This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


2 Days

17-18 Nov

Bulletproof APIs: Hands-On API Security

Security

To be fair, the people who abuse this term are also the people who probably fall under this category. I prefer “Agentic Programming” instead. I have pushed thousands of lines of code in production using agentic programming. Code that would have taken me months to write myself now takes merely days.

In this workshop, we’ll explore agentic programming as a disciplined engineering practice, not a toy.
Using Claude Code, I’ll show how to collaborate with AI agents to produce maintainable, reviewable, and production-ready code, without surrendering architectural control, correctness, or performance.

What Claude Code, Codex and Cursor are, how they work, and how you should use them

Designing clear agent boundaries and responsibilities.

How to turn vague intent into explicit, testable instructions.

Create plans that can run for hours on end, generating and testing code as they go.

Much more (workshop contents are constantly updated as new models and tools are released)

This is not a “let the AI take the wheel” session. It’s about teaching the AI to work like a senior engineer, while you stay firmly in charge. If you believe AI coding tools are dangerous, flaky, or fundamentally incompatible with serious software engineering, then this workshop is for you.



A laptop with your favourite IDE installed

Vibe Coding for Production

Two-day training session on AI agents, MCP, and Skills facilitated by Aleksander Stensby from GritAI. This training gives you the foundation to build MCP servers and MCP Apps, reusable agent skills, and wire everything into capable autonomous agents that actually work.

This hands-on workshop will equip you with practical skills to build your own MCP servers, CLI tool wrappers, and interactive MCP Apps — and then go further by creating reusable skills that turn simple tool-calling agents into capable, autonomous systems. You'll leave with a working agent powered by tools and skills you built yourself.

Day 1: Context & Connectivity — MCP Servers, Apps & Tools

Introduction to the AI agent stack: LLMs in a loop with tools and why context is king

Core MCP concepts: Host/client/server architecture, tools, resources, and prompts

Building a working local MCP server (Python or TypeScript)

MCP Apps: Adding interactive UI components to your MCP Server

CLI tools with direct API access as an alternative and complement to MCP

Hands-on exercises: Build an MCP server, extend it with an MCP App

What skills are and why they're the missing layer in most agent setups

Skills vs. tools vs. prompts: Understanding the capability stack

The skill creator pattern: Using AI to capture and formalise skills from workflows

Workflow capture: Turning expert knowledge into reusable agent skills

Agentic loop architecture: How LLMs, tools, and skills combine across frameworks

Provider-agnostic patterns: Claude, OpenAI, Gemini and beyond

Final exercise: Building a capable agent combining MCP tools and custom skills

Basic Python or JavaScript programming knowledge

Familiarity with AI/ML concepts (helpful but not required)

Laptop with necessary development environment

This training is targeted at developers and people with a medium+ technical skill level and interest for AI.



Bring your laptop with your preferred IDE and either Python or Node installed. We recommend an AI coding agent like Claude Code, Cursor, or GitHub Copilot.
Bring your favorite sauce! You need access to an LLM provider like Anthropic, OpenAI or Azure Foundry, but you can also use Ollama if you would like to run everything locally and free. Claude Code is highly recommended and will be used for a lot of the demonstrations during the workshop.

Context and Skills Are All Your Agent Needs

In this hands-on workshop, you'll build AI agents that can reason about data, use tools, and hold meaningful conversations.

You'll create a personal finance assistant. An agent that understands natural language, retrieves transaction data, maintains memory across conversations, and helps users make better financial decisions.




- Working with Large Language Models: LLM fundamentals, prompt engineering basics, and raw API calls without abstractions.
- Calling AI services from C#.
- Tool calling: Giving agents the ability to take actions and retrieve external data.
- Reasoning loops: How agents think, plan, and iterate.
- Memory and context management: Maintaining state across conversations.

We'll use Azure AI services throughout the workshop, but the patterns and code apply to other providers like OpenAI, Anthropic, and Google.


By the end of this workshop, you'll have:


- A working AI agent integrated into a .NET backend
- Practical experience with tool use and memory
- A clear mental model for when agents add value versus simpler AI approaches
- Confidence to apply these patterns in your own applications


Yes, if you want to move beyond basic AI integration and build something that reasons. 


- Know how to build APIs with C#
- Have some exposure to AI concepts (prompts, completions, embeddings)
- Prefer learning by doing over slides and theory



- Your favourite IDE
- .NET 10
- Docker
- Git and a GitHub account
- An Azure account (expect around 5–10 € of usage)

Build Your First AI Agent in .NET

.NET

GenAI

This course goes beyond traditional security testing to incorporate novel adversarial machine learning, Responsible AI (RAI) violations, and emerging threats to AI agents. Participants will gain hands-on experience with the latest attack vectors while learning defensive strategies.


The course emphasizes practical application through a custom-built red teaming platform that simulates real-world AI deployments. Participants will work with live AI systems—not mockups or demonstrations—to experience the unpredictable nature of AI vulnerabilities firsthand. Our lab environment includes vulnerable LLM applications, multi-agent systems, and multimodal AI tools that mirror enterprise deployments.

Each module combines theoretical understanding with immediate practical application. When we cover prompt injection techniques, participants immediately test them against live systems. When we discuss automated red teaming, participants build and deploy their own attack workflows using open source tools. This learn-by-doing approach ensures that participants leave with both conceptual knowledge and muscle memory for executing these techniques.

The competitive lab environment includes CTF-style challenges with scoring and leaderboards, making the learning process engaging while building the adversarial mindset essential for effective red teaming.

By the end of this training, participants will be able to:


- Systematically assess LLM applications for prompt injection, data extraction, and jailbreak vulnerabilities
- Execute advanced attacks including Crescendo, Greedy Coordinate Gradient (GCG), Prompt Automatic Iterative Refinement (PAIR), and Tree of Attacks with Pruning (TAP).
- Identify RAI violations across bias, privacy, misinformation, and harmful content categories.
- Leverage automation tools for offensive AI security, benchmarking, and agent building.

- Lab environment: Access to a custom-built platform to AI red teaming.
- Code samples: Complete setup with all tools and target applications .
- Digital Workbook: 400+ slides covered in the course for future reference.


- Laptop with access to the internet.
- Familiarity with the Python programming language and being able to write simple scripts.
- Background in machine learning is not required.


- Module 1: AI Security Landscape
- Module 2: LLM Attack Fundamentals
- Module 3: Automation and Scale
- Module 4: Introduction to Agents and Agentic Systems
- Module 5: Open Source Tooling for AI Red Teaming

- Module 6: Advanced Attack Techniques
- Module 7: Multimodal Models
- Module 8: Building Defenses and Mitigations
- Module 9: Responsible AI Red Teaming

NDC { Porto }

Workshops

09:00 - 17:00 (UTC±00)

Vibe Coding for Production

Nick Chapsas

Build Your First AI Agent in .NET

Gui Ferreira

Context and Skills Are All Your Agent Needs

Aleksander Stensby

AI Red Teaming: Attacks on LLMs, Agents, and Multimodal Systems

Gary Lopez

Bulletproof APIs: Hands-On API Security

Philippe De Ryck