Signal vs Noise focused 160th DevClub.lv

Proving who you are online is harder than it looks. Hi! Finding vulnerabilities is getting easier. Deciding which ones to fix first is getting harder. At our next DevClub.lv, three speakers look at AI in security from the attacker’s, the developer’s and the SOC analyst’s point of view. You are welcome to Signal vs Noise focused event on November 12, 18:30, at Tallink Hotel Riga – Elizabetes iela 24, Rīga. Please note that due to venue rules and our budget limits snacks and drinks will not be provided at this event. We kindly ask you to plan accordingly. Agenda for "Signal vs Noise focused" 160th DevClub.lv: Gvido Bērziņš from Tet will give a talk “The Blurring Line Between Coding and Hacking”. The line between software development and hacking is becoming increasingly blurred. Hackers are adopting the same tools, frameworks, and technologies as developers, but using them in different ways — adapting existing solutions, building custom tools, and automating tasks that once required extensive manual effort. In this session, I will share a pentester's perspective on how offensive security tooling is evolving. We'll explore how hackers approach software development, why custom tooling is becoming an essential part of security testing, and how AI agents are changing the way we research, develop, and automate security workflows. We'll also look at the emerging concept of hackbots - AI-powered agents capable of exploring applications, interacting with systems, identifying potential vulnerabilities, and automating parts of the security testing process. What happens when security tools stop being just tools and start making decisions on their own? Topics include custom security tooling, developer tools in offensive security, AI-assisted development, security automation, and autonomous vulnerability discovery. (Language: English) Tags: AppSec, Cybersecurity, Penetration Testing, Offensive Security, AI Agents, Security Automation, Hackbots, Developer Tools Gvido Bērziņš is a Senior Cybersecurity Engineer at Tet and an OSCP-certified penetration tester with experience in application security, offensive security and security tool development. His work focuses on identifying vulnerabilities in applications and systems, developing custom security testing solutions, and automating security research workflows. With a background in both software development and cybersecurity, he explores how emerging technologies, including AI-powered agents, are reshaping the way security professionals work. Lauris Bukšis from Dativa will give a talk “Beyond CVE Alerts: Contextual Vulnerability Triage with Local SLMs”. Every dependency scanner gives the same answer: package X has CVE Y. On a real Latvian public-sector system (2,153 dependencies across Go, npm, and .NET), that meant 118 open vulnerabilities. CVSS describes the library, not how your code uses it. Together with researchers from Riga Technical University, we built a pipeline asking a narrower question: does this specific file use the vulnerable package, and how much does that matter? We catalog dependencies with Syft, match them to known CVEs, drop unaffected files via static import filters, and let a local SLM score remaining file-level risk (0–5) with written justification. A small ML model combines these scores with CVSS and retrains on analyst feedback—without any source code leaving the premises. I’ll share what worked, the engineering tradeoffs of swapping DeepSeek-R1-8B for Mistral 3B Instruct (4x smaller, 2.5x faster), what we haven't solved yet (evaluating accuracy across our 168-case test set), and how this mindset supports compliance like CRA and NIS2. (Language: English) Tags: software supply chain, dependency vulnerabilities, CVE triage, local LLM, small language models, static analysis, AppSec, CRA, NIS2 Lauris Bukšis is the CISO of Dativa with 25 years of hands-on experience at the company across software development, systems architecture, and security leadership. A builder at heart, he continuously tracks emerging tech to introduce modern tools, automation, and pragmatic, local-first security practices directly into engineering and development workflows. Rolands Bīrons from BR2SEC will give a talk “Signal in the Logs: AI-Assisted Triage in an Open-Source SOC”. A SOC is only as good as the data it sees and the alerts its analysts can actually get through. Web servers write access logs, endpoint agents report file and process changes, and vulnerability scanners add CVE alerts on top. Most of it is noise, but the one request that matters is somewhere in there. In this session, I will look at a working SOC setup built on Wazuh, the open-source security platform. We'll start with the data: exploring which logs are worth collecting, whether web server logs are just noise and data bulk, and whether we actually need to parse everything. I'll also share my local LLM + Wazuh setup and demonstrate a custom Wazuh plugin I developed that uses AI to filter false positives and analyze alerts in place. We'll also look at how a SOC can become a single hub for overlooked security signals, such as dependency vulnerabilities and leaked credentials, using enki-guard as an example. While AI is powerful and can spot patterns faster — and sometimes better — than a human, a fully autonomous AI SOC isn't realistic in the near future. Many routine administrative tasks look suspicious to an LLM, and if you tune the model too aggressively to ignore that noise, you risk blinding it to real attacks. In modern security operations, data context and enrichment are essential — even for LLMs — raising the question: how do we feed AI the right context while remaining careful with sensitive data? Topics include log selection and noise reduction, open-source SOC architecture with Wazuh, custom AI plugins for alert triage, integrating external security signals, and safe data enrichment for local LLMs. (Language: English) Tags: SOC, Wazuh, Log Analysis, Alert Triage, False Positives, AI in Security Operations, Open Source Security, Threat Detection Rolands Bīrons is the CEO of BR2SEC and a certified penetration tester, auditor, and developer (OSCP+, CRTP, CISA, ISACA AAIA, CEH). Starting his career in software development and DevOps before moving into penetration testing, stress testing, and systems auditing, he brings over 15 years of hands-on experience across Linux, Windows, Active Directory, and diverse enterprise environments. His work focuses on offensive security, auditing complex infrastructures, and building custom security tooling — exploring how open-source platforms and AI can automate workflows and make everyday threat detection more effective. Tech Leaders Forum by Nine Brains returns on November 24 in Riga! After very positive feedback from the first Forum in September: 5 real-world cases + 5 structured peer discussions for CTOs, VPs/Heads of Engineering and other senior technology decision-makers. Early bird €150 + VAT until November 15. Learn more and apply. Videos from previous events you can find at our homepage and our YouTube channel. The best way to be informed about new videos is to Subscribe to our YouTube channel. GoCardless is a global fintech building the world's bank payment network, processing over US$130B annually for 100,000+ businesses. Our teams also use AI and open banking to increase payment success and reduce fraud, creating complex engineering challenges at a massive scale. We’re solving problems that affect how money moves globally.