external data at scale. For this talk, she brings the AI builder's perspective to the cloud identity threat model.

LinkedIn: https://www.linkedin.com/in/sadhana-sainarayanan

10:00-10:40

💡 Talk: Jenko Hwong & Chris Ryan
Bashing CloudShells for mining, networking, exfil and persistence at scale

+

Speakers: Jenko Hwong & Chris Ryan

Abstract:

CloudBashing started with reversing the private AWS, Azure, and GCP CloudShell REST protocols, analyzing websocket terminal sessions, and tracing janky browser authentication/credential flows with cookies and OAuth tokens. Along the way, we automated the APIs to access free CPU/networking, maintained access across container/VM resets, utilized persistent $HOME for implants/data, locked users out of sudo access, and installed a C2 framework. We discovered IAM design issues like: AWS role assumption that result in a large # of environments per compromised identity, web socket sessions that survive API token revocation, and M365/Gmail consumer email accounts that have default CloudShell access. This turned into a newly released exploit toolkit, CloudBasher, that enumerates, validates, installs, and runs distributed workloads with virtual storage and private networking across a large-scale agent network with persistence and resilience. We'll demo distributing CPU-intensive workloads, using virtual storage for staging/exfiltration, secure networking for proxy and obfuscated exfil paths, while automating the discovery, enumeration, creation of CloudShell environments from initial credentials/sessions to implants/setup/networking to management and control.

Speaker Bio(s):

Jenko Hwong

Jenko Hwong is a Principal Security Researcher at Huntress Labs, focusing on identity-based attacks and cloud abuse. Prior to Huntress, he spent 6 years at Netskope Threat Labs, has spoken at RSA and DEFCON, and is a Cloud Village Lead. He has spent an odyssey playing Sisyphus at security companies in cloud detection/response, vulnerability scanning, AV/AS, pen-testing, L3/4 appliances, threat intel, and windows security. He hates OAuth with a passion, would like to kill -9 Lost Lazy Mindless tools/people, and wishes insecure-by-default-security-vendors were forced to eat-their-own-crap.

Chris Ryan

A series of oddly configured server banners, a JARM fingerprint, curious fields in a security certificate - these aren't just technical details, but are instead threads in a narrative tapestry woven like a John le Carre novel. For over 20 years, Chris has dedicated his life to studying these threads and the intersection between cybersecurity, Russian linguistics, and free and open source software. His career path has taken detours through academia, aerospace and defense, software development, and cybersecurity.

10:40-11:20

💡 Talk: Jai Kumar Sharma & Tom McCarthy
Ghost Records: Automating Dangling DNS & Subdomain Takeover Detection at Enterprise Scale

+

Speakers: Jai Kumar Sharma & Tom McCarthy

Abstract:

This is not another subdomain takeover 101 talk. It's the story of how GoDaddy - one of the world's largest domain registrars, managing millions of domains across hundreds of AWS accounts, confronted dangling DNS at enterprise scale, and the hard-won learnings and automation that came out of it.

Let's be honest: 95% of subdomain takeover findings are noise. They're 4th, 3rd-level subdomains on dead non-prod environments that no customer visits. They create alert fatigue. But the other 5%, cookie theft via *.domain.com scope, OAuth token hijack, phishing from a legitimate domain with a valid TLS cert are catastrophic.

And then there's the bug bounty problem: researchers find these in bulk and report them in bulk. They're frustrated because the fixes take weeks. You're frustrated because most reports aren't impactful but you can't just close them. The relationship suffers on both sides and that's a cost nobody puts on a dashboard.

We share candidly where GoDaddy wasted time: manually triaging hundreds of researcher reports, chasing low-impact findings, building one-off fix scripts instead of systemic solutions, trying to map record ownership after the fact.

We cover the challenges: multi-account sprawl with no central DNS ownership, rapid dev cycles where IaC teardowns don't touch Route53, researchers reporting faster than teams can fix.

We explain what we built: automated cross-referencing of every Route53 A record and CNAME against Elastic IPs allocated across all AWS regions, integrated with ownership routing and shift-left pipeline hooks. And we share the result: reactive to proactive detection, MTTR from weeks to hours, entire record classes eliminated at the source.

We release "Ghost Records," an open-source tool focused on the highest-impact attack vector: dangling A records and CNAMEs pointing to released or unallocated AWS Elastic IPs. The tool inventories all EIPs across every enabled region, cross-references them against Route53 records, and flags any DNS record pointing to an IP not owned by the account. Read-only, multi-account, parallel scanning, risk-scored output. Live demo included.

Speaker Bio(s):

Jai Sharma

Jai Sharma is a Principal Offensive Security Engineer at GoDaddy, where he leads cloud penetration testing, red team operations, AI red teaming, and security research across one of the world's largest domain registrars and hosting platforms. A self-taught offensive security researcher from New Delhi, India, he built his career with a hacker's mindset, breaking code logic, chasing vulnerabilities, and proving real-world business impact from technical exploits. He also leads TTP research, drives threat emulation efforts, and works closely with blue teams to sharpen detection through an adversary-focused lens.

At GoDaddy, Jai tests the same infrastructure and enterprise environments that millions of customers rely on. His work spans cloud and on-premises penetration testing, IAM privilege escalation research, and building automated offensive tooling that helps turn point-in-time assessments into continuous detection. Before GoDaddy, Jai held offensive security roles at Housing.com, FIS, and EY, giving him firsthand experience with how security weaknesses and misconfigurations surface across different industries, architectures, and maturity levels.

Jai volunteers with the DEF CON community as CTF Ops for the Cloud Village and on-site Coordinator for the Bug Bounty Village.

Tom McCarthy

Tom McCarthy is the Director of Offensive Security and Business Information Security Officer at GoDaddy, where he oversees penetration testing, red team operations, and security strategy across multiple lines of business. With over 15 years in offensive security — spanning consulting, penetration testing, research, and training — Tom has built multiple penetration testing teams from the ground up and led or managed hundreds of penetration tests and red team engagements throughout his career. Tom is a returning DEF CON speaker, having previously presented research, tooling, and training at both DEF CON and DerbyCon. He has contributed to open-source offensive security projects including smbexec and Metasploit, and served as a trainer in hacking and incident response for local, federal, and military organizations across multiple countries.

11:20-12:00

💡 Talk: Shane Young
Trust the Cloud Pipeline, Lose the Kingdom

+

Speaker: Shane Young

Abstract:

In 2020, SolarWinds showed the industry what it looks like when an attacker owns a build pipeline. In 2021, Codecov did it again. CircleCI in 2023. Each incident surfaced the same pattern. Cloud CI/CD systems sit at the center of a trust graph most organizations have never actually mapped, and compromising them grants access to everything downstream: source code, cloud infrastructure, production artifacts, customer data, and every third party platform the organization stores credentials for. Detection remains largely absent.

