Content
DEF CON is one of the world’s most important gathering places for the international hacker and cybersecurity community. We are therefore all the more pleased that SECUINFRA was represented in the Malware Village with its own cyber defense expertise. Our presentation focused on a challenge that is becoming increasingly important due to the growing use of artificial intelligence in cyber defense: How can AI-supported analysis processes be designed so that even deliberately manipulated documents cannot take control of the triage process?
Hostile Input: When the Analyzed Document Itself Becomes the Attacker
In his presentation at the DEF CON Malware Village , our Principal Cyber Defense Analyst Klaus Wunder addressed the topic “Hostile Input: PDF Triage That Can Withstand a Malicious Document.” The presentation did not focus on theoretical attack scenarios, but rather on robust architectures for an environment in which every file under examination must, as a matter of principle, be treated as hostile.
In a hands-on workshop, participants developed their own triage pipelines and gained firsthand experience with prompt injections, differing interpretations by parsers, and staggered payloads. The use of large language models in analysis workflows, in particular, creates a new vulnerability: content that is actually supposed to be the subject of an investigation can attempt to influence the analyzing system itself.
Our architectural principle therefore sets a clear boundary. The final decision is made by a deterministic gate. The language model provides supporting analysis results but never gains control over the process. In this way, we combine the analytical capabilities of modern AI with technical control mechanisms whose behavior remains transparent and consistently limited.
From the Cyber Defense and Response Center straight to the community
The methods presented here are drawn directly from our daily work at the SECUINFRA Cyber Defense and Response Center. There, AI-powered analyses are applied to real malware, tampered documents, and other potentially malicious inputs. It is precisely this operational experience that shapes our development approach.
We build tools not only for ideal test conditions, but for situations in which attackers actively attempt to outwit analysis mechanisms. For us, resilience against malicious inputs is therefore not an add-on feature, but a fundamental design requirement of modern cyber defense. We deliberately share the insights we gain from this with the security community so that robust methods for broader application can emerge from operational experience.
Discussion on the Future of Practice-Oriented Security Training
Beyond Malware Village, we also used DEF CON as an opportunity for professional exchange. Klaus attended the OffSec Ambassador Meeting alongside OffSec CEO Ning Wang, where he represented the Canadian chapter and discussed with the community how to further develop hands-on security training.
This dialogue is particularly valuable to us. Cybersecurity expertise does not come solely from knowledge of technologies and attack techniques, but above all from applying them under realistic conditions. The exchange between operational cyber defense, research, offensive security, and professional development plays a crucial role in adapting training concepts to the actual challenges of modern threat landscapes.
Cyber defense thrives on collaborative learning
Since its inception, DEF CON has stood for open exchange among hackers, security researchers, developers, and cybersecurity experts. With its conference program, specialized “Villages,” and numerous community activities, the event creates an environment where technical curiosity meets practical experience. That’s exactly where we at SECUINFRA want to be: at the heart of technical discussions, close to emerging attack techniques, and with solutions that must stand up to real-world threats.
We would like to extend our heartfelt thanks to the entire Malware Village team for organizing the event, and to all the participants who spent the morning with us at our keyboards, testing, discussing, and developing new approaches.
We don’t just come away from DEF CON with exciting new ideas. We also bring back to the community what sets our daily work apart: cyber defense that must function under real-world attack conditions.
