Virtually all privacy depends on well-designed cryptographic protocols, yet a person working in security should be able to examine a protocol without having to become a formal-methods specialist first. Existing tools offer considerable power — but should mastering that machinery be the price of admission?

Verifpal gives you an easy way to define the model. Use its language to describe who knows what, what they compute, and what they send. Built-in cryptographic operations, a browser-based workbench, live editor feedback and protocol diagrams guide you to an iterative model-attack-repair cycle that allows to you examine or enhance the protocol in terms of robustness. Close to the release of Verifpal 1.0 in August 2026, Verifpal was used to discover three new authentication flaws in WalletConnect, one reproduced against an unmodified SDK, and novel weaknesses in SimpleX Chat. Verifpal performs bounded attack search, not unbounded proofs.

We’ll look at three aspects of adversarial use of AI in this talk:

1. AI use along the kill chain: the changing economics of cyberthreats. In this section, we will take an interactive journey along the cyber kill chain to explore how AI adoption increases actor speed and sophistication, and which security controls are best suited to prevent those threats.
2. Lessons from the frontlines: how state-backed threat actors leverage AI every day. We will share concrete observations of how sophisticated threat actors leverage AI, including examples of self-generating malware.
3. Threats from AI adoption: how poorly planned adoption or excessive agency can create risks for companies and public institutions. We will discuss concrete examples of agents „going rogue” and which controls could have stopped them.

Enterprises run on cryptography — but hardly anyone can say where it actually lives. TLS gets terminated somewhere in the infrastructure, the container base image decides which OpenSSL you run, algorithms come from library defaults. Everything works, and that’s exactly the problem: healthy cryptography is invisible.

We term this „shadow cryptography”. It’s the functional crypto that nobody sees/manages end to end. Pressure is now building from several directions at once — shrinking certificate lifetimes (browser forum), faster vulnerability discovery (AI), tightening regulation, the post-quantum transition. Different storms, same weakness: not knowing your cryptographic landscape.

Cyberattacks rarely begin with a big bang. Attackers often move unnoticed through corporate environments for weeks before striking.

Yet what if these risks were visible beforehand?

Self-managed infrastructure promises agility and autonomy. But what happens when it also slips outside the visibility of the teams responsible for defending it?

Our session examines a real-world incident in which an independently operated infrastructure became the starting point of a full-scale compromise inside an enterprise. The breach remained undetected until it was uncovered by luck rather than by security controls – highlighting how ownership gaps can quietly become security gaps.