Cybersecurity Events in Oslo
European infosec has its own character: community-run, less vendor-dominated than its US counterpart, and unusually healthy at the meetup layer. This page tracks the conferences, BSides events, OWASP chapter meetings, AppSec sessions, red-team/blue-team meetups, and capture-the-flag gatherings that make up that scene.
This page narrows the Oslo calendar to Cybersecurity events. It's a subset of Norway's wider tech-event schedule, useful when you want something specific to go to in the city this month.
Upcoming tech events in Oslo, Norway.
Upcoming Cybersecurity events in Oslo
OWASP Oslo September meetup
Oslo, 🇳🇴 Norway
Time: 17:00-19:00 on 7 .Sept
Location: Rebel, Universitetsgata 2. Room: Auditorium 0100 (https://www.rebel.no/konferansesenter/konferanselokaler/auditorium-0100)
Agenda:
17:00 - 17:20: Food and drinks
17:20 - 18:10: Testing API Business Logic With AI Agents: What We Got Wrong First (speaker: @Lucas Thietart)
18:10 - 19:00: From Patch to Pwn: Combining AI and static analysis to create a novel PoC for WP2Shell (speaker: @Katie Paxton-Fear)
Escape (https://escape.tech/) and Semgrep (https://semgrep.dev/) is sponsoring this event.
The sponsors will provide pizza and something to drink during the talks, and after the talk they will provide something to drink in a nearby bar for those that want to stay and mingle after the talks.
-----
Testing API Business Logic With AI Agents: What We Got Wrong First (speaker: @Lucas Thietart)
Automating API security testing sounds straightforward until you try it on a real enterprise API with complex auth and business flows. Over the past few years I've been building AI agents to test business logic vulnerabilities . This talk is an honest account of what we got wrong in that process.
We'll cover three specific failures: testing before we understood resource relationships (and what that did to our IDOR detection), over-relying on agents for things deterministic methods handle better, and ignoring domain context until it became impossible to ignore. Each failure changed how we built the system. Some of the lessons were obvious in retrospect. None of them were obvious at the time.
The goal is to give anyone working on similar problems an honest look at where automated business logic testing actually breaks down and why the gap between a clean test environment and a real enterprise API might be harder to close than it looks.
The speaker is @Lucas Thietart.
Lucas Thietart is a Solution Architect at Escape, where he helps organizations secure modern applications and APIs through AI-powered pentesting. Leading customer engagements across EMEA, he works closely with security teams to identify exploitable vulnerabilities, integrate security into the SDLC, and strengthen application resilience at scale. His background spans cybersecurity and data engineering, with previous experience at CHANEL and N7 Racing Team.
---------
From Patch to Pwn: Combining AI and static analysis to create a novel PoC for WP2Shell
How can we bridge the gap between static analysis and dynamic exploitation? Easy, why not use both! We're going to demonstrate how combining SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing) workflows can uncover vulnerabilities that are easily missed by either approach in isolation.
We'll dive into "WP2Shell" – a disclosed pre-authentication RCE in WordPress – and walk through the process of reverse-engineering a patch to build a novel Proof of Concept (PoC). By utilizing "Mandoline" to slice code and map complex call graphs, we'll identify potential entry points, then use dynamic analysis to observe how those call graphs work in practice.
In the session, you'll learn how to use static analysis tools to generate actionable leads for dynamic testing, effectively covering the blind spots of each methodology and accelerating the creation of effective PoCs.
The speaker is Katie Paxton-Fear who is Staff Security Advocate at Semgrep.
Knowledge Graphs for Threat-Intervention Gap Analysis
Oslo, 🇳🇴 Norway
Sunstone Institute publishes open analysis on thirty of the largest threats to humanity, from climate to conflict to democracy. The impact we have largely depends on our choice of topic, and today that choice is made purely with human judgement.
The question we are working towards is whether it can be made systematically: for a given threat, what is actually being done about it, where is the gap largest, and can new public analysis change anything? That requires representing threats, interventions and the evidence between them in a form you can query and reason over. This talk covers the groundwork: an ontology relating threats to intervention mechanisms, LLMs used in a deep-research fashion to draft domain maps we then curate into SKOS vocabularies, claim extraction with NER and ontologies, and HornDB, an OWL 2 RL reasoner we wrote in Rust.
A lot of this work is still not done: comparing threats across domains as different as health and democracy is an open problem. I am giving this talk partly to describe our approach and partly to connect with people who have worked on related problems.
Speaker: Stig Bakken, CTO Sunstone Institute