German OWASP Day 2026

Program

On the main conference day (24.09.2026) a series of exciting technical and non-technical presentations in the field of application security will take place. On the previous day (23.09.2026) various seminars and an evening event for shared experience exchange and the new OWASP Diversity PreCon will be offered. For participation in the event you will receive up to 14 CPE continuing education credits.

Uhrzeit	Topics 1	Topics 2
09:00	Introduction
10:00 - 12:30	Einführung ins Reverse Engineering von IoT-Firmware (Teil 1) 🇩🇪 \| Jiska Classen Details	Saftladen unter Beschuss 🇩🇪 \| Jana Prechelt Details
10:00 - 12:30	KI-Security Hands-On: Prompt Injection & Co. selbst ausprobieren 🇩🇪 \| Martina Kraus Details	Cyber Resilience Act & DSGVO: TOMS als Schlüssel für Security-Compliance-Synergien 🇩🇪 \| Friederike Schellhas-Mende Details
12:30 - 13:30	Lunch Break
13:30 - 14:30	Vielfalt von AppSec 🇩🇪 \| Larissa Prestel Details
14:30 - 16:30	Einführung ins Reverse Engineering von IoT-Firmware (Teil 2) 🇩🇪 \| Jiska Classen Details	Saftladen unter Beschuss 🇩🇪 \| Jana Prechelt Details
14:30 - 16:30	KI-Security Hands-On: Prompt Injection & Co. selbst ausprobieren 🇩🇪 \| Martina Kraus Details	Was kann schief gehen? Threat Modelling - Bedrohungsmodellierung für Einsteigerinnen. 🇩🇪 \| Lilith Pendzich Details
16:30	Closing Session

Time	Track 1	Track 2
09:00 - 13:00	Understanding Modern Application Security - Foundations 🇬🇧 \| Michael Helwig Details	Scaling Threat Modeling with OWASP Precogly: Building AI-Agent-Ready Programs 🇬🇧 \| Vikramaditya Narayan \| Jeroen Verwoest Details
14:00 - 18:00	Hacking a smart Pizza Place with the OWASP AI Exchange - PwnzzAI! 🇬🇧 \| Behnaz Karimi \| Maryam Mouzarani Details	CANCELLED - Silent Sabotage: When AppSec Hits the Water — Exploiting the OWASP OT 🇬🇧 \| Blessen Thomas \| Wojciech Poparda \| Ranjith Menon \| Javier Villalba Details
15:00 - 17:00		German Chapter Meeting Room Rheinauen Details
from 18:30	Evening event in the Zieglersaal at Restaurant Akropolis

Time	Saal Baden	Saal Fidelitas
08:15 - 08:55	Registration
08:55 - 09:05	Introduction 🇬🇧
09:05 - 09:50	Keynote: Rob van der Veer 🇬🇧 \| Rob van der Veer Details Recording
09:50 - 09:55	Split to track #1 and track #2
09:55 - 10:20	Agentic AI Gateway Enforcement of the OWASP Top 10 🇬🇧 \| Davi Ottenheimer Details Recording	Understanding the Map of Threat Modeling Through the Lens of the TM-BOM 🇬🇧 \| Vikramaditya Narayan Details Recording
10:20 - 10:45	Hackbots under control: Methodology for Autonomous Pentesters 🇬🇧 \| Hussein Bahmad \| Tanguy Snoeck Details Recording	OWASP Cornucopia - Gamifying AI Threat Modeling and Security Requirement Analysis 🇬🇧 \| Johan Sydseter Details Recording
10:45 - 11:20	Break
11:20 - 12:05	Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives 🇬🇧 \| Soheil Khodayari \| Giancarlo Pellegrino Details Recording	Vier grüne Häkchen, trotzdem gehackt: Threat Modeling für KI-Agenten 🇩🇪 \| Christian Schneider Details Recording
12:05 - 12:55	What LLMs Can Do in Pentesting and Code Security 🇬🇧 \| Julius Henke Details Recording	CRA effizient und nachhaltig umsetzen 🇩🇪 \| Dagmar Moser \| Max Moser Details Recording
12:55 - 13:55	Lunch Break
13:55 - 14:40	How To Become a Certified AI Security Professional 🇬🇧 \| Rob van der Veer Details	Zeit für OAuth 2.1 - Security Best Practices als neuer Standard 🇩🇪 \| Martina Kraus Details Recording
14:40 - 15:10	OWASP AISVS: Bringing Order to AI Security Chaos 🇬🇧 \| Rico Komenda Details Recording	How To Fuzz for Logic Bugs? Building Effective Oracles - A Case Study on Site Isolation Bypass Bugs 🇬🇧 \| Jan Niklas Drescher \| David Klein \| Martin Johns Details Recording
15:10 - 15:40	How to Hack "Read-Only" SQL MCP Servers Online (Fast) 🇩🇪 \| Maximilian Hildebrand Details Recording	New OWASP Kubernetes Top 10 in Action and Explained 🇬🇧 \| Benjamin Koltermann Details Recording
15:40 - 16:10	Break
16:10 - 16:55	Public Money, Public Containers 🇩🇪 \| Sebastian Kawelke \| Janou Feikens Details Recording	16:10 - 16:45 Race Against The Workflows: Stealing GitHub Tokens from Docker Images 🇬🇧 \| Gaetan Ferry \| Guillaume Valadon Details Recording
16:55 - 17:20	Sicher in einen neuen Hafen -- Die Geschichte einer Migration in eine europäische Cloud 🇩🇪 \| Adrian Metzner Details Recording	16:45 - 17:20 Silent but Deadly: Reconstructing Undisclosed Security Vulnerabilities in Public Package Registries 🇬🇧 \| Thomas Barber Details Recording
17:20 - 17:25	Back to track #1
17:25 - 17:45	Celebrating the 25th Anniversary of OWASP and the 22nd of German Chapter 🇬🇧 \| Boris Hemkemeier \| Dirk Wetter Details Recording
17:45 - 17:50	Chapter Lead: Thanks & meet you next year 🇬🇧 Recording
17:50 - 20:00	25 Years OWASP - Celebration Following the German OWASP Day, there's something special in store. Let's celebrate 25 years of OWASP together! If you have the time and feel like it, just stick around after the official end of the event. Drinks and snacks will be served until around 8:00 p.m., and you'll have the chance to chat with the community.

