Pentesting under DORA: What the Regulation Actually Requires

Since January 2025, the Digital Operational Resilience Act (DORA) has made security testing a legal obligation for EU financial entities. For many fintech and financial-services security teams, the hard part is not knowing that testing is required. It is knowing what to test, how often, and how to prove it to a supervisor without slowing the business down.

Join Cobalt and CyAdviso for a practical 30-minute session. Andrey Gubarev, CISO for FinTechs at CyAdviso, explains what DORA requires of your testing program. Marion Sornette, Sr. Solutions Architect at Cobalt, then shows how penetration testing as a service (PTaaS) turns that requirement into a repeatable annual process: fast scoping and launch, independent testers, findings tracked through remediation and retested, and a clear record of scope, results and fixes you can show your supervisor.

You will leave with:

A clear view of what DORA means for penetration testing and who it applies to.
A way to run annual testing of the systems that support your critical or important functions without a heavy manual process.
An understanding of what audit-ready testing evidence looks like, and how Cobalt provides it.

Andrey Gubarev has been a CISO since 2008 — 17 years in the seat, 24 years across IT and security. Engagements at 10+ companies across Europe, under EU financial-sector supervision — across EMI, PI, and CASP licence types. In 2020 Andrey founded CyAdviso (SIA, Latvia) to bring CISO function to fintechs that need it but cannot justify a full-time hire — typically EMIs, PIs, and CASPs of 30-200 people working under DORA, NIS2, and local cyber-resilience regimes.

DEF CON 34

Hacking Big Iron: When Modern Security Assumptions Fail on Mainframes

DATE TBA

Mainframes still underpin critical infrastructure such as banking, airlines, and government systems, yet most modern security teams approach them using assumptions formed around Unix, Windows, and enterprise platforms. These assumptions often fail on z/OS, creating blind spots that are difficult to detect and easy to underestimate.

This talk explains how mainframe security actually works and why familiar concepts such as "root," shells, ports, and lateral movement do not translate cleanly. Focusing on components like JES, JCL, RACF, CICS, and PR/SM, we explore where attackers and defenders truly operate today: transactions, security managers, and management boundaries.

BLACK HAT USA

MCParasite: Universal MCP Worm Security Testing Framework

Aug 6, 2026 | 11:20 AM PDT

MCParasite takes prompt injection and tool poisoning techniques that already exist and chains them into a self-propagating worm that lives inside MCP. A single rogue server poisons the agent's context the moment it connects.

The agent then writes a payload to whatever channel it has access to: Slack, GitHub, Jira, email. A completely separate agent on a different system reads that message, gets infected, and starts executing commands on its own. Shell access, credential theft, data exfiltration. The victim agent never touched the malicious server. We tested 8 models from 4 vendors. 5 out of 6 propagated the worm. We are actively expanding to DeepSeek and others; the talk will cover full results across all major frontier models.

DEF CON 34

Deep Dive into Fuzzing (Course)

Aug 10 - 11, 2026 | 8:00 AM - 5:00 PM PDT

Attendees would be emulating techniques which would provide a comprehensive understanding of "Crash, Detect & Triage" of fuzzed binaries or software. In "Deep dive into fuzzing" we will be covering a detailed overview of fuzzing and how it can be beneficial to professionals in uncovering security vulnerabilities with a hands-on approach through focus on labs.

Finding vulnerabilities in software requires in-depth knowledge of different technology stacks. Modern day software’s have a huge codebase and may contain vulnerabilities, manually verifying such vulnerabilities is a tedious task and may not be possible in all cases. This training is designed in such a way that it introduces the concept of fuzzing and vulnerability discovery in software’s covering multiple platforms such as Linux & Windows and triage analysis for those vulnerabilities.