Cork|Sec

• You can find out exactly what to expect about the night and the venue on the What We're About section of our Meetup page. Past talk details can be found the "Past Events" section.
• All people with any sort of an interest or level of knowledge in Security, Hacking and Emerging Technology are more than welcome to attend and feel free to bring like minded colleagues and friends.

CorkSec is made possible through generous sponsorship from our Platinum Sponsor TrendAI, Gold Sponsor CyberSkills , as well as our Silver and Bronze Sponsors featured prominently on the night.

Our talks come from our community so if you have an idea for a topic (anything for 10-60 minutes) please email us at DefconCork@gmail.com . Whether you are an experienced presenter, or presenting for your first time - CorkSec is a great venue for it - and we are happy to help you prepare and mentor you.

Doors open at 19:00 with talks starting at 19:15. Talks below

TALK 1: Digital Twins: A Double Insecurity – Securing and Threatening Cyber-Physical Systems by Dr Sabah Suhail
he convergence of information technology and operational technology in cyber-physical systems (CPSs) has led to highly interconnected and autonomous systems. However, this integration also introduces new attack vectors, posing significant risks to social, economic, and business sectors. Securing CPSs requires evaluating both system functionality and security without disrupting ongoing operations. A promising approach to enhancing CPS security is to leverage digital twins as security enablers. A digital twin is a virtual representation of a physical object or process, replicating its attributes, services, and interconnections throughout the system life cycle. With a continuously synchronized feedback loop, data flows from CPS to the digital twin, while assessments, predictions, optimizations, and insights flow back to the physical system for improved decision-making. In the context of ‘security through digital twins’, digital twins can be utilized for intrusion detection, cyber deception, and incident response. However, the ‘security of digital twins’ is also a critical concern. If compromised, a high-fidelity digital twin can leak sensitive information, exposing critical process knowledge about the physical system, or trigger cascading failures through feedback loops between the digital and physical spaces. In this talk, I will explore what digital twins are, how they can serve as security enablers for CPSs, what the potential abuse cases of digital twins are, and what research opportunities exist to develop trustworthy digital twins, drawing on examples from my research and industry collaborations.

TALK 2: Beyond Alert Volume: Chess, Cognitive Overload, and SOC Decision-Making by Ioana Macovei
Ioana Macovei is back at CorkSec to share insights from ongoing research into the cognitive life of SOC analysts. The talk will explore alert fatigue and cognitive overload as problems of human pattern recognition, selective attention, and verification - not simply alert volume. How do chess players manage the exponential growth of possible states in complex decision-making?

The talk will also explore what cybersecurity might learn from chess players’ cautious and sceptical approach to uncertain information—while recognising that effective cyber decision-making requires calibrated scepticism, rather than distrusting every message or alert.

• You can find out exactly what to expect about the night and the venue on the What We're About section of our Meetup page. Past talk details can be found the "Past Events" section.
• All people with any sort of an interest or level of knowledge in Security, Hacking and Emerging Technology are more than welcome to attend and feel free to bring like minded colleagues and friends.

CorkSec is made possible through generous sponsorship from our Platinum Sponsor TrendAI, Gold Sponsor CyberSkills , as well as our Silver and Bronze Sponsors featured prominently on the night.

Our talks come from our community so if you have an idea for a topic (anything for 10-60 minutes) please email us at DefconCork@gmail.com . Whether you are an experienced presenter, or presenting for your first time - CorkSec is a great venue for it - and we are happy to help you prepare and mentor you.

Doors open at 19:00 with talks starting at 19:15. Talks below

TALK 1: Adopting AI for Threat Defense: What Actually Works (and What’s Still Hype) by Saurabh Khadtare
A lot of people in security are understandably skeptical of “AI” right now. Marketing slides promise fully autonomous SOC's, while real defenders are still drowning in huge alerts and brittle detection logic. At the same time, attackers are already using automation and AI‑adjacent tooling to scale phishing, brute forcing, credential abuse, and exploitation, so a purely manual defensive approach is becoming unrealistic.
In this talk, I’ll share practical lessons from working as a security engineer and Pentester on how AI is actually starting to help with threat defense, and where it absolutely should not be trusted on its own. I’ll break “AI for defense” into three buckets: classical ML/UEBA and anomaly detection, AI‑powered SOC automation for triage and noise reduction, and LLM‑based that help with summarizing incidents, writing queries/rules, and translating technical findings for non‑technical stakeholders. For each bucket, I’ll walk through concrete workflows and examples (using redacted or synthetic data) showing what sucked before, what AI does better, and what still needs a human in the loop.
I’ll also cover the major limitations and risks: hallucinations, weak multi‑step reasoning, prompt injection, and new attack surfaces introduced by LLMs and vendor tools. The goal is to give the audience a realistic blueprint for where AI can safely augment defenders today, and where “AI‑only” approaches are still pure hype.

TALK 2: Confidential Computing by Nigel Douglas
You might already be familiar with industry terms such as encryption in-transit and encryption at-rest. What about encryption in-use? Confidential computing does just that. It's a cloud computing technology that specifically protects data during processing. Exclusive control of encryption keys delivers stronger end-to-end data security in the cloud. Confidential computing continues to redefine how critical infrastructure isolates sensitive data. This is achieved within a protected CPU enclave during processing. The enclave's contents, which include the data being processed and the techniques used, are accessible only to authorised programatic codes. They're invisible and unknowable to anything or anyone else, including the cloud provider. As company leaders increasingly rely on public and hybrid cloud services, data privacy in the cloud is imperative. The primary goal of my talk is to highlight how confidential computing is providing greater assurances to security leaders that their data in the cloud is actually protected and confidential, as we continue to move more of our sensitive data and computing workloads to public cloud services.