Five years after SolarWinds, red teams still rarely operate meaningfully against cloud native CI/CD. Most offensive security programs treat pipelines as infrastructure they inherit rather than terrain they fight over. Defenders build detection around endpoints and identities they recognize, while ephemeral build agents with elevated cloud credentials run continuously and unmonitored.

This talk presents a full cloud native CI/CD attack chain drawn from red team engagements across multiple enterprise cloud environments. The chain starts at a low privilege developer identity. Pull request poisoning, in both direct and indirect variants, exfiltrates temporary AWS credentials from the build agent. A scheduled Lambda function then relays fresh credentials before each expiry, providing durable serverless persistence with no endpoints, no implants, and no signals a traditional detection stack watches for. IAM role trust chain abuse escalates the compromised build identity into broad cloud access spanning multiple accounts. Finally, Secrets Manager extends the attack beyond AWS. The credentials stored inside grant organization admin access to the code hosting platform, administrative control of the CI platform itself, access to customer data warehouses, and access to every SaaS and third party system the organization depends on.

Speaker Bio:

Shane Young is an offensive security operator and program builder with over 15 years in the field. His career spans consulting across financial services, hardware, and SaaS; building out an IoT security practice at a major security consultancy; leading red team operations against cloud native product companies; and pioneering AI/ML red teaming for deployed enterprise AI features. He builds offensive security programs from scratch, runs red team operations end to end, and still carries significant technical IC workload because he thinks that is how security leaders stay sharp. He has been hacking since he was a teenager, and it still has not gotten old.

12:00-12:20

⚡️ Lightning Talk: Moshe Berntsein
Whose Resource Is It Anyway? The Design Flaw That Breaks the IAM Permission Model

+

Speaker: Moshe Berntsein

Abstract:

The major cloud provider’s permission model is simple: use IAM to keep the bad guys out of your cloud environment. But what if the bad guys could lure victims in? Each provider implements IAM differently, and in this talk, we will explore a hidden quirk in the GCP identity boundary that allows attackers to invert the permission model and force victims into a malicious environment.

We will examine the unique aspects of GCP IAM and explore how a core design choice enabled cross-tenant account takeover via a novel vulnerability I discovered in Vertex AI Workbench, potentially leading to full cloud compromise.

The biggest threat to your cloud environment could be a project you didn’t even know you were a part of.

Speaker Bio:

Moshe Bernstein is a Senior Security Researcher specializing in cloud vulnerability research at Tenable. With over a decade of experience in cybersecurity, Moshe has developed a strong focus on network and operational security, web vulnerability research, and cloud infrastructure security. He enjoys presenting his research at conferences around the world, and is always on the lookout for new challenges.

12:20-13:00

💡 Talk: Doron Kapah
Pinchy Gets Played: How We Red-Teamed AI Agents Before the Threats Did

+

Sponsored by: Varonis

Speaker: Doron Kapah

Abstract:

AI agents are showing up in cloud workflows with credentials, autonomy, and trust, but so are the threats targeting them. So, before attackers started probing them, Varonis Threat Labs did.

We built a target agent named Pinchy on the OpenClaw platform and put it through a red-team gauntlet using well-known techniques. Pinchy handled sophisticated technical attacks with ease but folded immediately against simple social ones. The same drive to be useful turns these agents into an attack surface that requires entirely different defensive strategies. Join us for a deep dive on the new risks autonomous AI brings to the cloud. You'll leave with a clearer picture of where AI agents fail, why the threat model is unlike anything that came before it, and what architectural controls — not prompts, not policies —

actually keep environments secure.

13:00-13:30

🔨 Tool Demo: Ritvik Arya & Kyle Quest
Minimal by Design: Building Hardened Near-Zero-CVE Container Images

+

Speakers: Ritvik Arya & Kyle Quest

Abstract:

Most production containers ship on base images with dozens of known CVEs — debian:latest currently sits at 127. Patches take weeks. Your compliance team isn't happy. We built "minimal" — an open source project producing 36 hardened (and adding more), distroless container images for the stack most cloud teams actually run: Python, Node, Go, Redis, PostgreSQL, MySQL, Kafka, Nginx, Prometheus, Jenkins, and more. Image runs as non-root, has no shell, ships with a signed SBOM, and is rebuilt daily so CVE patches land in under 48 hours instead of 30 days.

This talk is a practical walkthrough of how you build something like this from scratch using entirely open source tools — and what could go wrong. We'll cover the toolchain: Chainguard's melange for sandboxed source builds, apko for declarative image assembly,Wolfi as the package base, Grype for scanning, and cosign for keyless signing.

We'll show the CI pipeline — 60 parallel GitHub Actions jobs, native ARM64 runners, ephemeral signing keys for PRs, multi-arch manifest assembly — and the 24 automated update workflows that track upstream releases daily across GitHub tags, RubyGems, php.net, and Wolfi's APKINDEX. We'll close with live Grype scan comparisons against official Docker Hub images. The numbers are dramatic, and they make the case better than we can. Every source build is SHA256-verified, and every assembled image is tested in CI before publishing — tests for no shell, correct entrypoint, expected binaries present, services responding.

Everything is open source and running in production today. If you leave this talk and build your own hardened container pipeline the next week, we've done our job.

Speaker Bio(s):

Ritvik Arya

Ritvik Arya is an Application Security Engineer at Amazon Web Services specializing in cloud security, container security, and offensive security research. His work focuses on securing large-scale cloud-native applications, building hardened container ecosystems, and developing scalable AppSec automation and vulnerability discovery tooling.

13:30-14:10

💡 Talk: Dan Gansel
What's Behind the Curtain? Tearing Down AWS's AI Agent Runtime From the Inside

+

Speaker: Dan Gansel

Abstract:

When you deploy an AI agent to AWS Bedrock AgentCore, your code lands in a container inside a Firecracker microVM - and AWS tells you almost nothing about what else is in there with you. So we decided to find out.

We started with nothing but a Python process in a container and a lot of patience. What began as hand-parsing `/proc/net/tcp` to find open ports and reconstructing the process tree from `/proc/[pid]/cmdline` quickly turned into something much bigger - the container wasn't alone, and the things running alongside it weren't expecting visitors.

Breaking out of the container gave us access to the microVM filesystem and let us extract four unstripped Rust platform binaries. But it was the second trick that really opened things up: by manipulating the container's metadata and log configuration, we got AWS's own logging pipeline to ship us the platform's internal logs - boot sequences, lifecycle state transitions, TLS certificate provisioning, hypervisor handshakes, and error messages the platform was never meant to share with customers.

Between the inside-out reconnaissance, the extracted binaries, and the captured logs, a complete picture emerged of something Amazon internally calls "Project Kepler" - an undocumented platform that has never been publicly described. We'll walk through every technique we used to peel back the layers, what we found at each one, and what it tells us about how AWS builds isolation for managed AI workloads.

