Sessions worth an hour

The archive opens with the first two recorded sessions. Until then, the slate below is what the programme will be drawn from.

1. 01

   Testing access control properly: why one session is never enough

   The technical argument that access control is a relationship between identities, and that single-session tooling cannot observe relationships. Demonstrate cross-role testing live, with two sessions held simultaneously and cross-access attempted.

2. 02

   Finding the endpoints nothing calls

   Specification-driven API testing versus interface-driven crawling. Take an OpenAPI spec, show the gap between declared endpoints and endpoints any front end exercises, and test the difference. Covers GraphQL introspection and gRPC too.

3. 03

   What a validated finding actually contains

   Walk one finding end to end: the request, the response, the reproducible curl, the CVSS vector, the CWE class, the remediation with vulnerable and secure code, the retest.

   Aimed at teams evaluating whether validated output changes their triage cost.

4. 04

   Prioritising when everything is critical

   The scoring argument: why CVSS is not a remediation order, and how weighted factors with published weights change the queue. Show two findings with identical severity and opposite priorities.

   Suited to a security leadership audience.

5. 05

   Security testing in the pull request without slowing anyone down

   Practical CI/CD session. Configuring GitHub Actions, choosing a gating threshold, why gating narrowly matters, and routing everything else to tickets.

   Developer and platform-engineer audience.

6. 06

   Multi-tenant isolation: testing the thing that would end the company

   Aimed squarely at SaaS. Configure accounts in two tenants, attempt to cross, and discuss why this class survives in production longer than any other.

7. 07

   Building an assessment programme with two people

   Leadership and small-team session. Cadence, depth selection, what to automate, what to keep human, how to evidence it. Explicitly not a product session; the product appears as one option among the practices discussed.

8. 08

   What automated testing cannot do

   The credibility session. An honest account of where autonomous testing has limits (novel business logic, social engineering, architecture review, anything needing organisational context) and how to structure a programme around that.

• The 45-minute technical deep-dive

  30 minutes of demonstration, 15 minutes of Q&A. The default for practitioner topics. Live terminal and product, minimal slides.

• The 30-minute focused session

  One narrow question answered properly. Higher completion rates than 60-minute sessions and easier to schedule for people with real jobs.

• The panel

  Three practitioners on a shared problem. Works when the guests are genuinely independent and are allowed to disagree with you. Do not run this with two employees and a customer.

• Office hours

  No presentation. Announced topic, and an hour of questions. Cheap to run, disproportionately valuable, and it works even with a small audience; five engaged people is a good office hours session.

• The form stays short.

  Name, work email, company. Every extra field costs registrations, and the qualifying information is available later anyway.

• The recording goes to everyone who registered, attended or not.

  The people who registered and could not attend are a real audience segment, and withholding the recording to force attendance is the kind of small hostility this audience notices.