LASCON 2026 Training

L ASCON Trainings are events held in conjunction with the LASCON conference. Trainers are highly respected and experts in their field. Typically, the trainers have presented at several other quality events unrelated to OWASP, like Black Hat or other industry events. For LASCON 2025, the training offerings are both two day and one day trainings - please check the training you are signing up for the length.

Trainer:

Abstract:

This intensive 2-day secure coding training immerses participants in the mindset of both attacker and defender, using a purpose-built vulnerable web application developed specifically for this course. The application reflects realistic development patterns and serves as a hands-on environment to explore, exploit, and ultimately fix security flaws commonly found in modern web applications.
The training is based on the OWASP Top 10 Web 2025 and is structured as a continuous, experience-driven journey through today’s most critical risks. Each topic follows a consistent and practical approach: participants first get familiar with the vulnerability and its real-world impact through concrete examples and breach scenarios, then actively exploit the issue themselves in a guided hands-on lab, and finally work through effective mitigation strategies and secure coding techniques.
This progression, from understanding risks, to attacking them, to see the mitigations, ensures that participants not only recognize vulnerabilities but also truly understand how they emerge and how to prevent them in their own codebases.
While the training primarily uses Java-based examples to demonstrate secure implementation patterns, all concepts and techniques are explained in a language-agnostic way, making them applicable across a wide range of modern technology stacks. The workshop covers common areas such as input validation, authentication and session management, access control, and secure handling of data within API-driven applications.
By working through realistic attack and defense scenarios, participants develop a deeper, practical understanding of secure coding. The goal is to move beyond theory and enable developers and security professionals to integrate security thinking directly into their daily development workflow.

Trainers Bio: Senior Security Consultant

Rico is a senior security consultant at adesso SE. His main security areas are in application security, cloud security, offensive security and AI security.
For him, general security intelligence in various aspects is a top priority. Today’s security world is constantly changing and you should always familiarize yourself with the most up-and-coming technologies and methodologies.
As a husband and father of two, he enjoys spending time with his family and exploring the world with them.

Trainer:

Abstract:

Can prompt injections lead to complete infrastructure takeovers? Could AI agents, MCP-connected tools, or poisoned external context be abused to compromise backend services? Can data poisoning in AI copilots impact a company’s stock? Can jailbreaks create false crisis alerts in security systems? This immersive, CTF-styled training in GenAI, LLM, agent, and MCP security dives into these pressing questions. Engage in realistic attack-and-defense scenarios focused on real-world threats, from prompt injection and remote code execution to backend compromise, tool abuse, unsafe agent orchestration, trust and authorization failures. Tackle hands-on challenges with live AI applications to understand vulnerabilities and build robust defenses. Learn how to build a comprehensive security pipeline, master AI red and blue team strategies, secure tool-connected and agentic systems, implement resilient guardrails for LLMs, and handle incident response for AI-based threats. You will also explore governance, Responsible AI, and enterprise security patterns for modern AI ecosystems.
# By the end of this training, you will be able to:
- Exploit vulnerabilities in AI applications to achieve code and command execution, uncovering scenarios such as instruction injection, agent control bypass, remote code execution for infrastructure takeover, as well as chaining multiple agents for goal hijacking.
- Conduct AI red-teaming using adversary simulation, OWASP LLM Top 10, and MITRE ATLAS frameworks, while applying AI security and ethical principles in real-world scenarios.
- Execute and defend against adversarial attacks, including prompt injection, data poisoning, jailbreaks, agentic attacks, and insecure tool-connected workflows.
- Perform advanced AI red and blue teaming through multi-agent auto-prompting attacks, implementing a 3-way autonomous system consisting of attack, defend, and judge models.
- Build and deploy enterprise-grade LLM defenses, including custom guardrails for input/output protection, security benchmarking, penetration testing of LLM agents, and defensive controls for MCP-enabled integrations.
- Understand MCP fundamentals and assess how they expand the attack surface of modern AI systems.
- Establish a comprehensive LLM SecOps process to secure the supply chain from adversarial attacks and create a robust threat model for enterprise applications, including AI systems connected to external tools and data sources through MCP-like architectures.
- Implement an incident response and risk management plan for enterprises developing or using AI services.

Trainer Bio: Cyber Security Research in AI,Cloud & Data

Abhinav Singh is a security leader, founder of Wingback Security, and a globally recognized speaker and trainer focused on securing enterprise AI systems. He has been involved with AI fellowship and research communities including MATS, PIBBSS, CSA, AIUC, and the Foresight Institute. He is a frequent speaker and trainer at Black Hat, RSAC, DEF CON, OWASP, BruCon, NeurIPS, and other major conferences worldwide. He is also the author of “Metasploit Penetration Testing Cookbook” and “Instant Wireshark Starter”. His work spans patents, open-source tools, academic & research publications, and bridges advanced AI security research with practical enterprise defense, with a focus on securing AI applications, agents, and enterprise AI infrastructure.