Speaker Bio:

Dan Gansel is a cloud security specialist with deep expertise in cloud API research, secure cloud solutions and architecture design. Dan has led cloud security research teams and has a track record of uncovering novel attack techniques in cloud environments.

As a Security Researcher at Upwind Security, Dan continues to push the boundaries of cloud security, focusing on uncovering blind spots in the services organizations trust the most.

14:10-14:50

🎙️ Panel:
Autonomous Offense vs. Autonomous Defense: Who's Winning in the Cloud?

+

Panelists: TBD

Description:

An AI agent now runs most of a nation-state-grade intrusion on its own. It handles recon, escalation, and exfiltration in sequence, with a human looking in only a few times a day. Agents rank among the top hunters on public bug-bounty boards, and AI-run intrusions are showing up in real incident response, not demos. Vendors say autonomous offense is the best defense; skeptics note the agents that ace benchmarks still stall on hard targets. So who gets the bigger AI multiplier in the cloud: the attacker probing a thousand near-identical tenants at once, or the defender with uniform telemetry and instant revocation? And is "who's winning" even the right question?

14:50-15:20

🔨 Tool Demo: Aniruddha Biyani
cloud-auth: a provider-agnostic CLI for cross-cloud workload identity

+

Speaker: Aniruddha Biyani

Abstract:

Modern engineering teams don't live in one cloud. A workload in Google Kubernetes Engine needs to read from an S3 bucket. An EC2 instance needs to fetch a secret from Azure Key Vault. A single GitHub Actions job has to deploy to AWS, log telemetry to GCP, and trigger a workflow in Azure — all in the same run. The default way teams make this work is the same way they have for a decade: paste a long-lived credential into a secret and hope nobody finds it.

This is the credential sprawl problem at the heart of every multi-cloud breach. Static AWS access keys, GCP service account JSON files, Azure client secrets — the most reliably exploited foothold in cloud environments, sitting in env vars, secret managers, and committed git history across every blue team's environment.

Why this was hard before cloud-auth? In theory, every major cloud already supports a way to skip the static credential entirely. A GKE pod can assume an AWS IAM role directly — no AWS keys anywhere. An EC2 instance can call Azure with no service principal on it. A Kubernetes workload can hit GCP APIs with no service account JSON file. In practice, each cloud has its own model, API, and failure modes. Setting up just one of these connections means learning a new mental model, authoring trust documents with provider-specific subject formats, and validating it all by hand. Doing it across clouds means doing that work three or four times over, with no consistent way to set it up, validate it, or clean it up.

That friction is why cloud-auth exists. The secure path is already supported by the clouds — defenders just need tooling that makes it as easy as pasting an access key, or easier. So most teams stay on static keys.

cloud-auth: cross-cloud workload identity for defenders

cloud-auth is an open-source CLI and library that gives blue teams one consistent way to set up, validate, and safely retire cross-cloud workload identity. One command stands up the trust between any two of: AWS, GCP, Azure, HashiCorp Vault, Cloudflare, GitHub Actions, and Kubernetes. The same command validates it, previews changes before applying, and tears it down without touching anything it didn't create.

Live demo

GKE pod → AWS S3, no AWS keys. A GKE pod reads from S3 using a short-lived AWS role.

EC2 → Azure Key Vault, no service principal. An EC2 instance fetches a secret with no Azure client secret on it.

GitHub Actions → AWS, GCP, and Azure in one workflow. A single CI job deploys across three clouds.

Catching a misconfigured trust. The validator flags an overly permissive trust before it ships.

Safe teardown. Dry-run a multi-cloud cleanup, then execute. cloud-auth only deletes what it created.

What attendees leave with? A working open-source tool, a concrete pattern for cross-cloud workload identity, and a validation framework to drop into existing CI/CD.

Repository: https://github.com/anirudhbiyani/cloud-auth (LGPL-3.0)

Speaker Bio:

Aniruddha "AB" Biyani leads the Security and Compliance program at Prophecy, where he focuses on building security as a business enabler for high-growth cloud and AI platforms. His work centers on scaling information security programs, strengthening cloud and identity security, enabling secure product development, and aligning security strategy with customer trust, compliance, and engineering velocity. He has previously held security roles at Mandiant, Securonix, CRED, and Khoros.

AB's career spans cloud security leadership across startups and cybersecurity vendors, with deep experience in defensive cloud engineering, identity and access management, secure developer enablement, and operationalising secure-by-default practices in fast-moving organizations. He is known for translating complex security challenges into practical programs, tools, and frameworks that help engineering teams move quickly while reducing risk.

AB has presented at global security conferences including Black Hat Arsenal, SANS CloudSecNext, and MCPDev BLR, on workload identity, multi-cloud attack surface discovery, credential lifecycle management, and secure cloud adoption at scale. He is also an active open-source contributor and community builder, maintaining cloud security tools and secure developer training resources. He previously served for three years as a core DEF CON Cloud Village CTF volunteer, leading contest design and build efforts.

15:20-16:00

💡 Talk: Marios Gyftos & Chrysostomos Manousis
New Hope for SSRF: Exploiting Credential Relay from APIM to AI Foundry

+

Speakers: Marios Gyftos & Chrysostomos Manousis

Abstract:

We found the same root cause — credentials and destinations resolving independently — across six Azure services spanning AI platform, developer tooling, Kubernetes infrastructure, and traditional enterprise services. User-controlled input reaches an outbound HTTP request carrying Managed Identity tokens, HMAC secrets, or OAuth credentials, and nothing validates where the request goes.

The affected services include Azure AI Foundry (code interpreter and OpenAPI tool), Azure AI Speech, Azure MCP Servers, AKS MCP, and Azure API Management. The impact ranges from stealing live MI tokens for any Azure audience, to dumping production Key Vault URIs and never-expiring write SAS tokens from Microsoft's own backend, to root RCE on Kubernetes nodes through a readonly tool. One finding has CVE-2026-26118 assigned; the rest are reported to MSRC and pending.

We built attack chains that combine these findings: Foundry MI theft into full tenant reconnaissance, Speech SSRF into persistent backend access via never-expiring SAS, MCP credential relay delivered remotely through prompt injection with no network access to the target, and AKS command injection into cluster-wide lateral movement via Azure's AKS MCP. The oldest service we found this in — APIM — has been in production for over a decade. The newest — AI Foundry — shipped last year. Same pattern.

The talk includes three live demos, a credential relay taxonomy, and a testing methodology the audience can apply on their next Azure engagement. All findings reported to MSRC before submission.

