INTENT Summit 2026 is coming back this year. Help us make it the best thing that has happened since MD5!

INTENT is an information security research summit. It is created by researchers, for researchers.

Here is our chance to talk, hear, and discuss everything around security research - methodologies, techniques, concepts, and approaches. Stories of success, tales of failures, and our favorites - legends of glorious mishaps!

Many conferences will give you a stage to rightfully brag about your amazing work, and we love these conferences. INTENT is different, so we want different submissions. Teach us, enlighten us, and make us all better researchers!

Submission Requirements

1. Submissions must be made in English through the official CFP platform. 
2. Proposals must be submitted by the researcher or intended speaker. 
3. Talks must be designed for 30 minutes. 
4. Sessions will not include a dedicated Q&A period. 
5. Each session may have no more than two speakers. 
6. A short professional biography must be submitted separately for each speaker. 
7. Include a clear title and a public abstract of up to 250 words. 
8. Provide a reviewer-only technical description of the attack, methodology, and findings. 
9. Clearly state what is new, technically significant, or previously unknown. 
10. Describe the attack scenario, affected technology, and required attacker capabilities. 
11. Include supporting evidence such as experiments, a proof of concept, technical artifacts, or a demonstration. 
12. Explain the practical impact and potential attack path. 
13. Disclose previous publications, presentations, and relevant prior work. 
14. For vulnerability research, provide the responsible disclosure and remediation status. 
15. Sales presentations, product demonstrations, company overviews, and recruitment talks will not be accepted. 
16. Submitters must have the authorization and rights required to conduct and present the research.

Topics of Interest

• Identity attack paths — chaining misconfigurations, excessive permissions, and trust relationships to gain control. 
• Authentication and authorization bypasses — weaknesses in SSO, MFA, federation, OAuth, SAML, IAM, and PAM. 
• Credential and session attacks — password theft, token abuse, cookie hijacking, credential replay, and secret extraction. 
• Privilege escalation and identity persistence — targeting human, machine, workload, service-account, and agentic identities. 
• Endpoint exploitation and post-exploitation — initial access, persistence, lateral movement, and privilege escalation. 
• Malware and offensive tooling — implants, loaders, command-and-control, obfuscation, and novel attacker tradecraft. 
• EDR, XDR, and detection evasion — telemetry blind spots, security-control bypasses, anti-analysis, and anti-forensics. 
• AI-enabled offensive research — using AI to discover vulnerabilities, automate attacks, develop tooling, or scale offensive operations. 
• Attacks against AI systems and agents — prompt injection, tool abuse, agent hijacking, model manipulation, and unauthorized actions. 
• Cloud and container attack paths — exploitation across Kubernetes, workloads, service meshes, and hybrid environments. 
• Cloud control-plane exploitation — abusing APIs, permissions, metadata services, automation, and cross-account trust relationships. 
• Connected-system exploitation — network appliances, firmware, IoT, OT, wireless, mobile, 5G, and embedded systems.

By submitting your session information to Palo Alto Networks through Sessionize, you acknowledge that:

1. Non-personal information (such as your session title and description) will not be treated as confidential, in accordance with Sessionize’s Terms of Service.
2. You are responsible for ensuring your content does not violate intellectual property rights or contain viruses or malware of any kind.
3. Your content must not be spam, defamatory, or incite violence.