Blue Team Con 2026

arrow_back View All Dates

11:00am CDT

Fortress in a Box: Enterprise-Grade Kubernetes Security for the Organizations That Can't Afford It

Sunday September 13, 2026 11:00am - 11:50am CDT

In 2022, the Red Cross was breached and data from 515,000 vulnerable people was exposed. Amnesty International was surveilled by state-sponsored attackers. Bellingcat, the group that documents war crimes, is a constant target of state actors trying to destroy evidence.
These organizations protect the most vulnerable, and have zero security budget to defend themselves.
This talk presents Fortress in a Box, an open-source, one-command Kubernetes security platform built specifically for NGOs, journalists, and human rights organizations. It implements four layers of defense-in-depth: CI/CD scanning with Trivy, admission control with Kyverno, real-time runtime threat detection with Falco, and GitOps self-healing with ArgoCD — fully configured, zero Kubernetes expertise required.
Attendees will see a live demo where Kyverno blocks an insecure deployment and Falco catches unauthorized container access in seconds, routing alerts directly to Discord — no SIEM required.
Takeaways: a clear understanding of how defense-in-depth works in Kubernetes, the specific policies that block the most common attack vectors, and how to deploy Fortress in their own infrastructure that same day.

Speakers

José Lorenzana

DevSecOps Student & Open Source Developer

A computer science student and DevSecOps practitioner focused on making enterprise-grade security infrastructure accessible to organizations that need it most. With hands-on experience in Kubernetes, containers, and cloud security, their work sits at the intersection of technical... Read More →

Sunday September 13, 2026 11:00am - 11:50am CDT
Swissôtel Chicago 323 E Wacker Dr, Chicago, IL 60601, USA

Talk, Talk Track 1

Audience Intermediate
Subject Application Security / DevSecOps
global Y

12:00pm CDT

When the Package Is the Weapon: Detecting and Responding to npm Supply Chain Intrusions

Sunday September 13, 2026 12:00pm - 12:25pm CDT

Swissôtel Chicago

Your developers trust npm. Attackers figured that out before your detection stack did.
This talk is a ground-up forensic reconstruction of two real npm supply chain campaigns — the NX package compromise in late 2025 and the axios RAT campaign in March 2026 — told entirely from the defender's perspective. Not a theoretical exercise. This is what the logs actually looked like, what the tooling missed, and what finally surfaced the activity.
We walk through how a malicious git hook silently drops a RAT onto a developer endpoint the moment they run a routine yarn dlx command, why this technique is specifically engineered to stay quiet in standard endpoint telemetry, and what the attacker does next. The target isn't your servers. It's the MetaMask wallet sitting in your developer's browser profile and the seed phrases cached in their dotfiles. Cloud credentials are secondary — harvested and staged for resale while the crypto moves on-chain.
The second half of the talk is pure blue team. We'll share the Humio/LogScale query patterns that actually worked, the CrowdStrike telemetry fields that matter for this attack class, the detection gaps these campaigns deliberately exploit, and a hardening checklist your security team can hand directly to engineering.
Real IOCs and detection artifacts from live incident forensics will be released during the session.
You will leave with something you can use the same week.

Speakers

Mohit Bansal

Senior Engineering Manager, Security Engineering, Webflow

Mohit Bansal leads a security engineering team spanning SecOps, Vulnerability Management, Enterprise Security, Incident Response and security tooling. He brings 10+ years of security experience across application security engineering and leadership roles at multiple high-scale technology... Read More →

Sunday September 13, 2026 12:00pm - 12:25pm CDT
Swissôtel Chicago 323 E Wacker Dr, Chicago, IL 60601, USA

Talk, Talk Track 2

Company Webflow
Audience Intermediate
Subject Application Security / DevSecOps
global Y

Blue Team Con 2026

From $0.00

Tickets

Success you have shared X tickets.

Blue Team Con 2026

11:00am CDT

José Lorenzana

12:00pm CDT

Mohit Bansal

Get help with the event

Choose your checkout method

Success you have shared X tickets.

Blue Team Con 2026

11:00am CDT

José Lorenzana

12:00pm CDT

Mohit Bansal

Get help with the event