BSides Aarhus 2025 — Kickoff Conference Archive

Archive of the BSides Aarhus 2025 Kickoff Conference held June 14, 2025 at EAAA Aarhus. Two tracks of talks on threat hunting, malware reversing, mainframe hacking, WAFs, OT security, command and control frameworks, alert fatigue, and more.

On Saturday, June 14, 2025, BSides Aarhus held its Kickoff Conference at EAAA in Aarhus — the first event after the association’s relaunch. Two parallel tracks brought together ten speakers covering offensive security, malware analysis, cloud and OT security, mainframe hacking, threat hunting, and human-centred approaches to alert fatigue and security training.

This page is a permanent archive of the 2025 program, speakers, and agenda.

Speakers

Speaker A placeholder

Speaker A

BSides Aarhus 2025 speaker

Talk

System partitioning and segmentation in industrial and hybrid environments: This talk explored the practical trade-offs of dividing systems into security zones and conduits, and when this approach strengthens resilience versus when it adds unnecessary complexity. It covered risk-based design, shared control boundaries, and the operational realities of aligning architecture with standards such as IEC 62443.

Bio

This entry has been anonymized to protect personal information while retaining a high-level summary of the presentation topic.

Picture of Avester Fahimipour

Avester Fahimipour

Security Analyst at Conscia

Talk

Through the lens of a threat hunter: This session will provide a live and partially pre-recorded walkthrough of a threat hunting scenario. We’ll begin by discussing how the initial hunting hypothesis was developed, followed by a demonstration of a custom piece of malware designed to drop LSASS and evade Microsoft Defender.
The presentation will then dive into the process of crafting a hunting query, explaining the logic behind it and how it functions. We'll showcase how the query successfully triggers as a detection rule in Defender when the malware is re-executed. To complete the cycle, we’ll also run the same query in a threat hunting context to identify the activity.
Due to the time-consuming nature of some steps, select parts of the demo will be pre-recorded to ensure a smooth and focused presentation.

Bio

Hello, I work as a security analyst at Conscia. I have worked in the cyber security industry for 3 years now. I spend my free time cooking, watching movies and shows.
I have experience presenting at the OWASP chapter and the Conscia Security Festival, and I’ve also published a blog post on ActiveCountermeasures. In addition, I have created a mini-course on network security monitoring, which is on YouTube.

Picture of Bella Nielsen

Bella Nielsen

Forensics nerd and privacy enthusiast

Talk

From secure phone to insecure personalities: Ever thought of how much tracking a phone actually has?
In this talk we go through a secure phone, finding out which insecure personalities are behind the creation of it.

Bio

A young cybersecurity enthusiast that loves playing CTFs and researching random topics in their freetime

Picture of Francine Solheim

Francine Solheim

Cybersecurity Consultant

Talk

AuraCast: A Multisensory Proof-of-Concept to Combat Alert Fatigue in Cybersecurity: Security analysts face a constant deluge of alerts, dashboards, and decision-making pressure, leading to cognitive fatigue and missed anomalies. AuraCast is a proof-of-concept system that reimagines network monitoring through multisensory feedback using sound and light to support analyst awareness without adding complexity or screen time.
Developed as part of a master's thesis, AuraCast sonifies intrusion detection system alerts and pairs them with ambient IoT-based lighting (via Philips Hue) to create an intuitive, passive alerting environment. The goal? To reduce the cognitive load on analysts and allow faster, more instinctive responses, especially during high-volume alert scenarios.
In this session, I present the motivation behind AuraCast, the technical design of the system, and the results from usability testing conducted with both SOC professionals and IT generalists. I explore how auditory and visual modalities can be meaningfully mapped to security events, and how this prototype performed when evaluated against traditional visual-only setups using NASA-TLX cognitive load assessments, response times, and qualitative feedback.
I’ll also discuss the practical, unfiltered challenges of building and testing something experimental, from deployment constraints to user scepticism, and reflect on what it would take to bring a concept like this into production in SOC environments.
Whether you're interested in human-centred cybersecurity, creative monitoring solutions, or just want to know what happens when intrusion detection meets MIDI and mood lighting, this session offers a unique angle on how we can support the humans behind the screens.

Bio

I'm a Cybersecurity Consultant with a Master’s degree in Cybersecurity Leadership and a strong technical background. I hold a range of industry certifications, including CompTIA Security+, CySA+, Pentest+, and SecurityX (formerly CASP+), as well as ISC2 SSCP and CC, and Microsoft AZ-500 and SC-300. My work spans vulnerability management, detection engineering, and systems hardening, with a particular interest in practical, scalable solutions for SOC environments. While my thesis involved human testing and cognitive load analysis, my focus has always been on the technical design, implementation, and evaluation of tools that improve detection and reduce noise. I enjoy building things that actually work - and then stress-testing them.

Picture of Jack Fitzsimons

Jack Fitzsimons

Security Consultant at Reversec

Talk

Bending the Big Iron: An Introduction to Mainframe Hacking: Mainframes underpin a lot more of society than we think - banks, airlines, supermarkets, day-to-day card transactions etc. Daily life would become much more inconvenient - or come to a halt entirely, without them. Yet many in the security community know very little about them and/or consider them legacy technology.

Having started working with mainframes around 2 years ago, I'd like to raise a bit of awareness and share some knowledge of the area.

This talk will demystify some perceptions and assumptions about mainframes in general, show that they're far from legacy technology, and give some useful advice on what you can do if you find yourself 'in front' of one or just want to explore further.

Bio

Jack is a security consultant at Reversec where he spends the majority of his time doing mainframe and cloud things.

