Cork|Sec 161

Running since June 2013, every month we have 1-2 talks focused on Security or Technology - followed by socialising with like minded people

• You can find out exactly what to expect about the night and the venue on the What We're About section of our Meetup page. Past talk details can be found the "Past Events" section.
• All people with any sort of an interest or level of knowledge in Security, Hacking and Emerging Technology are more than welcome to attend and feel free to bring like minded colleagues and friends.

CorkSec is made possible through generous sponsorship from our Platinum Sponsor TrendAI, Gold Sponsor CyberSkills , as well as our Silver and Bronze Sponsors featured prominently on the night.

Our talks come from our community so if you have an idea for a topic (anything for 10-60 minutes) please email us at DefconCork@gmail.com . Whether you are an experienced presenter, or presenting for your first time - CorkSec is a great venue for it - and we are happy to help you prepare and mentor you.

Doors open at 19:00 with talks starting at 19:15. Talks below

TALK 1: Airgapped System | Not a problem. Lessons Developing Malware for a NATO Exercise by Sabastian Hague
Step inside the development process behind Exercise Locked Shields 2026, the largest and most complex cyber live-fire exercise in the world
Centri had the honour of supporting Locked Shields by developing realistic technical content for some of the most capable cyber operators globally. This session explores the challenge of building scenarios that are credible, relevant, and difficult enough to test defenders operating at enterprise and nation-state level.
You’ll hear how we approached the design of advanced exercise content, the considerations involved in developing realistic adversary behaviour, and how we balanced technical depth, safety, and learning value.
The session will also walk through one of the more intricate malware components developed for the exercise. Rather than relying on obvious destructive behaviour, this tooling was designed around specific operational objectives, showing how subtle functionality can be harder for commercial detection tooling to identify.
Can malware be effective without being noisy? Can highly specific functionality create a bigger detection challenge than overtly malicious behaviour?
Join us and find out.

TALK 2: Adopting AI for Threat Defense: What Actually Works (and What’s Still Hype) by Saurabh Khadtare
A lot of people in security are understandably skeptical of “AI” right now. Marketing slides promise fully autonomous SOC's, while real defenders are still drowning in huge alerts and brittle detection logic. At the same time, attackers are already using automation and AI‑adjacent tooling to scale phishing, brute forcing, credential abuse, and exploitation, so a purely manual defensive approach is becoming unrealistic.
In this talk, I’ll share practical lessons from working as a security engineer and Pentester on how AI is actually starting to help with threat defense, and where it absolutely should not be trusted on its own. I’ll break “AI for defense” into three buckets: classical ML/UEBA and anomaly detection, AI‑powered SOC automation for triage and noise reduction, and LLM‑based that help with summarizing incidents, writing queries/rules, and translating technical findings for non‑technical stakeholders. For each bucket, I’ll walk through concrete workflows and examples (using redacted or synthetic data) showing what sucked before, what AI does better, and what still needs a human in the loop.
I’ll also cover the major limitations and risks: hallucinations, weak multi‑step reasoning, prompt injection, and new attack surfaces introduced by LLMs and vendor tools. The goal is to give the audience a realistic blueprint for where AI can safely augment defenders today, and where “AI‑only” approaches are still pure hype.

We will also have a seat for the CPTA | Certified Penetration Testing Associate to give away on the night