Our sponsors

The following companies and organizations are supporting this year's German OWASP Day.

Sponsoring opportunities around German OWASP Day 2026

We anticipate approximately 200 participants from a range of industries. By sponsoring the German OWASP Day 2026, you will be making a strong statement:

Your support for this key event in the German-speaking Application Security community will significantly bolster your company's expert reputation.

Building on the positive feedback from previous years, we've created several attractive opportunities to maximize your visibility at the conference, alongside your presence online and in official materials.

Standard Sponsor
Gold Sponsor

Price (net): 1.500 €

Perks:

your logo* on the conference homepage
your logo* in a LinkedIn post by the German OWASP Day page
your logo* on the schedule during the conference
one (1) Giveaway (e. g. a brochure*) or a promotional gift* for the participants
an included conference ticket including the social pre-event

Items marked with * must be provided by the sponsor.

Price (net): 4.000 €

Perks:

All points of the Standard Sponsor Package apply to the Gold Sponsor plus the following:

Selection of one of the following sponsorship options based on availability (first come, first serve):

Coffee break and lunch catering (max A4-sized table displays*) or
Lanyard (lanyard* for conference badges) or
Evening event (option to put up to two RollUp-Displays* and hold a short speech) or
Conference bags*

One additional (two in total) included conference tickets incl. pre-event.

Items marked with * must be provided by the sponsor.

All sponsorship revenue is used solely to cover the costs of the conference and the mission of the independent and non-profit OWASP Foundation (501c3 Not-For-Profit).

Details for Sponsors

Call for Presentations & Community Trainings

The German OWASP Day 2026 is a security conference focused on expert talks covering secure development, operations, testing, and organizational aspects related to web-based applications. Cross-disciplinary and non-technical topics are also encouraged. The conference is primarily intended for a German-speaking audience, though English presentations are welcome.

At this year's German OWASP day we'd again like to offer a few half day workshops (3-4 hours) for the community.

Here you find the Call for Presentations on 24.09.2026

CfP is closed

Here you find the Call for Community Trainings on 23.09.2026

CfT is closed

Location

The OWASP Trainings and the Conference will take place at the IHK Haus der Wirtschaft, Lammstraße 13-17, in Karlsruhe.

We suggest using public transport for your travel:

Tram from main train station: Line 2 to the stop Marktplatz (Pyramide U).

IHK Haus der Wirtschaft Karlsruhe

The Diversity PreCon will take place at the queerKAstle, Karlsruher Zentrum für queere Vielfalt, Liebigstraße 10-12, 76135 Karlsruhe

We suggest using public transport for your travel:

Bus from main train station: Line 55 to Kühler Krig to the stop Hübschstraße.

queerKAstle

The evening event will take place at the Zieglersaal im Restaurant Akropolis, Baumeisterstraße 18, 76137 Karlsruhe

We suggest using public transport for your travel:

S-Bahn from main train station: S11 to Neureut Kirchfeld to the stop Karlsruhe Kongresszentrum (U).

