Conferences

Talks

I've given talks around the world about security, development and AI.

I founded Navaja Negra and the OWASP Madrid chapter. These are the ones people still bring up.

See with books and papers →

16talks

8at RootedCON

2015the first one

RootedCON

2026

When MCP goes Wrong - Que MCP no rompa tu seguridad

Security in Model Context Protocol (MCP): how design and implementation mistakes can compromise an organisation's infrastructure. With Alfonso Muñoz

RootedCON

2026

MCP Enterprise Security: A Practical Architecture and Lessons to Avoid Being Pwned

A practical security architecture for MCP in the enterprise and what we have learned about keeping it from being compromised. With Alfonso Muñoz

RootedCON

2025

Censorship, privacy and the fine art of disappearing without trace

Privacy techniques, censorship, anonymity and robust cryptography. With Dr. Alfonso Muñoz

Since 2015

2024

Navaja Negra

Doing fun things with databases

Unconventional ways to exploit databases, beyond deleting data or stealing information

RootedCON

AWS, with its lambdas and its little things

Real AWS Lambda examples: good, bad and terrible practices. With César Gallego

2023

Navaja Negra

Protecting Python Source Code

Techniques to protect Python source code when it is published, from the simplest to compiling a custom Python interpreter

Navaja Negra

Protect your Python... because if it's as bad as it sounds, better nobody sees it

Techniques to protect Python code, from basic methods to building custom Python interpreters

2022

PyConES

Asyncio in production: what nobody tells you

What I've learned using Python Asyncio in production, processing millions of events per day: the good, the bad and the ugly

RSA Conference

Spreading Application Security Ownership Across the Entire Organization

How to spread the responsibility for application security across the whole organization instead of leaving it only with the security team

2020

RootedCON

From the Heaven to Hell in the CI/CD

Critical vulnerabilities in CI/CD pipelines and how an attacker can compromise the whole development and deployment process

2018

RootedCON

Crawlino: The New Level of Crawling Systems

A high-performance distributed crawling system to scout and analyze web applications at scale

2017

RootedCON

Docker Might Not Be Your Friend - Trojanizing Docker Images

How to trojanize Docker images and why a container registry can end up being the worst enemy of the team that runs it

2016

OWASP Madrid

I Meetup OWASP Madrid

Technical talk on web application security at the first meetup of the OWASP Madrid chapter

RootedCON

Broker & MQ Injection

I introduce the Broker Injection concept and Enteletaor, a tool to inject, extract and modify information in brokers like Redis, RabbitMQ or ZeroMQ

2015

Cybercamp

Python, Hacking and Sec-tools from the Trenches

Hands-on workshop on building security tools with Python, from basic scripts to professional tools

Codemotion

Your DevOp Gives Me Work: I'm a Security Auditor

How DevOps teams are creating new attack vectors and vulnerabilities that we security auditors end up having to fix