He has previously given talks at BSides København and Disobey in Helsinki.

Picture of Klaus Agnoletti

Klaus Agnoletti

Storytelling Cyber Security Advisor at Relations Security

Talk

Dungeons & Dragons: The security tool you didn't know you needed: Tired of security training that puts your team to sleep? What if I told you the most powerful training tool in cybersecurity has been sitting in your game room all along? Welcome to the world of game-based learning, where the proven power of play transforms how professionals master complex skills.

Research shows that humans learn best when working together, yet traditional training methods keep pushing isolated, theoretical learning. Game-based learning flips this approach on its head, creating environments where people forget about office politics and actually engage with the material. Through structured play and collaborative storytelling, participants don't just memorize concepts—they live them, breaking down professional barriers and building genuine understanding through experience.

I'll show you the compelling evidence behind why using roleplaying games work, and demonstrate how to transform resistant learners into engaged participants. Using compelling examples, you'll discover how tabletop role-playing mechanics can turn your most challenging training scenarios—from incident response to zero trust architecture—into adventures your team actually looks forward to.

Join me to learn why adding roleplaying games to your professional development isn't just about making training fun—it's about making it work.

Bio

Klaus Agnoletti has been an all-round infosec professional since 2004. He co-founded BSides København in 2019. Recently he started out as an infosec freelancer focusing on storytelling in marketing, employer branding, game-based learning or wherever new ideas bring him.

Picture of Mark Steenberg

Mark Steenberg

Senior consultant at Truesec Denmark

Talk

Creating Your Own Command Control Framework: In this talk I will go through how to create your own command and control framework. We will go through architecture, API design, Agent design, and how you could implement this.
I'll show examples of how this can be done and share general info and knowledge about considerations for different protocols, infrastructure etc.

Bio

@Truesec | GCFA | HTB APTLabs, Cybernetics, RastaLabs, Offshore, Dante, Zephyr | eCRE, eCMAPv1, eCPTXv2, eCXD, eCTHPv2, eCDFP, eCIR, eNDP, eWPTXv2, eWDP, eCPPTv2, eWPT, eMAPT, eJPT | CARTP, CRTP | az-900 | CVE-2021-44151, CVE-2021-44152, CVE-2021-44153, CVE-2021-44154, CVE-2021-44155

Picture of Knud Højgaard

Knud Højgaard

Principal security consultant at Fraktal

Talk

From promises to performance: A critical review of (mostly cloud) WAF solutions: Dive into the world of Web Application Firewalls (WAFs), exploring the strengths and limitations of leading providers such as Azure & AWS, as well as some decidedly commercial offerings. Through a detailed evaluation based on a subset of the OWASP Top Ten vulnerabilities, DoS/DDoS protection and AI/ML capabilities, we uncover whether WAF solutions deliver as promised in terms of protecting against common and bespoke web threats. Participants will gain insights into practical recommendations for selecting and deploying WAFs effectively, emphasizing the integration of developer expertise for enhanced security models. A blend of technical analysis and identification of weak areas despite what glossy brochures would have you believe.

TL;DR: A quick look at what a WAF is, some of the commercial offerings in WAF space, what it can and cannot do for you, some WAF fails

Bio

Knud works at Fraktal.fi in the exciting field of information security. Interests and focus areas span wide, from lock manipulation and covert entry to vulnerability discovery and exploit development, usually focused on traversing trust boundaries one way or another. He enjoys popping shells and stealing corporate secrets, with permission naturally.

Picture of Martin Clausen

Martin Clausen

Cyber & AI at Jyske Bank

Talk

Go-ing Under the Hood: Practical Malware Reversing for Threat Intel: This session shows how to peel back some of the layers of modern Golang-based malware. We’ll start with a lightning refresher on Go’s language quirks and its distinct ELF/PE binary layout, then move into tooling and workflows for reversing. Along the way, you’ll see how dissecting real-world samples yields IOC intelligence and insights that feed blue-team detections, and ultimately flip the advantage from attackers to defenders.

Bio

Martin is a Cyber & AI specialist at Jyske Bank with 20+ years of experience across blue-team defense, red-team offense, security architecture, and leadership. His driving passion is to rethink security and solve cyber challenges the right way—shifting the asymmetric advantage from attackers to defenders.

Picture of Michael Weng

Michael Weng

Senior OT Security Specialist at SektorCERT

Talk

Wanna play with OT and Cyber Security? Play with Labshock, then: Labshock is a newly created OT Cybersecurity lab in Docker, that's easily deployed and immediately gets you to play and learn about all things OT/ICS Cybersecurity - We'll go through deployment and one attack simulation together

Bio

Michael is an Experienced OT/ICS Cyber Security Professional. Started designing and building pharmaceutical manufacturing networks and systems. Later gained Operational experiences which prepared him for the real passion he holds – Protecting OT/ICS. He has had numerous roles as a Senior Principal/Consultants for companies like NCC Group and F-Secure/WithSecure. He served 2 years as the first SE for Nozomi Networks in the Scandic and Baltic Region. Michael’s favourite discipline is Blue Teaming. He believes that defence is doable and now works as a Senior Analyst in the SOC of SektorCERT. He spends time on Alerts, Detection Engineering, Network Forensics, and IR, predominantly. He also oversees Sensor Deployments in a third of the Country (Denmark).

Michael is an experienced speaker at venues such as S4 in Miami, and CS3 in Stockholm, and ofc at conferences at numerous other places around Europe.

Agenda

EAAA Aarhus · 14 June 2025

Track 1

Track 2

Sponsors