Provenancekeynote30 min
Opening Keynote: The Supply Chain Is the Product
Where supply chain security actually stands going into 2027 — what three years of incidents changed, what they did not, and the honest scorecard for the decade so far.
Wednesday, 13 January 2027 · 08:00 – 15:00 UTC
The full 7 hours
13 sessions, one track, no clashes — the whole room sees the same conference. Switch the times into your local timezone below.
13 sessions · times in UTC
08:00
to 08:30
08:30
to 08:55
AI25 minWho Built This Model? Provenance for Fine-Tunes
What Northwind Intelligence learned the expensive way, written up honestly. The session walks through what provenance means once the artifact is a set of weights rather than a binary. Short on theory, long on what actually broke.
08:55
to 09:20
SBOM25 minTen Million SBOMs Later: What Actually Breaks at Scale
Sai rebuilt this twice at Harbourline Bank before it held. This is the second attempt. The session walks through what the bill of materials actually told them, and the parts it quietly left out. Pitched at anyone who has to do this themselves next quarter.
09:20
to 09:45
SBOM25 minBuilding an SBOM Lake: Storage, Query, Retention
Three years of data from Fjordline Marine, and the conclusions that surprised them. The session walks through what the bill of materials actually told them, and the parts it quietly left out. Includes the approach they tried first and abandoned, and why.
- Ingrid HalvorsenFjordline Marine
09:45
to 10:00
Break · Sponsor Expo Open
10:00
to 10:25
Provenance25 minReproducible Builds: Three Years, Four Languages, One Diff
A working session from the principal devex engineer who has been carrying this at Shannon Aerospace. The session walks through where the chain of custody held, where it broke, and what it cost to prove either way. Real config, real failure modes, and a frank list of what is still unsolved.
- Daniel BrennanShannon Aerospace
10:25
to 10:50
Open Source25 minAnatomy of a Maintainer Takeover, Step by Step
Gregor has spent the last two years on this problem at Foundation for Open Infrastructure. The session walks through the dependencies nobody owned, and what happened the week one of them went quiet. Expect numbers rather than slogans.
- Gregor PavlovicFoundation for Open Infrastructure
10:50
to 11:15
Open Source25 minTriage at Volume: 400 Advisories a Week, Four People
A field report from Sahel Digital Bank, told by the security programme manager who owned it. The session walks through the dependencies nobody owned, and what happened the week one of them went quiet. You should leave with one change you can make the same week.
- Amara DialloSahel Digital Bank
11:15
to 11:35
Break · Networking Lounge
11:35
to 12:15
SBOMpanel40 minPanel: Has SBOM Delivered on Its Promise?
Four practitioners who ship, ingest and audit bills of materials argue about whether the ecosystem is genuinely better off than it was in 2023 — and what would have to change for the answer to be an unqualified yes.
12:15
to 12:40
AI25 minMCP Servers: The New Unreviewed Dependency
What Zuiderzee Logistics learned the expensive way, written up honestly. The session walks through what provenance means once the artifact is a set of weights rather than a binary. Short on theory, long on what actually broke.
- Mirjam de VriesZuiderzee Logistics
12:40
to 13:05
Regulation25 minCRA Conformity: What Manufacturers Must Ship by 2027
Martina rebuilt this twice at Rheinwerk Automation before it held. This is the second attempt. The session walks through the evidence the auditor asked for, versus the evidence anyone could actually produce. Pitched at anyone who has to do this themselves next quarter.
- Martina SchusterRheinwerk Automation
13:05
to 13:25
Break · Sponsor Expo Open
13:25
to 13:50
Regulation25 minKilling the 300-Question Vendor Security Review
Three years of data from Deccan Assurance, and the conclusions that surprised them. The session walks through the evidence the auditor asked for, versus the evidence anyone could actually produce. Includes the approach they tried first and abandoned, and why.
- Vikram ChandraDeccan Assurance
13:50
to 14:15
Response25 minDetections That Would Have Caught xz Earlier
A working session from the detection engineering manager who has been carrying this at Sentinel Grid Labs. The session walks through the timeline, the detections that fired, and the ones that should have fired first. Real config, real failure modes, and a frank list of what is still unsolved.
- Devon PriceSentinel Grid Labs
14:15
to 14:30
Break
14:30
to 15:00
Responsekeynote30 minClosing Keynote: What We Fix Before Next January
A synthesis of the day: the things the room agreed on, the ones it did not, and the work that carries into 2028.
- SamCascadia Robotics