// 01About

Highlights of 2025

4 MacBooks for attendees

Four new MacBook Airs from Freedom Holding Corp.: attend, take part in activities and follow the giveaways.

Prize shop

Themed books, sticker packs, merch and partner gifts — in exchange for AppSec coins earned at the booths.

// 02Speakers

22 speakers

// 03Program

How the day went

09:00–10:00

Registration and welcome coffee
10:00–10:05

Opening remarks

Sezdbek Temirbekov, CEO of AST Cyber Lab
10:05–10:40

How to make AI work for your security

Valeriya Kim, DerScanner

Details
How do you tell when AI helps and when it creates risk? What new threats does it bring to application security, and how can you use it wisely to raise both team efficiency and security?
10:40–11:05

Secrets of package managers. And where does security come in?

Igor Petrov, CodeScoring

Details
Basic rules and principles of package managers in the context of software composition analysis. How much control does a developer really have over what goes into the product?
11:05–11:30

The evolution of Application Security: are we on the right path, comrades?

Anton Mikhailov, ITD Group

Details
ASOC and ASPM as the next step of DevSecOps: how well does aggregation and correlation of data from different tools work, and does the snowball of false negatives and false positives turn into an avalanche?
11:30–12:00

Coffee break
12:00–13:00

Panel discussion: AppSec — everything you wanted to know but were afraid to ask

Alexey Fedulaev, Bakytzhan Seitkazin, Svetlana Gazizova, Tatyana Korshikova
13:00–14:00

Lunch
14:00–14:20

Anatomy of a breach: DevSecOps through an attacker’s eyes

Rasul Aitbayev, Freedom Holding Corp.

Details
What DevSecOps looks like through an attacker’s eyes, illustrated with real incidents and common mistakes.
14:20–14:55

All right, keep your secrets secure

Alexey Fedulaev

Details
Threats and attacks aimed at compromising secrets, whether Vault will save you, delivering secrets to k8s, and how secrets design affects application security.
14:55–15:15

Host: oops.domain.internal — a cheat code into the infrastructure

Oleg Yurchenko, RTEAM

Details
How a single external IP and a Host header open access to private services.
15:15–15:40

Frontend Application Security Testing (FAST)

Mikhail Parfenov, DPA Analytics

Details
Why classic analyzers don’t work for frontend applications and how to protect against supply chain attacks in JS libraries.
15:40–16:10

Coffee break
16:10–16:40

Your forgotten EC2 instance is my entry point

Ekaterina Shevchenko

Details
How attackers find forgotten EC2 instances, extract AWS access keys and do reconnaissance inside a cloud account — and how to defend against it.
16:40–17:10

Rolling out SSDLC step by step, and the pitfalls

Ivan Filko

Details
Why Application Security starts with a document, not with buying a SAST tool.
17:10–17:20

Wrap-up and prize giving

09:00–10:00

Registration and welcome coffee
10:00–10:05

Opening remarks

Timur Shaikhin, CTO of AST Cyber Lab
10:05–10:40

How to do a Security Code Review and keep your sanity

Daniel Chernov, DerScanner

Details
The main problems of code review — from missing standards to the difficulty of finding vulnerabilities — and why automation matters so much.
10:40–11:05

Security layers of a financial application: how deep the rabbit hole goes

Denis Valyaev, CSD

Details
A securities trading system built in 9 months by a team of 4: how to meet high security requirements with small resources.
11:05–11:25

Infrastructure evolution: from colocation to Managed Kubernetes

Dmitriy Pak, Kazteleport JSC

Details
Moving a business from physical hardware to IaaS and Managed Kubernetes.
11:25–11:55

Coffee break
11:55–13:00

Panel discussion: The future of development — how the roles of Dev, DevOps and AI in building software are changing

Renat Tukanov, Farukh Bakiev, Nikita Bayev
13:00–14:00

Lunch
14:00–14:25

Balancing Innovation, Speed and Security with the Evolution of AI

Soffian Osman, Sonatype

Details
Balancing innovation, speed, and security in the evolution of AI is crucial for responsible and sustainable progress.
14:25–14:55

Fixed but not fixed: how bugs mutate

Tatyana Korshikova

Details
How a small caterpillar vulnerability turns into a butterfly vulnerability, and why tools can’t protect you from people themselves.
14:55–15:20

UI tests in action: from scenario to stable runs

Temirlan Birzhanov

Details
Architecture, approaches and mistakes of UI automation, with a live demo.
15:20–15:50

Coffee break
15:50–16:25

AppSec is on line two! Securing machine learning models

Svetlana Gazizova

Details
The main threats when operating ML models and the defenses against them — both for the development pipeline and model-specific.
16:25–16:50

1C for everyone, everyone on 1C: how not to administer accounting

Adil Nurmanov, DataArt

Details
A first dive into 1C security: client-server, encoding vs encryption, and unusual scenarios with external processing modules.
16:50–17:10

“Never do this”: practical secure backend development

Konstantin Mazurov, Technodom and Airba

Details
Common security mistakes Go developers make in business logic, based on real production cases.
17:10–17:20

Wrap-up and prize giving (in Sec Zone)

// 04OpenCTF

Try yourself as a hacker

OpenCTF in collaboration with Mimicats Team

An open CTF competition by the mimicats team: level up your skills on real information security challenges. A unique format with maximum practice and no theory — just you and the challenge.

[Web Exploitation]Find vulnerabilities in web applications

[Mobile]Test mobile applications

[OSINT]Solve tasks using open-source intelligence

[Reverse Engineering]Analyze and break executables

Solve→Earn points→Get AppSec coins→Trade them for prizes

! Bring your own laptop!

// 05Partners