Adversary Village·38 min
Abhijit · Anant Srivastava
Looks back at six years of Adversary Village, from early debates over emulation versus simulation to how AI fits into adversary testing.
villagepanelattack+2
DEF CON 34/Adversary Village across years
Adversary Village DC34
Las Vegas Convention Center · 6–9 August 2026 · 12 talks
Adversary Village talks from DEF CON 34.
1–12 of 12 talks
Adversary Village·23 min
Michael Leibowitz · Niranjanaa Ragupathy
Explains how red teams choose adversaries to emulate, drive defensive change through storytelling, and adapt their work to AI-driven attackers.
attackaiteam+2
Adversary Village·21 min
Samet Tasci · Mehmet Key
Shows how to emulate identity-first intrusions across Active Directory, Entra ID and cloud control planes, and score detection coverage with repeatable playbooks.
identitycloudthreat-detection+2
Adversary Village·26 min
Dominika Pietrzak · Ibai Castells
Shares lessons from building reusable, reliable offensive AI agents for client web application tests, covering evaluation and safety controls.
aiwebattack+2
Adversary Village·43 min
Sarah · Olaf · Cheryl Biswas
Panelists discuss how to turn threat intelligence into adversary simulation exercises that test whether detections and controls actually hold up.
threatintelligencedetection+3
Adversary Village·21 min
Mauro Eldritch · Nelson Meran
Shows how an AI agent built on Ruby and simple HTTP tools finds and exploits weak North Korean malware C2 servers, with an emulator for safe practice.
aimalware-analysisexploitation+2
Adversary Village·24 min
Daniel Isler
Shows how red teams read security awareness metrics, OSINT and employee habits to gain initial access without advanced code, and how defenders can respond.
socialattackopen-source+2
Adversary Village·23 min
Eli Woodward
Shows how internet scanners and attackers target exposed LLM gateways, MCP servers and local inference APIs, based on a multi-persona AI honeypot.
aiattackinfrastructure+2
Adversary Village·20 min
Robert Pimentel
Shows how Microsoft Azure Relay and AWS IoT services can carry command-and-control traffic that blends into trusted cloud endpoints.
cloudattackinfrastructure+2
Adversary Village·25 min
Yi Ting Shen · Ariz Soriano
Presents SEND, a framework that pairs cheap attacker actions with LLM-generated fake artifacts to mislead SOC analysts' investigation narratives.
security-operationsdetectiondefensive-security+2
Adversary Village·37 min
Heidi Potter · Christine Billingsley · Tati · Ashley
A panel of DEF CON organizers and community leaders shares how mentorship, welcoming villages and local meetups help newcomers find their place in security.
panelvillageinterview+1
Adversary Village·23 min
Nikos Vourdas
Shows how disabled and deleted Active Directory objects keep dangerous permissions and recoverable data, with open-source tools to find and abuse them.
windowsattackexploitation+3