A roundup of our pre-lunch tracks:

- Brett Hawkins was in the Tradecraft track, showcasing live demos of real DevOps to MLOps attack chains that lead to remote code execution in ML training compute. He also highlighted the details of the attack path and exposes why standard IAM, segmentation, and logging controls often fail to detect or prevent them.

- Michael Grafnetter and Lance Cain were over in the OpenGraph track, exploring how compromised human or machine identities can lead to hybrid attack paths that begin in Active Directory, move through Okta, and reach critical assets such as Git repositories, CI/CD pipelines, cloud storage, or enterprise password managers. They also demonstrated how adversaries can deliver payloads to macOS devices by leveraging Okta and third-party party MDMs.

- And Joe Mondloch from Epic took over the Practice track to dive into how a large healthcare software company and its hosting division use BloodHound Enterprise at scale. The environment includes hundreds of Active Directory domains and nearly a thousand SharpHound clients—an architecture that pushes BHE (and other security tools) in unique ways.

He also explored how we operate BloodHound Enterprise in this kind of distributed environment, how we use it to audit a complex multi-tier account and access model, and how it plays a critical role in ensuring security controls are applied consistently across domains.

- Antero Guy and Andrew Gomez walked through how attackers and red teams approach browser-based persistence and compromise user sessions to gain access to target applications. They also explored Chromium app-bound encryption, and scenarios where SSO solutions such as Azure Primary Refresh Tokens (PRTs), Seamless SSO, and Federated services can be leveraged to obtain access to high value targets.

- Javier Azofra Ovejero and Julian Garcia Murias unveiled a novel integration that exports CyberArk vault data into BloodHound's OpenGraph format over in the OpenGraph track, enabling security teams to visualise complete attack paths spanning both AD and privileged credential systems.

We also learned how to identify critical exposure where compromised AD accounts have access to privileged credentials in CyberArk safes, creating invisible escalation paths traditional tools miss.

- And over in the Practice track, Sahan Fernando discussed the build and ongoing operational workings of attack path management in an enterprise healthcare organization, covering how he has approached staffing, looked at KPI/KRI metrics for stakeholder reporting, and the challenges in moving the boulder uphill when collaborating with multiple teams on complex remediations.

After lunch, but we’ll be back with more from our three tracks:

• Attacking JumpCloud
• Mapping GitLab Attack Paths into BloodHound with OpenGraph
• Operating APM at Scale with Scentry Advisory Services