Keynote

### Overview At Troopers 26 in Heidelberg, conference founder Enno opened the event by reviewing logistical updates, conference history, the CTF, community run, and challenges with hardware badge delivery. Following the opening, Marion Marschalek delivered the keynote, titled "Ship It, They Said: Security Research and Product Development at Scale." Drawing on her 15-year career—spanning security research, compiler mitigations at Intel, large-scale threat detection at AWS GuardDuty, and community initiatives like Black Hoodie—Marschalek examined the stark divide between curiosity-driven research and constraint-driven production engineering, and how the rise of AI impacts security work and junior talent development.

### Key Topics - **Research vs. Applied Production**: Security research focuses on finding vulnerabilities and developing proof-of-concept (PoC) exploits driven by curiosity and dopamine hits. In contrast, deploying production-grade mitigations or detection products requires months to years of design, testing, addressing corner cases, operations, backwards compatibility, and long-term support. - **Hardware & Edge Security Realities**: The physical and edge security landscape remains brittle. While pioneers like Alex Matrosov (Binarly) transformed UEFI/boot security with hundreds of vendor disclosures, devices like the Ledger Nano X can still be compromised via physical hardware espionage implants. Furthermore, GreyNoise's "State of the Edge" report highlighted botnets swelling from 2,000 to 300,000 devices within two and a half months, largely by exploiting a 26-year-old vulnerability from 1999. Upcoming European Commission regulations mandating 24-hour vulnerability reporting reflect how broken the ecosystem has become. - **Mitigation Prototyping & Trade-Offs**: Discussing her work at Intel implementing compiler-level mitigations in GCC, Marschalek highlighted Retpoline for Spectre v2. While Retpoline successfully stalls speculative execution on vulnerable indirect branches in a loop, it caused a 1% to 20% CPU performance penalty, creating major friction between security goals and product performance requirements. - **Large-Scale Engineering & False Positive Economics**: In cloud-scale detection (e.g., AWS GuardDuty), a seemingly excellent false positive rate of 0.01% on a volume of 1 billion daily events generates 100,000 false positives per day, completely overwhelming SOC teams. Engineering at scale is primarily about blast radius management, handling environmental drift, legacy configurations, and edge cases. - **Outage Case Studies & Postmortems**: - *CrowdStrike Falcon (Channel File 291)*: A crash triggered not by new code deployment, but by a latent bug in the kernel driver exposed when a rapid detection logic update introduced a parameter corner case that parser validation failed to catch. - *Cloudflare (Code Orange / November 18, 2025 outage)*: A SQL permission configuration change doubled query result sizes, exceeding a hard-coded parser limit in proxy servers. Traffic spikes were initially mistaken for a DDoS attack due to staggered fleet deployment. - **AI's Impact on Security & Community**: LLMs like Claude can rapidly automate entry-level reverse engineering tasks (decrypting XOR strings, renaming API wrapper functions, handling complex runtime-packed Delphi binaries). While AI accelerates development, detection, and attacks simultaneously, it compresses the learning pipeline. Because junior engineers historically learned by doing these easy tasks, their elimination—combined with corporate hiring freezes—threatens future talent development.

### Technical Details - **Spectre v2 & Retpoline**: Exploitation combines indirect branch prediction poisoning, speculative execution, and cache timing side-channels to extract kernel memory secrets. Retpoline neutralizes the attack at compile time by directing speculative execution into an endless loop so sensitive data never reaches the CPU cache. - **Privileged Detection Attack Surface**: Security drivers run with kernel-level execution and instant update mechanisms, creating massive potential blast radiuses when latent parser bugs encounter malformed rule files. - **Large-Scale Data Drift**: Systems encounter continuous environmental drift as underlying shared libraries and customer workflows shift, causing detection and exploit tools alike to break without continuous operational maintenance.

### Takeaways - A PoC demonstrates possibility; shipping a product guarantees reliability and containment of failure. - Organizations must engineer for operational excellence, observability, and small blast radiuses during initial design rather than treating operations as an afterthought. - Postmortems must focus on learning and structural fixes rather than assigning blame. - Accelerating workflows with AI leaves human analysts with strictly the most complex tasks while removing foundational training opportunities for entry-level professionals. Senior security practitioners and communities like Black Hoodie must actively create mentorship, training, and career avenues to sustain junior engineers.