Speaker Bio(s):

Marios Gyftos

Marios Gyftos is a Senior Penetration Tester specializing in cloud security across AWS, Azure, and GCP since 2017. He previously presented at DEF CON 33 Cloud Village on Azure service principal exploitation, BSides Athens 2024, and BSidesChicago 2023 on DevOps attack chains. He is the creator of Azure AppHunter, an open-source tool for scanning Graph API permission misconfigurations. He has reported multiple vulnerabilities to MSRC across Azure AI Foundry, Azure Speech, AKS, Azure MCP, APIM, and Entra ID. Solo speaker — all research, exploitation, and vendor reporting was conducted independently.

Chrysostomos Manousis

Chrysostomos Manousis is a cybersecurity professional and Senior Penetration Tester at Mind The Hack, specializing in penetration testing, red teaming, and the delivery of cybersecurity and information technology services. He holds an MEng in Electrical and Computer Engineering, with a focus on software and hardware engineering. His background spans offensive security across web, cloud, and enterprise environments, and he holds multiple industry-recognized certifications

16:00-16:40

🎙️ Panel:
The 100-to-1 Problem: Securing the Non-Human Identity Perimeter

+

Panelists: TBD

Description:

Non-human and machine identities rapidly outpace human users and AI agents are accelerating the gap. This panel explores how autonomous agents break the assumptions that traditional machine-identity and secrets-management strategies were built on and how to secure secrets and delegate permissions at machine scale.

16:40-17:20

💡 Talk: Jie Wu
Key Rotation Won't Save You: Hunting Workload Identity Backdoors in AWS and GCP

+

Speaker: Jie Wu

Abstract:

Cloud incident response runbooks end with "rotate all keys and credentials." AWS IAM Roles Anywhere and GCP Workload Identity Federation were designed to remove keys from the trust chain, and that design is what lets an attacker survive standard containment.

This talk shows how an attacker registers their own certificate authority as an AWS Roles Anywhere trust anchor, or modifies a GCP Workload Identity Federation provider to trust an attacker-controlled identity, and mints fresh credentials indefinitely. Defender content has not caught up to the attack research: Roles Anywhere trust anchor and session events land in CloudTrail by default, but no published hunting query traces the CreateSession back to the issuing certificate authority via the hex serial recorded in roleSessionName. GCP pool and provider creation lands in Admin Activity logs for free, but the federated token exchange only lands in Data Access logs when explicitly enabled and paid for.

The session closes with the cross-cloud fingerprint: when the same attacker-controlled OIDC provider is registered in both clouds (as an AWS OIDC identity provider and as a GCP Workload Identity Federation pool provider), the same OIDC sub claim surfaces in both audit trails. Extracting and joining on it ties one attacker to two cloud incidents.

Attendees will gain the WIF Hunting Pack: a working playbook for keyless persistence in AWS and GCP, two prevention policy templates that block the attack at organization scope, and a cross-cloud correlation pattern for OIDC-based incident response. Live demo across speaker-controlled AWS and GCP environments. This talk is for blue teamers and platform security engineers who secure infrastructure across AWS and GCP.

Speaker Bio:

Jie is a Senior Security Engineer at Shopify based in New York City, working on cloud security, Kubernetes, and detection engineering to secure cloud infrastructure. She has spoken at KubeCon EU, fwd:cloudsec, and BSides (Chicago, Ottawa, Montréal), covering topics from Kubernetes security at scale to non-human identity accountability in the cloud. Before Shopify, she worked on cyber defense and vulnerability management at Bank of America.

10:00-10:40

💡 Talk: Itay Saraf
Tag, You’re It: Authorization Traps in AWS ABAC

+

Speaker: Itay Saraf

Abstract:

AWS Attribute-Based Access Control (ABAC) is gaining popularity for good reason: it scales well, minimizes policy duplication, and aligns with dynamic cloud environments. However, it can expand the attack surface in unexpected ways.

In AWS, ABAC often relies on tags and attributes whose semantics are easier to misunderstand than most practitioners realize. Those semantics determine whether a policy actually enforces the intended boundary, or quietly creates a new attack surface.

In this talk, we present a taxonomy of authorization traps in AWS ABAC: recurring patterns where policies look correct but do not behave as expected. These traps arise from ambiguous documentation, non-obvious IAM evaluation rules, service-specific behavior, and edge cases. Different as they may be, they often lead to the same result: a broken security boundary.

This talk is for anyone building, reviewing, or attacking access control in AWS - from cloud security practitioners and IAM engineers to red teamers. Expect real policy examples, common failure patterns, and practical techniques you can apply directly in your own environments, with takeaways relevant to almost any AWS setup.

Speaker Bio:

Itay Saraf is a Senior Cloud Security Researcher at CrowdStrike. He has a background of offensive security, and worked as a red teamer targeting enterprise environments around the world, including multiple Fortune 500 companies. Today, he brings that offensive mindset to cloud and AI research, focusing on exposing real-world threats in modern cloud infrastructure.

10:40-11:20

💡 Talk: Gowthamaraj Rajendran
When Machines Attack Machines: Detecting AI-Autonomous Cloud Compromise at NHI Scale

+

Speaker: Gowthamaraj Rajendran

Abstract:

Two forces are converging to break cloud detection as we know it. First, non-human identities (NHIs) such as service accounts, API keys, OAuth tokens, AI agent credentials now outnumber human identities by ratios exceeding 100:1 in enterprise environments. 97% of these NHIs carry excessive privileges, 71% are never rotated within recommended timeframes, and over 40% are orphaned with no human owner. Second, attackers have begun using AI agents to compromise these identities at machine speed, performing hundreds of reconnaissance actions per minute, autonomously mapping privilege escalation paths, and executing lateral movement faster than any human analyst can respond.

The result is a detection problem that traditional security tools were never designed to handle: machine-speed attacks against machine identities, where the attacker's AI agent looks indistinguishable from the defender's AI agent in the logs.

This talk presents the first detection engineering framework purpose-built for this collision covering how to baseline NHI behavior, detect AI-autonomous compromise patterns, and build response automation that can match attacker speed.

Speaker Bio:

Gowthamaraj Rajendran is a Detection and Response Engineer at Meta with over 6 years of experience in cybersecurity. He specializes in building high-fidelity rules and improving detection engineering practices at scale.

11:20-11:50

🔨 Tool Demo: Scott Weston
Breaking the Oracle: Building an Offensive Security Toolkit for OCI

+

Speaker: Scott Weston

Abstract:

Oracle Cloud Infrastructure (OCI) has an IAM model that looks very different from AWS, GCP, and Azure. Its sentence-based policy language, compartment scoping, dynamic groups, cross-tenancy statements, and resource relationships can make authorization difficult to parse, test, and visualize during a security assessment.

While learning OCI from a penetration-testing perspective, I encountered several tooling gaps that made analysis more difficult. This talk presents a suite of open-source tools I built to close those gaps and make OCI attack-path analysis more practical.

The toolchain includes:

- oci-lexer-parser: An ANTLR-based parser that converts OCI’s sentence-based IAM policies into structured, machine-readable JSON.

