AppSecFest2026
Where development, DevSecOps and security meet in real cases, practices and attacks from the inside
Highlights of 2026
We discuss real vulnerabilities and demo attacks live.
Look at your infrastructure through the eyes of an attacker.
Building security into CI/CD and protecting AI models.
A meeting place for developers, security engineers and CTOs.
13 speakers
How the day went
-
9:00–10:00Registration and welcome coffee
-
10:00–10:03Opening remarksSezdbek Temirbekov, CEO of AST Cyber Lab
-
10:03–10:05Address by general partner DerScannerAidana Derbekova, AppSec Triage & CodeFix Engineer at DerScanner
-
10:05–10:30From VibeCoding to Enterprise-level Specification-Driven Development: tracking, control and governanceAlexander Tyutin, DevSecOps at Semrush (Adobe)
Details
AI-assisted and Specification-Driven Development have become part of our lives, and hundreds of companies have grown around them. How do you make this scalable and manageable? The speaker shares his experience launching a product, looking at development and governance through ISO/IEC 42001:2023 and other frameworks, with a focus on Responsible AI.
-
10:30–10:55Bugbounty: Hack. Earn. Repeat — building an independent platform for bug hunters, by bug huntersDauren Bazarbekov and Oleg Yurchenko, RTEAM
-
10:55–11:25Coffee break
-
11:25–11:55The DevSecOps Backbone: Centralizing Security Workflows in HashiCorp VaultAdam Breznen, IBM
Details
How HashiCorp Vault goes beyond a key store and becomes a full security lifecycle platform: dynamic credentials, automated certificate management and centralized data encryption.
-
11:55–12:25The Post-Cookie WebSergey Belov, Freedom Holding Corp.
Details
Device-bound sessions, FedCM, WebAuthn L3, and the new browser primitives hardening the session layer.
-
12:25–12:55Prompt-to-Prod: how not to vibe-code vulnerabilitiesSvetlana Gazizova
Details
How AI changed the speed of code delivery and why classic AppSec approaches can’t keep up with neural networks. We look at “security hallucinations” — when AI suggests code that works but is full of holes (outdated libraries, SQL injections, insecure architectures) — how to prompt securely, and put together a list of useful tips and safe prompts for every developer.
-
12:55–14:00Lunch and activities!
-
14:00–14:35What Open Source Malware Does Today?Cameron Townsend, Principal Architect at Sonatype
Details
Current observations on the evolution of open source malware and why software supply chain protection is becoming critical for modern development and security teams.
-
14:35–15:10Running an International Bug Bounty: lessons from our first year in productionKarina Abakova, Head of Product Security at Beeline Kazakhstan
Details
Launching a bug bounty is not just about the platform but about whether your processes, teams and infrastructure are ready for real attacks. How we launched an international program, what problems we hit and what we changed during the first year: practical takeaways, metrics and telling cases.
-
15:10–15:45A canary in the production mineArnur Nurov, team lead at a large fintech corporation
Details
How to roll out canary deployments in a large company and automate metrics collection.
-
15:45–16:15Coffee break and networking
-
16:15–16:45AppSec on a shoestring: building cyber defense with limited resourcesMikhail Markevich, independent cybersecurity expert and mentor
Details
Worldwide, large companies have one AppSec engineer per 75–100 developers, and only 40% of them have the necessary skills. How to organize minimally secure development in practice when people, time and budget are short.
-
16:45–17:10Secrets management: rolling out Vault and a custom clientArseniy Savin, technical architect and developer, ONAY!
Details
How we built a secure development perimeter (Dev/Stage/Prod) within SSDLC and moved from chaotic secret storage to centralized management with HashiCorp Vault. Why we needed our own client, how we rolled it out without changing CI, and the mistakes we made along the way.
-
17:10–17:355G network securityZharkynai Yespolova, Huawei
Details
Modern attacks on mobile networks and 5G vulnerabilities, and the security paradox: how technical improvements such as beamforming can open new attack vectors. Real cases and approaches to solving them.
-
17:35–17:45Kahoot quiz
-
17:45–17:55Kahoot awards and closing
Hands-on practice and live talks
This workshop explores the practical automation of internal and external certificates using HashiCorp Vault. Participants will learn how to implement native and ACME-based workflows to manage certificate lifecycles seamlessly across both legacy VM environments and modern Kubernetes platforms.
A chance to take a breath and talk about security the way colleagues usually do only in a close circle: AppSec, DevSecOps, engineering culture, processes, failures and discoveries — everything that rarely fits a formal format. No schedule or rules — the conversation goes wherever the community takes it.
Try yourself as a hacker
OpenCTF in collaboration with Mimicats Team
An open CTF competition by the mimicats team: level up your skills on real information security challenges. A unique format with maximum practice and no theory — just you and the challenge.
! Bring your own laptop!
Partners of the edition