Zieglersaal im Restaurant Akropolis

About

OWASP is an independent, global community committed to making web application security more visible, sharing expertise in developing and operating secure web applications, and offering resources freely available to everyone. All OWASP materials, including documents, videos, slides, and podcasts, can be used for free under an open license.

OWASP is open, inclusive, and vendor-neutral. Everyone is welcome to contribute to projects or simply benefit from the shared knowledge. A great way to get involved is by attending the OWASP Meetups, which regularly take place in many major German cities.

For more details, visit the German OWASP Chapter website and follow us on social media.

Webseite

Mailingliste

GitHub

Youtube

Mastodon

Kontakt

Martina Hartmann

Organisation

martina . hartmann [at] owasp . org

Kai Jendrian

Organisation

kai [at] owasp . org

Christian Dresen

Organisation

christian . dresen [at] owasp . org

Christian Becker

Organisation

christian . becker [at] owasp . org

Lilith Pendzich

Organisation

lilith . pendzich [at] owasp . org

Henrik Willert

Organisation

henrik . willert [at] owasp . org

Jasmin Mair

Organisation

jasmin . mair [at] owasp . org

Dirk Wetter

Organisation

dirk [at] owasp . org

Tobias Glemser

Sponsoring

tobias . glemser [at] owasp . org

The Conference and Training Tickets are available on GlueUp!

Program

Introduction

Einführung ins Reverse Engineering von IoT-Firmware (Teil 1)

Saftladen unter Beschuss

KI-Security Hands-On: Prompt Injection & Co. selbst ausprobieren

Cyber Resilience Act & DSGVO: TOMS als Schlüssel für Security-Compliance-Synergien

Lunch Break

Vielfalt von AppSec

Einführung ins Reverse Engineering von IoT-Firmware (Teil 2)

Saftladen unter Beschuss

KI-Security Hands-On: Prompt Injection & Co. selbst ausprobieren

Was kann schief gehen? Threat Modelling - Bedrohungsmodellierung für Einsteigerinnen.

Closing Session

Understanding Modern Application Security - Foundations

Scaling Threat Modeling with OWASP Precogly: Building AI-Agent-Ready Programs

Hacking a smart Pizza Place with the OWASP AI Exchange - PwnzzAI!

CANCELLED - Silent Sabotage: When AppSec Hits the Water — Exploiting the OWASP OT

German Chapter Meeting

Evening event in the Zieglersaal at Restaurant Akropolis

Registration

Introduction

Keynote: Rob van der Veer

Split to track #1 and track #2

Agentic AI Gateway Enforcement of the OWASP Top 10

Understanding the Map of Threat Modeling Through the Lens of the TM-BOM

Hackbots under control: Methodology for Autonomous Pentesters

OWASP Cornucopia - Gamifying AI Threat Modeling and Security Requirement Analysis

Break

Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives

Vier grüne Häkchen, trotzdem gehackt: Threat Modeling für KI-Agenten

What LLMs Can Do in Pentesting and Code Security

CRA effizient und nachhaltig umsetzen

Lunch Break

How To Become a Certified AI Security Professional

Zeit für OAuth 2.1 - Security Best Practices als neuer Standard

OWASP AISVS: Bringing Order to AI Security Chaos

How To Fuzz for Logic Bugs? Building Effective Oracles - A Case Study on Site Isolation Bypass Bugs

How to Hack "Read-Only" SQL MCP Servers Online (Fast)

New OWASP Kubernetes Top 10 in Action and Explained

Break

Public Money, Public Containers

Race Against The Workflows: Stealing GitHub Tokens from Docker Images

Sicher in einen neuen Hafen -- Die Geschichte einer Migration in eine europäische Cloud

Silent but Deadly: Reconstructing Undisclosed Security Vulnerabilities in Public Package Registries

Back to track #1

Celebrating the 25th Anniversary of OWASP and the 22nd of German Chapter

Chapter Lead: Thanks & meet you next year

25 Years OWASP - Celebration

Our sponsors

Sponsoring opportunities around German OWASP Day 2026

Call for Presentations & Community Trainings

Location

About

Kontakt

Martina Hartmann

Kai Jendrian

Christian Dresen

Christian Becker

Lilith Pendzich

Henrik Willert

Jasmin Mair

Dirk Wetter

Tobias Glemser