TechLab by Squad Cybersolutions

The "backdoor" you coded yourself

AI tools integrated into development environments (code agents, VS Code extensions, MCP) have become prime targets. A single malicious extension, recommended by a convincing deepfake, is enough to silently contaminate a developer's LLM context.

In this workshop, we will demonstrate the complete attack chain live, from deepfake social engineering all the way to production compromise via the legitimate CI/CD pipeline, without any significant alert being triggered at the right moment. We will then show how an approach combining extension governance, secrets management and behavioral detection makes it possible to break this chain.

Technologies: Live Attack, Deep Fake, Social Engineering, UEBA
With Crowdstrike, Forcepoint

• Wednesday - 3:00 pm
• Thursday - 10:00 am | 3:00 pm
• Friday - 10:00 am | 3:00 pm

Shadow AI: your employees use it, your data feeds it, and your SOC ignores it

Your employees are already using generative AI on a daily basis, often outside any approved framework, escaping both traditional network controls and SOC visibility.

In this workshop, we will highlight the complementarity of two essential viewpoints needed to address Shadow AI. The network view, which maps SaaS AI usage, qualifies the GenAI applications being used and applies contextual DLP to what actually leaves the company. And the local visibility into installed AI agents, MCP servers running on the machine, and associated processes and file accesses. Together, these two signals make it possible to map the real Shadow AI, to authorize productive uses under control and to block exfiltrations.

Technologies: Shadow AI
With Netskope, Crowdstrike

• Wednesday - 3:00 pm
• Thursday - 11:00 am | 4:00 pm
• Friday - 11:00 am | 3:00 pm 

AI Agent: your next cyber risk isn't human, but it has your privileges

No one will hack your AI agent. They will simply talk to it, and it will sign on your behalf. At the heart of your business processes, agentic AI acts with the keys to your systems and the trust you grant it by default. It is exactly this trust that an attacker turns against you, without ever triggering your traditional controls. In this workshop, by exploiting a booby-trapped MCP, we will exfiltrate data from your information system right before your eyes, and together we will see how to put countermeasures in place. Objective: move from an agent you blindly trust to an agent whose every action is under control.

Technologies: AI Runtime, MCP, Agentic
With Crowdstrike, OKTA

• Wednesday - 4:00 pm
• Thursday - 11:00 am | 4:00 pm
• Friday - 11:00 am | 4:00 pm

NIS2: turning the new European obligations into a concrete action plan

With the French transposition of NIS2 expected in Q4 2026, the organizations concerned must implement concrete measures: resilience, management of critical suppliers, incident notification. For CISOs, the challenge is to identify the priorities that are genuinely expected, beyond the frameworks already in place. In this workshop we will offer a pragmatic reading of NIS2 and its operational impacts. Drawing on field feedback, we will share the main difficulties encountered on the ground (compliance evidence, supplier maturity gaps, demonstrating resilience) and simple approaches to structure your first initiatives, prioritize the actions expected by the regulator and prevent NIS2 from becoming an operational headache.

Technologies: Resilience, Third-Party Management, Supply Chain Security, ReCyF

• Wednesday - 5:00 pm
• Thursday - 12:00 pm | 2:00 pm | 5:00 pm
• Friday - 2:00 pm

CRA: from theoretical compliance to continuous control of product risk

With the Cyber Resilience Act, cybersecurity becomes a continuous requirement across the entire product lifecycle: vulnerability management, support period, component traceability, notification obligations. These are constraints that go far beyond simple patch management for security, product and development teams. In this workshop, we revisit the concrete implications of the CRA and the difficulties already encountered: visibility into dependencies, vulnerability qualification, management of third-party components, secure maintenance over time. Discover how a CTEM approach provides a continuous view of real exposure to prioritize exploitable remediations, facilitate the notifications required by the CRA and reduce product risk without slowing down innovation.

Technologies : CTEM, Exposure Management, SBOM, Attack Path
With Tenable

• Wednesday - 5:30 pm
• Thursday - 10:30 am | 3:30 pm
• Friday - 11:30 am

SASE and micro-segmentation in the service of Zero Trust

Ransomware, lateral movement and account compromises are among the most widely used attack vectors against companies. In the majority of cases, detection comes too late. During this TechLab, we will immerse you in a real attack that progresses silently from your SD-WAN network to the core of your datacenter, and we will see how to detect, isolate and contain this attack surgically, in real time, without ever disrupting the rest of the business.

Technologies: Zero Trust, SASE, Micro Segmentation
With Versa Networks, Illumio

• Wednesday - 4:00 pm
• Thursday - 10:00 am | 3:00 pm
• Friday - 10:00 am | 2:00 pm

The browser has become the primary attack surface. Make it your first bastion!

AiTM attacks, token theft, malicious extensions: the browser now concentrates the most critical risks to your access and your data. Enterprise browser + Bastion: a live demonstration of protection with no VPN, no VDI, no agent.

Technologies: Enterprise Browser, Zero Trust
With Netskope, BeyondTrust

• Wednesday - 5:00 pm
• Thursday - 2:00 pm | 5:00 pm
• Friday - 12:00 pm | 4:00 pm