THE PATCH CAN WAIT. THE EXPLOIT WON'T.

The time between a flaw going public and attackers using it has dropped from weeks to under a day. AI models can now find new vulnerabilities, write working exploits and suggest fixes at machine speed. Attackers have the same tools you do.

2026 IN BREACHES

• The fridge attack. In October, attackers took over the refrigeration controllers at hundreds of supermarkets across France and switched them to defrost overnight. The controllers could be reached from the public internet, many still used "admin" as the username, and some models had been out of support for years. Losses are expected to reach tens of millions of euros.
• The poisoned library. In March, a North Korea linked group published malicious versions of Axios, a JavaScript library downloaded more than 100 million times a week. For about three hours, anyone who installed it could have pulled a remote access trojan into their environment.
• The one request takeover. React2Shell, a flaw in React Server Components rated 10.0 out of 10, let an attacker run code on a server with a single unauthenticated web request. Amazon threat intelligence saw state backed groups exploiting it within hours of disclosure.
• The AI assisted crew. In October, South Korean police arrested a suspect accused of using generative AI and an autonomous penetration testing system to breach around 90 organisations and steal 8.2 million records.
• The wiped fleet. In March, attackers wiped large numbers of devices at a global medical technology company after compromising a single Windows domain administrator account. Full recovery took about three weeks.

Each attack came in a different way: through code, a dependency, an internet facing app, an identity or a device nobody could patch. The lesson is the same every time. Vulnerabilities live at every layer, and patching alone is too slow.

THE MISSION

After an external security audit, you're now responsible for keeping your company's web applications safe. A security consultant has set up a lab environment, plays out real threat scenarios and asks you to respond. Whatever your role, you'll see how the layers of defence fit together and what to put in place back at work.

WHAT YOU'LL DO

• Catch it in the code. Use Amazon Inspector Code Security to find vulnerabilities before you deploy, then let Kiro review the finding and patch the code for you.
• Respond to a newly disclosed vulnerability. Scan your EC2 instances with Amazon Inspector and read the Software Bill of Materials (SBOM) to spot software and supply chain risk. Put a virtual patch in AWS WAF to block malicious requests, then patch the instance properly with AWS Systems Manager. Detect, block, then patch.
• Contain a zero day. Investigate a live incident detected by Amazon GuardDuty. Then cut off the attacker's command and control traffic with Amazon Route 53 Resolver DNS Firewall and AWS Network Firewall, even though no patch exists yet.

WHO SHOULD COME

Founders, CTOs, engineering and product leaders, developers, and security and IT teams: anyone responsible for software running on AWS. The labs are Level 300, but beginner level coding is enough. You'll work in the AWS Console and AWS CloudShell, with guided commands throughout.

WHAT TO BRING

Just your laptop. We provide AWS lab accounts and all workshop material, at no cost to you.

THE DAY

09:30 AM: Registration and coffee
10:00 AM: Opening talk: 2026 in breaches, and what they teach us
10:30 AM: Mission briefing and lab setup
10:45 AM: Chapter 1, Catch it in the code
11:30 AM: Chapter 2, Respond to a newly disclosed vulnerability
12:30 PM: Lunch and networking
01:15 PM: Chapter 3, Contain a zero day
02:30 PM: Put your skills to test
03:00 PM: Q&A with AWS Solutions Architects and wrap up

You'll leave with hands on practice in the full loop: detect, block, patch and contain.

How to Register
Use the event link to complete your registration. Following registration, you'll receive an email with instructions for the next steps.

Privacy & Data Usage
Your personal data will only be shared with event organizers and will not be disclosed to third parties.

General Terms
AWS reserves the right to modify or cancel the event if necessary.

By registering, you agree to the AWS Event Terms & Conditions and AWS Code of Conduct.