Agenda: Friday Nov 6, 2026 — Track One

Registration

AI-Assisted Vulnerability Management for an Open Source Data Platform

Our product is a data platform that bundles open source projects such as Apache Kafka, Apache Airflow, Apache Spark and Trino, each in several supported versions. Because of that vast scope, a single platform release contains over 50,000 reported vulnerabilities across its roughly 40 product and operator images. With two supported releases at any time we face that scope twice over, which is far more than our security team can analyze by hand.

OpenChain: Towards a More Secure and Compliant Software Supply Chain

Across industries, more than half of the software used is now open source (OSS). This includes both OSS in a company’s own developed products, and OSS in components provided by suppliers. The shift towards OSS has led to an ever increasing demand for license compliance, security assurance, and software bills of material (SBOMs). In addition to that, the need for supply chain visibility required to address security issues will only become more crucial with the introduction of the EU’s Cyber Resilience Act.
To deal with these challenges, organizations can adopt the ISO standards developed within the OpenChain community, namely 5230:2020 for license compliance and 18974:2023 for security assurance. This talk will highlight where to start and how you can get involved in the OpenChain community.

Tea break

What Does the Internet Know About Your Software?

Every piece of software an organization runs — from the framework in production to the small utility library buried four dependencies deep — has a public shadow: commit histories, mailing list threads, forum posts, expired domains, and the personal footprints of the people who maintain it. None of this is secret. All of it is searchable. And almost none of it shows up in a vendor questionnaire or an SBOM. This talk uses open-source intelligence (OSINT) as a lens for a question security teams rarely ask directly:
what does the internet already know about the software we depend on — and about the people who build it?

ORT Server as an open source tool for software asset tracking and regulatory compliance.

ORT Server covers software component analytics, scanning, vulnerability monitoring and resolution, license compliance, SBOM and artefact management. It is a fully open source platform with many adopters across Europe. It supports configuration as code and within a nice UI. It’s an API first platform well suited for MCP servers and building agentic workflows to e.g. manage vulnerabilities or license compliance rule violations.
This talk introduces the ORT Server, it’s building blocks and it’s community, and its capabilities, mapping them to the CRA obligations. It goes on to show practical usage patterns. And examples on how agentic workflows can be built

Building TPT: From alert chaos to clear priorities

Applications generate hundreds of vulnerability alerts, but which ones actually matter? Nav’s AppSec team built TPT (Titt på Ting), an open-source tool that helps remediate this problem using free data sources. In this talk, I’ll share how we transformed overwhelming vulnerability backlogs into actionable, prioritized workflows. Learn about our risk-scoring approach, how we aggregate data from multiple free sources, and the UX principles that help developers prioritize.

Lunch

To be announced

How many security badges do we need?

The EU Cyber Resilience Act puts a responsibility on the manufacturer for all components used. A SBOM is required and for each component, the manufacturer needs to do due diligence – both for open source and commercial components.
In order to help, there has been multiple projects that create some sort of assessment on the projects, in many cases with a “security badge”.
This talk is a call to action: Is it helpful to create more badges? There are so many that open source developers are overwhelmed, which unfortunately leads to them not doing anything. What can we do to simplify for Open Source projects and still assist manufacturers?

To be announced

Break
After the break, single track session

KEYNOTE: Beyond compliance : Building resilience

The Cyber Resilience Act asks a clear question of every product placed on the European market: is it secure enough? That question matters, but it is not the only one. Resilience also depends on what happens when circumstances change, such as when a supplier changes its terms, a jurisdiction changes its laws, or a critical component is left without anyone to maintain it.
This talk takes a broad view of how Europe’s policy agenda is moving from compliance towards resilience. It connects the CRA to the wider EU push on digital sovereignty, including the new Open Source Strategy and the Cloud and AI Development Act. It then asks what these mean for the organisations that build and run software. The argument is that open source and open standards sit at the centre of the answer, because they decide whether an organisation can still choose, adapt and act when it matters most.

Summary and closing

Olle E. Johansson