- OCISigner: A Burp Suite extension that transparently signs OCI API requests, making it easier to intercept, modify, and replay authenticated OCI traffic.

- OCInferno: A modular OCI reconnaissance framework for enumerating IAM and resource data during security assessments. Includes download functionality as well as pre-packaged exploit modules. Was designed and modeled from gcpwn.

- OpenGraph IAM modeling (part of OCInferno): A graph-based model that turns parsed policies and collected OCI data into nodes and edges for visualizing access paths and potential privilege escalation routes.

The talk will show how these tools can be used to parse OCI policies, collect environment data, and model privilege escalation paths that are difficult to identify from policy text alone. For example, a user may belong to a group with permissions over a compute instance, that instance may belong to a dynamic group, and that dynamic group may have broader tenancy-level access.

Attendees will leave with a practical understanding of OCI IAM attack-path analysis and how to use these open-source tools to better assess, test, and visualize OCI environments.

Reference: https://github.com/netspi/ocinferno

Speaker Bio:

Originally from Southern California and now based in Minneapolis, Scott has six years of experience in information security. As a Labs Researcher at NetSPI, he builds open-source tools and research material focused on cloud security and penetration testing across AWS, GCP, and OCI environments. His tools include gcpwn, ocinferno, oci-lexer-parser, and ocisigner.

In his spare time, he enjoys being a totally fair and impartial Dungeon Master for his friends in Dungeons & Dragons, and holding out hope that San Diego FC or Minnesota United can make it to the finals.

11:50-12:30

💡 Talk: Shani Kurtzberg & Zohar Buber
Foxveil: Cloud-Native Loader Tradecraft on Cloudflare, Netlify, and Discord

+

Speaker: Shani Kurtzberg & Zohar Buber

Abstract:

Malware loaders used to advertise themselves with throwaway domains, fragile hosting, and obvious command-and-control infrastructure. Foxveil is a hard reset in loader tradecraft.

Less attacker-owned infrastructure, less disk-heavy execution, fewer static clues, and more abuse of platforms defenders see every day.

This newly documented loader stages payloads from our most trusted and favorite cloud-native tool chains: Cloudflare Pages, Netlify, and Discord attachments, executes shellcode largely in memory, establishes persistence through masqueraded Windows artifacts, and actively rewrites analysis-significant strings at runtime to make reverse engineering and static detection harder.

Across two observed variants, Foxveil combines several pieces of modern tradecraft into one compact initial-stage loader. One variant spawns a fake svchost.exe and performs Early Bird APC injection into the target process before it fully resumes. Another pulls shellcode from Discord attachments and executes it through self-injection. Both stage follow-on payloads from trusted platforms, drop files into SysWOW64 under names designed to blend into normal Windows noise, and use runtime string mutation to corrupt keywords such as beacon, meterpreter, shellcode, and even fox itself.

This talk walks through the full Foxveil infection chain, from staging and shellcode delivery to persistence and follow-on deployment, and examines what makes this loader part of a broader shift in attacker and malware tradecraft by comparing both variants. The real story is not just cloud-hosted staging. It is the emergence of a loader model that borrows trust instead of building infrastructure. Foxveil examines what modern initial-stage malware looks like when it is designed for rotation, ambiguity, and survival.

Speaker Bio(s):

Shani Kurtzberg

Shani Kurtzberg is an XDR Team Lead at Cato Networks and member of Cato CTRL. She leads the Threat Intelligence and XDR Detection Engineering initiatives. Prior to Cato, Shani served in the Israeli Air Force (IAF) as a Security Analyst, leading SOC operations to protect critical systems. Shani holds a Master of Business Administration (M.B.A.) from Peres Academic Center, specializing in Marketing and Product Management.

Zohar Buber

Zohar Buber is a security analyst in Cato Research Labs at Cato Networks. He focuses on network protocol analysis and malicious traffic detection, specializing in threat identification using network-based methods. He previously worked at Radware, where he examined threats in the DDoS industry. Zohar holds B.A focused in Business Administration, Information System Analysis // Zohar Buber, zohar@devtalks.me

12:30-13:10

💡 Talk: Shani Peled
The Invisible Runtime: Understanding Azure AI Foundry's Hidden Trust Model

+

Speaker: Shani Peled

Abstract:

Azure AI Foundry promises a simple serverless AI experience: upload models, run workflows, execute Python code, and Azure handles the rest. But what exactly is "the rest"?

In this talk, we pull back the curtain on a hidden framework operating silently beneath every Azure AI Foundry serverless workload. Our research uncovered an entire layer of Azure-managed runtimes, identities, and infrastructure that customers never see, never configured, and never knew existed - yet runs alongside their code every time a workload executes.

This talk reveals how attackers can abuse hidden trust relationships inside Azure AI runtimes, why most organizations are blind to these attack paths, and what defenders must do before AI runtimes become the next major cloud pivot point.

If your organization is building, deploying, or securing AI workloads on Azure, this is a talk you can't afford to miss. You'll leave with a fundamentally different understanding of the hidden infrastructure powering your AI workloads, the trust relationships it introduces, and what they mean for your organization's security.

Speaker Bio:

Shani Peled is a Senior Cloud Security Researcher at CrowdStrike, specializing in offensive cloud and AI security research. She began her career in the Israeli Intelligence Corps, where she served as the only female hacker on her cyber defense team protecting critical infrastructure. After transitioning into offensive security, she spent years conducting red team operations against enterprise environments worldwide, including Fortune 500, Fortune 100, and Fortune 50 companies. Today, her research focuses on exposing hidden trust relationships, identity abuse paths, and emerging attack surfaces across modern cloud and AI platforms.

13:10-13:30

Closing Note

+

A brief on what got uncovered and prize distribution.

Cloud Village CTF

Cloud Village CTF @ DEF CON 34: 7th & 8th August 2026

CTF starts - 7th August, 2026 - 10:00AM PDT

CTF closes - 8th August 2026 - 23:59PM PDT

CTF registrations opens - 30th July 2026 - 10:00AM PDT

CTF Site - https://ctf.cloud-village.org

If you ever wanted to break stuff on the cloud, or if you like rabbit holes that take you places you did not think you would go to, follow complicated story lines to only find you could have reached to the flag without scratching your head so much - then this CTF is for you!

Our CTF is a two days jeopardy style contest where we have a bunch of challenges hosted across multiple Cloud providers across multiple categories of difficulty.

You can register as teams or go solo, use hints or stay away from them, in the end it will be all for glory or nothing. Plus the prizes. Did we not mention the prizes? :D

See you on the other side!

Labs Schedule

🗡 Attack Labs: 3 | 🛡 Strategic Defense Labs: 6 | 🔍 Investigation Labs: 2 | ⚔️ Attack & Tools Labs: 2

Note: All labs will be conducted in Room 312, LVCC. The room has been divided into two zones, A and B, to accommodate simultaneous lab sessions.

