Workshops schedule
Workshops will be held on Friday, November 6, 2026 at Le Quartz in Brest. These workshops are a chance to discover and practice technical concepts around cybersecurity with passionate instructors.
Workshops are open on registration only, and seats are limited in each room.
The schedule is also available on Pretalx (subject to minor changes).
| FRIDAY, NOVEMBER 6 | |||
|---|---|---|---|
| 9:00 - 10:00 | Welcome coffee | ||
| 10:00 - 12:00 | Room 1  Practice designing secure architecturesby Cyril Legris |
Room 2 No EDR, No logs, No problems... How Suricata can save detection in OT world?by Charles Blanc-Rolin |
Room 3 Qubes Toxic: Breaking Bad Isolationby David Brosset & William Robinet |
| 12:00 - 13:30 | Lunch break | ||
| 13:30 - 14:00 | Welcome coffee | ||
Room 1 14:00 - 17:00 Entra Connect Sync: anatomy of a tier 0 bridge between two worldsby topotam & Luc-Marie Coustillière |
Room 2 16:00 - 18:00  Applied Transformer NLP for Cybersecurityby Pauline Bourmeau (Cookie) |
Room 3 14:00 - 16:00 Hacking Bluetooth Low Energy with WHADby Damien Cauquil & Romain Cayre |
|
Practice designing secure architectures - Cyril Legris
Language: French
Time: 10:00 to 12:00, room 1
This workshop is a hands-on training in designing secure architectures. Through guided exercises, then group work, you will draw architectures and compare your experience with the good practices of the French national cybersecurity agency (ANSSI).
Built on the experience ANSSI gained while supporting secure architecture projects, the workshop introduces the job of cyber architect. Several use cases let you progressively try out its different aspects, from the way of thinking and sharing ideas to the design of an information system, along with the secure architecture models recommended by ANSSI.
No EDR, No logs, No problems… How Suricata can save detection in OT world? - Charles Blanc-Rolin
Language: French
Time: 10:00 to 12:00, room 2
Legacy operating systems, real-time operating systems, black box devices using special protocols, no EDR available, system logs that are difficult to collect… Monitoring the security of OT devices can prove challenging for most security tools on the market. Find out how Suricata helped detect malicious activity, particularly on medical devices.
Qubes Toxic: Breaking Bad Isolation - David Brosset & William Robinet
Language: French
Time: 10:00 to 12:00, room 3
After last year’s “In bed with QubesOS, tips and tricks exchange party” workshop, which explored how QubesOS is used, this session changes perspective. If QubesOS promises security through compartmentalization, what happens when you try to break it?
The workshop explores the realistic attack surface of QubesOS: what its isolation model actually protects, where its limits lie, and how vulnerabilities or plain misconfigurations can turn a “secure by design” system toxic. It confronts real Xen vulnerabilities (Xen Security Advisories) and concrete pitfalls, such as overly permissive qrexec policies or careless use of the inter-VM clipboard, through live demonstrations, and ends with hardening practices.
Prerequisites: intermediate audience with basic knowledge of virtualization and hypervisors. Having attended an introduction to QubesOS is a plus, but not mandatory.
Entra Connect Sync: anatomy of a tier 0 bridge between two worlds - topotam & Luc-Marie Coustillière
Language: French
Time: 14:00 to 17:00, room 1
The Microsoft Entra Connect server is one of the most critical components of a hybrid infrastructure: it holds both DCSync rights on the on-premises Active Directory and the access keys to the cloud identity. Yet its credential protection mechanisms have deeply changed over the versions, from cleartext in the registry to the DPAPI Credential Vault, up to the gMSA service account whose password rotates automatically.
The workshop reviews the state of the art of attacks on Entra Connect, with a focus on the MSOL credential extraction chain when a gMSA is used as the ADSync service account. This scenario is increasingly common and recommended by Microsoft, but its offensive implications remain poorly documented and poorly covered by public tools. A final part covers defense and detection.
Applied Transformer NLP for Cybersecurity - Pauline Bourmeau (Cookie)
Language: English
Time: 16:00 to 18:00, room 2
A hands-on two-hour workshop covering applied transformer-based NLP for cybersecurity using the HuggingFace Transformers library. Participants build a complete threat intelligence pipeline from scratch (entity extraction, classification, summarization, and semantic ATT&CK mapping) using only open-source models running locally.
Participants learn to choose the right model architecture for the right problem. The session closes with a live demonstration showing how individual components combine into a fully automated analysis pipeline.
Hacking Bluetooth Low Energy with WHAD - Damien Cauquil & Romain Cayre
Language: French
Time: 14:00 to 16:00, room 3
A hands-on workshop on hacking Bluetooth Low Energy connected devices with the WHAD framework. The goal is to discover WHAD through Python scripting exercises, working on connected devices from the simplest to the toughest.
Some exercises will run on a brand new connected device emulation platform, which avoids the usual environment issues (a hundred BLE devices in a conference room, radio noise and interference…). Others will be done on real hardware brought for the occasion. The workshop also presents the latest version of WHAD and its improved Python API, which owes a lot to the workshop held at the 2025 edition.
Prerequisites: a laptop with VirtualBox or VMware (a preconfigured VM will be provided a few days before the workshop), admin rights to give the VM access to USB interfaces, at least two free USB ports (or a hub), good knowledge of Python 3. The nRF Connect app on a smartphone may be useful.