Do you know what is really in your logs — and what an attacker would do with it?
Black Belt deep dives on GitHub hardening and log hunting, live attack chains from social engineering to domain dominance, Tier 0 that reaches into Entra ID, and the race between AI-powered attackers and defenders. This is the track where the people who break things show you how they do it — so you can stop them.
The Security track at ELDK27 brings 9 sessions on the main day, 10 February, plus a full-day Master Class on the pre-day. Every session is level 300 or deeper — no product tours, no beginner detours.
🎟️ Join us at Experts Live Denmark 2027 (ELDK27) on 9–10 February in Copenhagen. Get your ticket here — early bird price for the first 500 tickets, and the 2-day ticket includes the Master Class pre-day.
📅 Agenda: Day 1 / Pre-day (Master Classes) · Day 2 / Main event
Hardening GitHub: From Default to Defended
Black Belt (500) · See it on the agenda
GitHub ships with sensible defaults. The problem is that sensible defaults aren't security controls – and the gap between them is where real attacks land. In this demo-heavy session, we go hands-on with the security decisions that most organizations either skip, misconfigure, or misunderstand.
- Pierre Thoor — MVP · LinkedIn
Thanks for accepting the invite! I’m GA now
Black Belt (500) · See it on the agenda
SESSION INFORMATION SHARED UNDER "NDA" – DO NOT SHARE OR DISCUSS WITH OUTSIDE PARTIES! With Entra ID governance you gain a lot of control over tenants in your enterprise.
- Thomas Naunheim — MVP · LinkedIn
- Fabian Bader — MVP · LinkedIn
What’s in Your Logs? – Expert Edition
Black Belt (500) · See it on the agenda
Threat hunters, Detection Engineers, SOC/IR analysts and other security specialists all depend on logs. Yet one of the biggest challenges in remains surprisingly fundamental: Do you actually know what is in your logs? Most security teams know which data sources they have onboarded.
- Bert-Jan Pals — MVP · LinkedIn
Breaking Identity at Scale: From DPAPI & TBAL Secrets to Full Domain Compromise
Expert (400) · See it on the agenda
Modern enterprise environments continue to rely on implicit trust within identity and credential protection mechanisms such as DPAPI, DPAPI-NG, and token-based authentication layers.
- Paula Januszkiewicz — Microsoft Expert · LinkedIn
Extending Tier 0 into Microsoft Entra ID
Expert (400) · See it on the agenda
Classic AD tiering is still relevant, but Tier 0 no longer stops at the domain controllers. In a hybrid Microsoft environment, privileged access also lives in Microsoft Entra ID, Microsoft 365, Conditional Access, PIM, and cloud-based admin roles.
- Kasper Norregaard — Microsoft Expert · LinkedIn
Gone in 180 minutes – From social engineering to domain dominance
Expert (400) · See it on the agenda
In just 180 minutes, a determined attacker moved from a convincing social engineering call to full control of a corporate domain.
- Hasain Alshakarti — MVP · LinkedIn
The two sided race: How AI Reshaped Both the Attack and Defense
Expert (400) · See it on the agenda
We have spent thirty years quietly putting AI to work in security. Spam filters, anomaly detection, malware classifiers. Nobody called it AI back then. What changed isn't that defenders finally got smart tools. It's that the attackers got the exact same ones, at the same time.
- Jeroen Niesen — MVP · LinkedIn
Unlocking the Power of Microsoft Sentinel with MCP Server and Sentinel Graph
Expert (400) · See it on the agenda
Explore the next evolution of Microsoft Sentinel through the MCP Server (Desktop MCP Server) and Sentinel Graph capabilities.
Tiering in Active Directory – Prevent exposure of sensitive credentials by going back to basics
Advanced (300) · See it on the agenda
In DFIR, we commonly see that the median hops needed to get access of Domain Admin credentials is three. Meaning that when compromised, a TA moves laterally up to three separate systems before getting DA.
- Viktor Hedberg — MVP · MCT · LinkedIn
Go all-in: the Security Master Class (pre-day, 9 February)
Security Master Class: Lessons from the Field – Hacking and Securing Windows Infrastructure. — 7 hours, one topic, Expert (400).
This is a deep dive course on infrastructure services security, a must-go for enterprise administrators, security officers and architects.
- Paula Januszkiewicz — Microsoft Expert · LinkedIn
🎟️ Interested? Then Security is waiting for you. Get your ticket here — early bird price for the first 500 tickets, and the 2-day ticket includes the Master Class pre-day.
📅 Agenda: Day 1 / Pre-day (Master Classes) · Day 2 / Main event