11:00-13:00

🗡 Attack Lab: Samanta Aranda
Weaponizing CloudFormation: Privilege Escalation via Infrastructure as Code in AWS

+

Venue: Zone A, Room 312

Instructor: Samanta Aranda

Abstract:

CloudFormation is widely trusted as a secure and declarative Infrastructure as Code (IaC) service inside AWS environments. In practice, however, CloudFormation frequently operates with permissions far beyond those of individual users, CI/CD pipelines, or developers. This workshop explores how attackers can abuse that trust model to achieve privilege escalation and persistence in realistic AWS environments.

In this fully hands-on offensive cloud security workshop, attendees will begin with limited IAM permissions and learn how to identify and exploit misconfigured CloudFormation execution roles using iam:PassRole, service roles, and Lambda-backed Custom Resources. Participants will weaponize CloudFormation templates to create persistence mechanisms inside service-scoped IAM paths without requiring direct administrative permissions.

The workshop emphasizes realistic cloud attack paths, delegated execution abuse, and the security risks introduced by over-permissioned automation. Attendees will also explore rollback abuse scenarios and learn how these attacks appear in CloudTrail and IAM logs.

Prerequisites:
- Basic familiarity with AWS concepts
- Basic understanding of IAM roles and policies
- Familiarity with terminal/CLI workflows
- Laptop capable of running:
   - AWS CLI v2
   - Terraform >= 1.5
   - Python 3.x (optional but recommended)

Instructor Bio:

Samanta Aranda serves as a Managing Senior Consultant at Bishop Fox, leading security assessments and initiatives focused on strengthening organizations’ technological resilience. She holds a degree in Electronics and Communications Engineering and a Master’s in Computer Science and Technology Management. From the very beginning of her career, she found in cybersecurity not just a profession but a genuine passion. Over the years, she has collaborated with national and international firms such as KPMG, Scitum, EC-Council LATAM, and INFOTEC, contributing to projects that bridge technology, strategy, and security.

Samanta holds 16 professional certifications, including GPEN, GWAPT, CEH, and CND, and has been recognized as an EC-Council Certified Instructor, earning a place in the organization’s Circle of Excellence in 2021. She blends technical expertise with a human and collaborative approach to security, firmly believing that shared knowledge is the strongest defense.

11:00-13:00

🛡 Strategic Defence Lab: Ram (n2r)
Governing the Firehose: Writing Custom OPA Policies to Tame and Remediate Prowler Output

+

Venue: Zone B, Room 312

Instructor: Ram (n2r)

Abstract:

When you run an opensource CSPM tool like Prowler across an cloud environment, you don’t get an audit; you get a tsunami of raw data. Sifting through thousands of JSON lines to determine what actually poses an active threat to your specific architecture is where most cloud defense pipelines break down.

In this 2-hour handson workshop, I’m going to show you how I bridge the gap between scanning and governance using Policy as Code. We will dive straight into treating Prowler’s raw security findings as structured data input for Open Policy Agent (OPA).

Together, we’ll write custom Rego policies from scratch to parse, filter and logically route Prowler results based on real world business context. I’ll show you how to write policies that evaluate infrastructure as code risk, suppress known risk acceptances safely and isolate critical failures (like exposed storage buckets or unencrypted databases) to trigger automated remediation workflows.

Prerequisites:

To actively participate, participants should bring a laptop and have:
- Comfort working in the command line (Bash/Zsh) and manipulating data structures.
- A foundational grasp of JSON formatting and basic cloud concepts (identities, storage accounts).
- Git, Docker and a modern code editor installed.
- Prior experience with Rego *isn't required* we'll build our logic from the ground up.

Instructor Bio:

Passionate about Linux, cryptography, and secure SDLC, He loves digging into code, threat modeling, and breaking things (responsibly ofc). Whether it’s hardening apps or decoding exploits. He is all about making software safer - one commit at a time.

13:30-15:30

🔍 Investigation Lab:
Cloudy with a Chance of Breaches: Hands-On AWS Threat Defense

+

Venue: Zone A, Room 312

Sponsored by: TrendAI

Abstract:

Join this hands-on workshop to explore integrated security capabilities for the modern AWS cloud stack, including containers, object storage, and AI applications. You’ll work with a deliberately vulnerable Flask application running on EKS with S3 and Amazon Bedrock, then deploy and configure controls that detect attacks at runtime.

The session will cover behavioral runtime detection for credential-access activity and malware inside live pods, attack-surface mapping, and identity-aware risk analysis to trace the potential blast radius of a compromised workload through its IAM role. You’ll also examine file-borne threat protection across the application boundary and S3, use unified XDR queries to hunt across container and storage detections, and close with runtime guardrails that block direct and document-borne prompt injection against a real Amazon Bedrock model.

13:30-14:30

🛡 Strategic Defence Lab: Jeremy Schiefer & Lawton Pittenger
The Autonomous Security Loop

+

Venue: Zone B, Room 312

Sponsored by: AWS

Speakers: Jeremy Schiefer & Lawton Pittenger

Abstract:

SOCs get thousands of alerts daily. Most orgs take days to triage and fix critical findings. Attackers exploit that gap.

This lab walks through the three stages of a continuous security loop. Do each phase by hand, then see how the latest AWS capabilities compress it to seconds:

Discovery: Review output from a continuous security scan that found a multi-step attack path. Understand why this catches things annual pen tests miss.
Triage: Manually triage 5 out of 30 Security Hub findings using the same signals AI triage uses. Compare your calls against the automated system.
Remediation: Examine proposed fixes. Understand the difference between human-approved and autonomous remediation. Submit a fix and confirm it works.

Speaker Bio(s):

Jeremy Schiefer

Jeremy is a Pr. Security Solution Architect at AWS focused on helping customers improve their security posture.

Lawton Pittenger

Lawton is a Worldwide Security Specialist Solutions Architect at AWS, based in New York City. He specializes in helping customers design and implement effective network security controls. At AWS, he works with customers at scale and collaborates closely with service teams to drive continuous improvement in security services based on customer needs and feedback. (https://www.linkedin.com/in/lawtonpittenger/ | https://github.com/lawtonpittenger)

16:00-18:00

⚔️ Attack and Tools Lab: Leron Gray
Cirro: Extending Your Azure Graph Beyond Identities

+

Venue: Zone A, Room 312

Instructor: Leron Gray

Abstract:

Most Azure graph analysis tooling focuses primarily on identity relationships: users, groups, service principals, and role assignments. While valuable, modern Azure environments contain far more exploitable context hidden within infrastructure, platform services, application configurations, network relationships, managed identities, and data-plane resources.

