BSides Munich 2026

Led by threat intelligence researcher Rakesh Krishnan, this 4‑hour hands‑on session uncovers the operational tradecraft of DPRK state‑sponsored threat actors. Participants will master practical threat‑hunting techniques to spot C2 infrastructure, uncover fake GitHub repositories, and dissect major campaigns like the $1.5 billion Bybit heist to bolster their organization's defenses.
Time: 14:00 - 18:00

Led by trainers Marius Genheimer and Leon Pang, this 4‑hour hands‑on workshop takes you through a real‑world APT28 attack chain, from phishing email to cloud‑blended C2, using an interactive platform and open‑source tools. Perfect for beginners and blue teamers looking for practical experience analyzing real malware artifacts safely in a virtual environment.
Time: 9:00 - 13:00

Led by Hans‑Martin Münch, this 4‑hour hands‑on workshop dives into the internal mechanics of .NET Remoting to uncover and exploit critical remote code execution vulnerabilities in legacy enterprise systems. Participants will learn how to bypass security controls like TypeFilterLevel.Low, walk away with practical exploitation checklists, and gain the skills needed to remediate these high‑risk endpoints.
Time: 14:00 - 18:00

Led by trainer Younes Ahmadzei, this 4‑hour hands‑on workshop takes you beyond simple “yes” or “no” compliance checks to perform an evidence‑based audit on a fictional German SME preparing for NIS‑2. Participants will analyze synthetic evidence packs across backup recovery, incident handling, and governance to identify gaps, request better proof, and build a prioritized improvement plan.
Time: 9:00 - 13:00

Led by trainer Daniel Schwendner, this 4‑hour hands‑on workshop takes an adversary‑first tour of modern software supply chain attacks. Participants will build malicious packages, poison build pipelines, and harvest CI/CD credentials, then flip to defense to trace the blast radius and execute real‑world incident response in isolated, containerized environments.
Time: 14:00 - 18:00

Led by trainers Andoni Alonso and Pedro Martín, this 4‑hour hands‑on workshop walks through building a hardened CI/CD pipeline using free and open‑source DevSecOps tools. Participants will integrate core security checks like SAST, SCA, and secrets detection, using a “break‑and‑fix” approach to learn how to defend modern development workflows.
Time: 9:00 - 13:00

Led by Moritz Krause, this 4‑hour hands‑on workshop explores LLM‑specific security risks like prompt injection, RAG poisoning, and data leaks through interactive attack and defense exercises. Participants will jailbreak guardrails in a vulnerable Docker lab and then shift to defense, leveraging agentic coding tools to automate input validation and integrate security checks into CI/CD pipelines.
Time: 9:00 - 13:00

Led by John Strand, this 4‑hour hands‑on workshop explores how strategic deception technologies can derail fast‑moving, AI‑driven cyber attacks. Participants will learn practical techniques to mislead and delay agentic AI systems, directing attackers toward decoy assets to gain the critical time and visibility needed to defend modern environments.
Time: 14:00 - 18:00

Led by Linux kernel expert Michael Kerrisk, author of The Linux Programming Interface, this full-day workshop explores the low-level building blocks of container isolation and sandboxing. Participants will gain practical, hands-on experience using capabilities, namespaces, and control groups (cgroups) to restrict process privileges and cap resource consumption on modern Linux systems.
Time: 9:00 - 18:00

Hack the Vault, Save the Conference is an 8‑hour, hands‑on CTF workshop where you break into a rival conference’s Vault by exploiting real web vulnerabilities (SQLi, XSS, XSRF, WordPress) and climbing a live leaderboard with open‑source tools like nmap, sqlmap, and wpscan. Designed for developers, testers, and ops with no security background, you can play solo or in a team, follow progressive hints, and turn your everyday dev skills into offensive superpowers to spring the Vault and save the schedule.
Time: 9:00 - 18:00