Security talks.

Anyone who has done an embedded device security audit can attest to some of the struggles with doing these types of evaluations: libraries are missing, code has to be statically compiled to run usually - and cross compiled for another CPU architecture. Trying to debug a process is usually a non starter due to these problems and others.

I developed a tool, dubbed "Embedded Linux Audit" (https://github.com/nstarke/embedded_linux_audit) to help alleviate some of these troubles, plus also make it possible to "remotely" audit an embedded device. This talk will cover what the tool is, how it works, and some of my motivations for developing such a tool.

The second part of the talk will focus on how this project was developed using the latest in AI assisted development tools, which allowed me to "punch above my weight" in terms of writing code I probably could have never written myself.

Nick Starke is an embedded device and firmware security researcher. When he isn't hacking, he likes playing with synthesizers

There's a massive influx of hype around AI agents for security and investigations - most of it is fluff. Chatbots that look impressive in a demo but fall apart the moment they hit a real investigation because they lack context, consistency, and grounding in ground truth.

This talk walks through what it actually takes to build an AI agent that works for threat hunting and security investigations. Not a conversational assistant - an Investigation Operating System.

We'll cover the architecture that delivered real results:

1. The Knowledge Layer (Institutional Memory) - feeding each investigation back into a knowledge database of entities, indicators, historical patterns, and analyst corrections so the agent never starts cold.

2. Data Mapping & Orchestration - teaching the agent where evidence actually lives and which schemas matter, so the model acts as an orchestrator across identity, infrastructure, billing, and usage signals - not just a summarizer.

3. Deterministic Data First, AI Second - using structured telemetry, parsers, and repeatable queries as the factual foundation, with the AI layer reasoning over evidence rather than being asked to 'believe' anything. This is the key to avoiding the hallucination trap.

4. Encoded Tradecraft - encoding investigative methodology (pivot-chain analysis, entity relationship mapping, timeline reconstruction) into repeatable workflows that another analyst can inspect, reproduce, and challenge.

5. Parallelism - fanning out across multiple angles simultaneously, merging results, and launching follow-up pivots instantly to compress multi-hour manual loops.

Attendees will walk away with a concrete framework for moving past 'shiny UI over a basic prompt' and toward AI systems that are reliable investigation partners - with context, constraints, and a repeatable process.

Drey is a Senior AI Security Researcher with a background in threat intelligence and security investigations. Originally from Washington state, moved to Iowa on accident and have spent the last three years in this amazing place.