Hacker Summer Camp 2026

Semgrep is heading to BSides Las Vegas to connect with builders and security leaders shaping the future of AppSec.

Stop by our table to learn more about our latest product launch to help developers reduce noise and ship secure code faster.

Semgrep is heading to BSides Las Vegas to connect with builders and security leaders shaping the future of AppSec.

Stop by our table to learn more about our latest product launch to help developers reduce noise and ship secure code faster.

Cryptographic failures rarely come from bad math. They come from a skipped validation check, unvalidated input, or the wrong algorithm picked under deadline pressure. Diptendu is giving this talk twice: once at BSidesLV and again at DEF CON's Crypto & Privacy Village, using GitHub Security Advisories data (collected as of January 2026) to walk through the OWASP Cryptographic Failures category. Expect real vulnerable open-source libraries, signature verification bypasses, algorithm confusion bugs, and live demos with CTF-style challenges built in. No cryptography background required to enjoy this talk.

PBC Connect events bring together CISOs, AppSec, infrastructure security, product security, AI security, and cyber resilience leaders for high-value discussion, networking, and community-building.

This year's Black Hat gathering will focus on the future of AI security, vulnerability management, product security, and frontier AI risk, anchored by a featured fireside chat with Jason Clinton and Phil Venables on how security leaders should prepare for the risks from advanced AI capabilities.

Register here!

Unwind while you network in The Business Hall before the first full day of Black Hat kicks off at the Welcome Reception. Meet fellow Attendees, Speakers, Exhibitors (check us out, booth #4943), and Staff over appetizers and refreshments.

Kicking off the week with a fireside-style conversation on what it actually looks like when AppSec, CTOs, and software teams try to agentically engineer their way into the future. Grab a drink at the Welcome Reception first. This one's meant to feel like a conversation, not a keynote.

Semgrep is heading to BSides Las Vegas to connect with builders and security leaders shaping the future of AppSec.

Stop by our table to learn more about our latest product launch to help developers reduce noise and ship secure code faster.

Visit us in booth #4943 for custom live demos and to learn how Semgrep’s low-noise results and AI guidance across SAST, SCA, and Secrets can help you fix vulnerabilities early, speed up releases, and reduce risk.

AWS Partner Demo

70% of engineering leaders list AI adoption as their #1 goal for increasing velocity. 59% of those same leaders say security threats and data control are what's stopping them. Katie and Milan get into how to bring tools like Cursor, Codex, Claude Code, and Replit onto your dev teams without losing the plot on security. Bring your AI IDE questions. Between the two of them, they've probably heard your exact one already.

"From Detection to Decision: How Semgrep and ArmorCode Close the Loop at Machine Speed"

Fireside Chat: "How Synthesia Automates AI Code Security Reviews: Built on AWS, Secured by Semgrep"

Visit us in booth #4943 for custom live demos and to learn how Semgrep’s low-noise results and AI guidance across SAST, SCA, and Secrets can help you fix vulnerabilities early, speed up releases, and reduce risk.

AI writes code fast but security review still moves at human speed. Space Rogue and Pablo get into what it takes to close that gap without turning review into a rubber stamp. If your team's already shipping AI-generated code faster than anyone can keep up with, come compare notes.

"Sysdig + Semgrep: From 10,000 Findings to the 10 That Matter"

International Copyright Equipment Services

Join Semgrep Co-Founder & CTO, Drew Dennison, as he breaks down "Using SAST + Mythos To Shift Right." Learn how using SAST + LLMs + tools + data to find bugs at scale.

Whether you’re coming from Black Hat sessions, hanging with the BSides crew, or gearing up for DEF CON madness, join us for a night of fun and games.

No pitches. No slide decks. Just a good food and good people.

Cryptographic failures rarely come from bad math. They come from a skipped validation check, unvalidated input, or the wrong algorithm picked under deadline pressure. Diptendu is giving this talk twice: once at BSidesLV and again at DEF CON's Crypto & Privacy Village, using GitHub Security Advisories data (collected as of January 2026) to walk through the OWASP Cryptographic Failures category. Expect real vulnerable open-source libraries, signature verification bypasses, algorithm confusion bugs, and live demos with CTF-style challenges built in. No cryptography background required to enjoy this talk.

After curl shut down its HackerOne program in January 2026 under a wave of AI-generated reports — some weeks saw seven reports in sixteen hours, none valid — Katie and Max are introducing Slop Spotting: a lightweight triage method that uses SAST rule generation as a validity signal. The core idea: if a vulnerability is real and well-specified, you should be able to write a SAST rule for it and get a result. If it's slop, even convincing slop, you get a fast no. Anyone who's watched a maintainer drown in obviously-fake reports will recognize the problem immediately.

Kindles, Kobos, Boox, BigMe — eReaders look like the most boring IoT device you own, until you look underneath the eInk display. Katie digs into the quirks of hacking these devices, from jailbreaking a locked-down Kindle to the xTeink's open-source Crosspoint firmware. Bring your own eReader. She might jailbreak it for you on the spot.