Beyond the Code: What Hack'a Valley 2026 Reveals About Architecture, AI, and Security

Posted on Oct 16 • Originally published at lucasresende.com

Most programming tutorials teach us how to build in ideal conditions: the page loads, the button clicks, and the database saves without a glitch. The reality of production, however, does not forgive architectural oversights.

This past weekend, I attended all nine presentations on the Technical Track of the Hack'a Valley Security Conference 2026 in Paraíba Valley, Brazil. In a single day, I watched live demonstrations of Software-Defined Radio (SDR) spoofing smartphone GPS coordinates over radio frequencies, and an API Gateway dumping JVM memory contents of a banking system due to a misconfigured wildcard route.

Arrival and badge check-in at Hack'a Valley 2026: full immersion in offensive and defensive security tracks.

Even though I am in my first semester of Systems Analysis and Development (ADS) at FATEC, my goal in attending was clear: to examine technology through the lens of engineers who stress-test systems, identify structural weaknesses, and design resilient defenses for mission-critical environments.

The conference reinforced a crucial principle: security is not a separate layer bolted on at the end of a project. It is an integral part of software engineering. Understanding networking, concurrency, memory management, and access controls is what keeps production systems standing.

Below is a breakdown of the key technical and architectural insights from each session.

Speaker: Poliana Moraes (InfoSec & Governance Specialist at CI&T)

This session covered the industry shift from simple text chatbots to autonomous AI agents. These systems receive high-level objectives, dynamically plan multi-step workflows, and trigger external tools such as APIs, databases, and CLI environments with minimal human intervention.

Poliana Moraes (CI&T) explaining the perception cycle, control center, and actuator layers in agentic systems.

The core discussion centered on the difference between two computing paradigms:

Securing probabilistic architectures requires new design patterns:

Speaker: Thiago Bordini (CTI Director at Cyber Horizon Group)

Drawing on over two decades of incident response experience in Brazil, Bordini analyzed the operational tactics of threat actors targeting enterprise and financial institutions.

Thiago Bordini (Cyber Horizon Group) mapping real-world attack lifecycles against enterprise infrastructure.

He highlighted that major breaches rarely stem from cinematic zero-days. Instead, attackers exploit simple developer oversights:

The key takeaway was the power of mastering the basics. Expensive security tooling cannot compensate for absent log visibility, excessive IAM permissions, and an incomplete understanding of business domain flows.

Bordini emphasized the value of intellectual rigor, reminding developers that mastering computer science demands digging into dense technical documentation and core foundations rather than relying on surface-level shortcuts.

Speaker: Fepame (API Security & OffSec Specialist)

A hands-on breakdown of how routing choices in microservice architectures directly impact application security. The API Gateway serves as the single public entry point, validating incoming requests and routing traffic to downstream backend services.

The presentation exposed the risks of overly permissive route configurations:

For software engineers, the message is clear: routing security must be enforced both at the gateway level and inside each downstream microservice.

Speaker: Vinícius Vieira (SecOps Manager at Trustly)

A technical blueprint on leveraging AI agents for Open Source Intelligence (OSINT) investigations in a structured, modular pipeline.

Vinícius contrasted one-off chatbot prompts with specialized agentic architectures. Rather than stuffing instructions into a massive single prompt, the recommended approach uses a central orchestrator that assigns discrete tasks to dedicated sub-agents: record collection, public data cross-referencing, anomaly detection, and automated report drafting with persistent state.

The session also addressed strict operational security (OPSEC) guidelines:

Speaker: Felipe Prado (Head of AI & Cyber Analytics at Credicorp)

A historical retrospective connecting early computing milestones to modern cloud and AI challenges.

Prado traced key turning points across computing history:

The main takeaway was the cyclical nature of cybersecurity: emerging technologies frequently reintroduce classic problems of input validation, identity verification, and access controls under new abstraction layers.

Speaker: Osmany Arruda (Incident Response Specialist at Tempest and Professor at FATEC)

An exploration of cybersecurity in Operational Technology (OT) environments, which govern industrial processes, electrical grids, and automated factory production lines.

Arruda contrasted operational priorities between traditional IT and industrial OT:

The presentation debunked the myth of the impenetrable Air-Gap, showing that maintenance wireless networks and transient field devices frequently bridge the gap. Arruda demonstrated how AI accelerates writing Kusto Query Language (KQL) rules in SIEM platforms to catch anomalies in legacy industrial protocols like Modbus and CIP without interrupting plant operations.

Speaker: Alberto Magno (Aerospace Cybersecurity Researcher)

A deep dive into the physical layer of radiofrequency transmissions and the vulnerability of Global Navigation Satellite Systems (GPS, GLONASS, Galileo, and BeiDou).

Alberto clarified two primary interference methods:

Using a Software-Defined Radio (HackRF One) and custom Python scripts, he demonstrated:

The demonstration underscored the security risks for autonomous fleets and commercial aviation, emphasizing the necessity of redundant Inertial Navigation Systems (INS) that do not rely solely on external radio signals.

Speakers: Cybelle Oliveira (La Villa Hacker DEF CON) and Divina Vitorino (LATAM InfoSec Coordinator)

Cybelle Oliveira (La Villa Hacker) breaking down the operational infection and data exfiltration flow of RedLine Stealer.

The speakers detailed how threat actors were unmasked by Cyber Threat Intelligence (CTI) teams and law enforcement through elementary operational security (OPSEC) failures:

The conclusion was unequivocal: technical malware sophistication is useless when paired with poor operational discipline and process failures.

Speaker: Zoziel Freire (CSIRT Manager at Telefônica Brasil)

A session debunking the perception of invulnerability surrounding Apple's operating system, examining built-in defenses (Gatekeeper, SIP, and XProtect) and real-world attack vectors targeting macOS.

The talk concluded with an emphasis on behavioral telemetry and deep integration with Apple's Endpoint Security Framework (ESF).

Beyond the main-stage talks, the conference provided direct interaction with emerging hardware and security practitioners.

Testing a brain-computer interface (BCI / EEG) to control hardware devices at the FIAP booth.

In the community exhibition hall, interactive demonstrations such as FIAP's Brain-Computer Interface (BCI / EEG) rig, which translated neural activity into physical lamp switching, illustrated how boundaries between hardware, software, and biometric telemetry continue to blur, introducing fresh challenges for reliability and secure system design.

Attending Hack'a Valley confirmed an essential engineering reality: developers who understand how underlying infrastructure operates write software that is significantly more resilient, performant, and scalable.

Grasping API gateway routing quirks, AI agent governance, network segmentation, and log retention is not something exclusive to security researchers. It is the technical foundation required to make sound architectural decisions every day.

Each presentation opened valuable areas of study that I will continue exploring at FATEC and applying directly to my production projects.