Cirro (the spiritual successor to Stormspotter) is an attack graphing tool built to model Azure environments by combining Microsoft Graph identity data with Azure Resource Manager (ARM) infrastructure data. Instead of limiting analysis to Entra ID objects and role assignments, Cirro maps Azure resources into Neo4j for deeper attack path and misconfiguration analysis.

This lab provides a practical understanding of Cirro’s collection, ingestion, and analysis workflow. Attendees will perform enumeration and assessment of an Azure tenant to understand how to view attack paths beyond identities. They will perform Cypher queries and use custom dashboards to visualize and interpret graph data.

Prerequisites:
- Docker/Podman Compose
- Azure CLI
- Web browser
- Sqlite3 Browser
Recommended (but not required):
- Fundamental knowledge of Cypher query language

Instructor Bio:

Leron Gray is a Senior Security Consultant at Bishop Fox, specializing in offensive security, cloud attack path analysis, and security tooling research. He is the creator of Cirro, an extensible graph-based framework for analyzing Azure and cloud environments through Microsoft Graph and Azure Resource Manager data. His work focuses on helping security researchers and red teamers better understand complex cloud relationships, identity abuse paths, and infrastructure misconfigurations at scale.

16:00-18:00

🛡 Strategic Defence Lab: Mackenzie Jackson
From Dashboard to Exploit: Weaponizing and Winning the Cloud Queue

+

Venue: Zone B, Room 312

Sponsored by: Aikido

Instructor: Mackenzie Jackson

Abstract:

Finding a vulnerability on a dashboard is only half the battle. Knowing how an attacker will weaponize it is what separates great security engineers from the rest.

In this hands-on CloudSec Village lab hosted by Aikido Security, you will step into the shoes of both defender and attacker. Navigating a custom simulation dashboard, you’ll face live vulnerabilities hidden across containerized apps and serverless functions. Your mission: don’t just trust the scanner. You will dive into live mini-applications, execute real-world exploits to prove their impact, and see exactly how they register on the platform. This drop-in lab bridges the gap between passive triage and active offensive security — join any time and validate threats like a pro.

Instructor Bio:

Mackenzie is the Field CTO for Aikido Security, helping tech leaders understand application security through an attacker’s lens. As the co-founder and former CTO health tech company Conpago, he understands the challenges of building secure applications. He has spoken in over 30 countries, hosts the popular Podcast The Secure Disclosure, and contributes to multiple publications including Dark Reading, Financial Times, and Fast Company.

11:00-13:00

🔍 Investigation Lab:
Patch Me If You Can: Hands-On Network Threat Defense

+

Venue: Zone A, Room 312

Sponsored by: TrendAI

Abstract:

Join this hands-on workshop to explore an integrated set of network security capabilities designed for real-time threat detection, prevention, and proactive risk management. You’ll see how inline traffic inspection can block threats with virtual patching, helping reduce exposure before vendor patches are available.

The session will also cover how deep network visibility supports detection of command-and-control activity, lateral movement, and advanced malware using behavioral analysis and custom sandboxing. You’ll learn how continuous asset monitoring can uncover misconfigurations, exposure, and other risk factors across the environment, then use that insight to prioritize response and reduce overall risk.

11:00-13:00

🛡 Strategic Defense: Toni de la Fuente & Amit Sharma
From Findings to Remediations: Open Source Cloud Security at AI Speed with Prowler

+

Venue: Zone B, Room 312

Sponsored by: Prowler

Speakers: Toni de la Fuente & Amit Sharma

Abstract:

Cloud security teams are drowning in findings, but isolated misconfigurations rarely tell the full story. This hands-on workshop shows how to use Prowler, the open-source cloud security platform, to detect vulnerabilities and misconfigurations, prioritize risks, and remediate with AI-driven workflows. Participants will learn how to run Prowler from the CLI and import findings into Prowler Cloud using the new Import Findings workflow. From there, the workshop will go beyond traditional compliance reporting and demonstrate Prowler's newer capabilities: Attack Paths for graph-based analysis of cloud resources, permissions, findings, and privilege-escalation chains;
Lighthouse AI for natural-language investigation, environment-aware prioritization, and direct guided remediation grounded in Prowler Hub's deterministic database; and the Prowler Claude Code plugin/MCP workflow for bringing security triage, remediation guidance, automated pull- request generation from IaC scanner findings as well as live cloud scans, and re-scanning into the developer workflow. By the end, attendees will understand how to use Prowler not only to assess compliance against frameworks such as CIS, GDPR, HIPAA, and cloud security best practices, but also to identify which findings matter most, explain their blast radius, and accelerate remediation with open source tooling and controlled AI assistance.

Speaker Bio(s):

Toni de la Fuente

Toni de la Fuente, Prowler’s open-source creator and CEO, has profoundly impacted cybersecurity. His AWS background and passion for FLOSS, cloud computing, and information security have fueled contributions to projects such as phpRADmin and Alfresco BART. An esteemed speaker at Black Hat and DEF CON, de la Fuente champions open-source solutions and advancements in cloud security.

Amit Sharma

Amit Sharma has over a decade of experience as a cloud architect and built cybersecurity and observability products at Splunk, Cisco, and SentinelOne before joining Prowler as Head of Product.

13:30-15:30

🗡 Attack Lab: Tal Peleg & Maya Parizer
Breaking AWS Bedrock: Novel Attack Techniques Against Cloud Infrastructure

+

Venue: Zone A, Room 312

Sponsored by: Varonis

Instructors: Tal Peleg & Maya Parizer

Abstract:

Amazon Bedrock is no longer just a research toy. It's embedded in CI/CD pipelines, production applications, and development workflows, often granted sweeping permissions over S3, IAM, and other AWS services. The rapid adoption of agentic AI has reproduced a new class of configuration patterns that security teams haven't caught up with yet.
In this hands-on attack lab, Varonis Threat Labs takes you inside real Bedrock deployment patterns observed across AWS environments. Participants will move from initial Bedrock access through data exfiltration, lateral movement, and AWS account compromise, exploiting the same misconfigurations we've found in the wild. No AI hype. No prompt injection gimmicks. This is cloud infrastructure security, and
Bedrock just happens to be the way in. Leave with attack paths you can take back to your own environment and the defensive controls to shut them down.

Instructor Bio(s):

Tal Peleg
Also known as TLP, is a senior security researcher and cloud security team lead at Varonis. He is a full-stack hacker with experience in malware analysis, Windows domains, SaaS applications, and cloud infrastructure. His research is currently focused on cloud applications, APIs, and agentic applications.

Maya Parizer
She is a Security Researcher at Varonis with a passion for cloud security,
identity, and data protection, specializing in IaaS and AI. Maya dives deep into every project, thoroughly investigating cloud environments to uncover potential vulnerabilities and stealthy attack techniques. Her experience spans both offensive and defensive disciplines — including CSPM, DSPM, vulnerability research, detection engineering,
and product security research in cloud environments.

