Call for speakers · apisec|con 2026

Bring proof, not findings

We want the talk you cannot give at a vendor conference. Working code, real incidents, methods that failed, numbers that surprised you. Exploitability is the unit here. If the takeaway fits on a slide of bullet points, this is not the venue.

Submissions close Tuesday, September 22

Decisions sent by September 25

Event: Wed, Oct 21, 2026
Time: 12–4 PM ET
Venue: Virtual

Submit a session

Six questions, five minutes. You do not need slides yet.

What we are looking for

The theme, and what it rules out

This edition is about what changes in application security when the code is written by models and the traffic is generated by agents. Submissions that could have been given in 2023 will not make the program.

Authorization for agents and non-human identities MCP servers as attack surface Authz bugs in model-generated endpoints Prompt injection that crosses an API boundary Securing RAG data pipelines Detecting agent-driven abuse AI in the SOC, honestly evaluated Secrets and tokens in AI toolchains EU AI Act and data-flow obligations OWASP API Top 10, re-tested against AI traffic Hands-on labs and live exploitation

25 min: Conference talk plus 5 min Q&A
40 min: Hands-on lab, attendees follow along
10 min: Lightning talk, one idea, one demo

First-time speakers are welcome, and we will help you shape the talk. Product pitches are rejected on sight, including ours.

Before you submit

What gets rejected

Saving you the twenty minutes. These are the four reasons submissions do not make it.

Reason 01

It is a product pitch

Including ours. If the talk resolves to a tool the audience should buy, it belongs in a webinar. Naming the tools you used to do real work is fine and expected.

Reason 02

It is a survey of the landscape

"The state of AI security" with no primary work behind it. This audience has read the same posts you have. Bring what you did, tested, or broke.

Reason 03

The AI angle is decoration

A 2023 talk with three slides about agents bolted on. If the content works without the AI framing, submit it somewhere else this year.

For speakers

What speaking here gets you

A practitioner audience, not a booth crowd

AppSec engineers, pentesters, and platform teams who came for the content because there is nothing else to come for. Questions in the chat are technical and relentless.

Distribution past the four hours

Your session is edited, published on demand, and promoted to the apisec University community of more than 150,000 practitioners, plus 15,000 AppSec pros in the Discord. Talks from prior editions keep collecting views long after the event.

A program team that edits

Accepted speakers get a working session on structure and a dry run. First-time speakers get more, if you want it.

No slide review, no message approval

We do not sand down your conclusions and we do not ask you to name a sponsor. Say the thing.

Track record

Where you would be speaking

150k+Practitioners on apisec University

15k+AppSec pros in the Discord

50+Speakers, prior edition

$0To attend, always

Past apisec|con speakers include

Corey Ball Katie Paxton-Fear Ben Sadeghipour Tanya Janca Jason Haddix Colin Domoney

Prior editions have drawn practitioners from Kong, Akamai, Ford, Costco, and Axis Bank.

The slot you are submitting for

12:00 PM ETOpening keynote30 min · Main stage

12:35 PM ETSession block oneTwo parallel tracks

1:35 PM ETHands-on lab40 min · Follow along

2:20 PM ETSession block twoTwo parallel tracks

3:20 PM ETLightning talksSix in thirty minutes

3:50 PM ETClosing panelWhere this goes next

The shape is fixed, the content is not. The full program is published September 28.

Deadline

September 22, then the program closes

Decisions go out by September 25, either way. Not submitting? Registration is open now and free.

Submit a session Register to attend