13:30-14:30

🛡 Strategic Defense: Mackenzie Jackson
Fix It, Snooze It, or Ignore It? Cloud Security Decisions Under Pressure

+

Venue: Zone B, Room 312

Sponsored by: Aikido

Instructor: Mackenzie Jackson

Abstract:

Cloud security teams rarely struggle to find issues. They struggle to decide what actually matters—and how to fix them with limited resources.

In this interactive CloudSec Village lab hosted by Aikido Security, attendees step into the role of a cloud security lead. Navigating a custom simulation dashboard, you'll manage a realistic environment spanning containers, Kubernetes, serverless, and virtual machines.

The catch? Your engineering teams have a strict cap on available hours, and every fix comes with an estimated time cost. You must evaluate a live queue of vulnerabilities, assign remediation to the right teams, and decide what to fix, defer, or ignore to find the most optimal defense strategy before your resources run out.

This drop-in lab focuses on real-world decision-making under pressure rather than theory. Join at any time, manage your clock, and see how your prioritization strategy compares.

Instructor Bio:

16:00-18:00

⚔️ Attack and Tools: Eli Shparaga
OCIguana - A vulnerable-by-design OCI lab

+

Venue: Zone A, Room 312

Instructor: Eli Shparaga

Abstract:

This workshop will discuss Oracle Cloud Infrastructure (OCI) and its unique take on IAM in comparison to other major cloud providers. We will explore how OCI's policy language, dynamic groups, and principal types (instance principals, resource principals) create an attack surface that differs from other major cloud providers. Attendees will also get hands-on experience with attacking OCI environments by completing a vulnerable-by-design lab, designed to highlight the unique design decisions of OCI and its IAM system in general.

Prerequisites:

- A free trial OCI account
- Some familiarity with cloud security and IAM concepts.

Instructor Bio:

Eli Shparaga is a Security Researcher in XM Cyber, specializing in cloud and AI security. His work involves identifying attack vectors and adversarial tactics in major cloud providers. Before that, Eli worked as a red teamer, helping secure multiple Fortune 500 companies.

16:00-17:00

🛡 Strategic Defense: Bryant Pickford
Securing the AI Stack and Hunting Across Clouds

+

Venue: Zone B, Room 312

Sponsored by: AWS

Speaker: Bryant Pickford

Abstract:

Teams are deploying AI agents fast, often without guardrails. Attackers are exploiting cross-cloud trust to pivot between environments. This lab tackles both.

Part A (30 min): Securing the AI Stack- Find over-broad permissions on an AI agent's execution role - Discover prompt injection evidence in model invocation logs - Review Amazon Bedrock Guardrails that block injection, prevent system prompt leakage, and filter PII.

Part B (30 min): Cross-Cloud Threat Hunting with OCSF- See how AWS, Azure, and GCP logs map to the same OCSF schema - Trace lateral movement across three clouds using federated identity - Write a detection rule that catches cross-cloud federation abuse.

Speaker Bio:

Bryant Pickford is a Security Specialist Solutions Architect at AWS, where he leads security, risk, and compliance discussions with enterprise customers to align strategies and drive secure outcomes on the AWS platform. With over five years at AWS and deep expertise in Edge Security, Threat Detection, and Generative AI, Bryant specializes in identifying emerging threats and developing practical defense strategies for cloud-native environments.

11:00-13:00

🗡 Attack Lab: Naveen Reddy Pogalla & Hari Pranav Arun Kumar
The Autonomous Insider

+

Venue: Zone A, Room 312

Instructor: Naveen Reddy Pogalla & Hari Pranav Arun Kumar

Abstract:

In 2026, the 'Cloud Perimeter' has shifted from IP addresses to Agent Identities. This lab explores the intersection of Generative AI and Cloud Misconfiguration. We move beyond the prompt, demonstrating how classic architectural flaws-like over-permissive VPC Endpoints, missing IAM Conditions, and SSRF-prone Tool-call environments-allow attackers to turn a 'helpful' AI assistant into a cross-account exfiltration engine. Attendees will learn to exploit and then 'shackle' these agents using VPC Service Controls, SCPs, and automated remediation workflows.

Prerequisites:

Web browser and familiarity with chatbots and AWS.

Instructor Bio(s):

Naveen Reddy Pogalla

Naveen works within the Product Security Engineering team at Google Cloud, operating at the intersection of data and defense. Specializing in Cloud Security Posture Management and engineering automated remediation accelerators, he analyzes the broader risk landscape to drive remediation and hardening at scale. Rather than just hunting for individual bugs, his goal is to build a more secure cloud by identifying and eliminating entire classes of vulnerabilities before they can be exploited. Naveen thrives on solving high-stakes security challenges that require a blend of analytical rigor and an offensive security mindset. Prior to Google, he empowered clients as a Security Consultant at EY and Grant Thornton, with expertise spanning network security, vulnerability assessments, and GRC. He holds a Master’s degree in Cybersecurity Analytics and Operations from Penn State University and a Bachelor’s in Computer Science Engineering.

Hari Pranav Arun Kumar

HP is a Security engineer and my job includes working on improving cloud, application and runtime security. He has worked with the cloud village team, developing CTF’s over the past two years. He love to tinker, participate in hackathons and eventually found my passion for security. Looking forward to connecting and collaborating with everyone!

Our sponsors at

DEF CON 34

DIAMOND SPONSOR
(ANNUAL)

Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, our cybersecurity platform protects 500,000+ organisations and 250+ million individuals across clouds, networks, devices, and endpoints. Know More

DIAMOND SPONSOR
(ANNUAL)

Varonis protects the data where it lives. Their platform is purpose-built to look deeply inside and around data—and then automate its protection using patented, battle-hardened machine learning and AI. Know More

DIAMOND SPONSOR
(ANNUAL)

Amazon Web Services is the world’s most comprehensive and broadly adopted cloud, enabling customers to build almost anything they can imagine. They offer the greatest choice of innovative cloud and AI capabilities and expertise, on the most extensive global infrastructure, with industry-leading security, reliability, and performance. Know More

PLATINUM SPONSOR
(ANNUAL)

Aikido have category-leading security products across code, cloud, runtime, and autonomous penetration testing.
What makes them even stronger is context. By connecting code, cloud, and runtime data, their products work together to find the right issues and fix them faster. Know More

PLATINUM SPONSOR

Prowler builds open, adaptable, and community-driven solutions that empower security teams to stay ahead. Prowler stands at the forefront of this transformation. They offer an open-source, highly configurable security platform that empowers organizations to tailor their security assessments and monitoring strategies. Know More

BECOME A SPONSOR

If you are interested in sponsoring Cloud Village, drop us an email at
hello@cloud-village.org or fill in this quick Google Form.

We are community-driven village that strives to promote and support research in Cloud security community

BECOME A SPONSOR