Buenos Aires, October 21, 2026. Gustavo Aragón, founder of Oktsec, has been selected to serve on the Program Committee for VulnCon 2027. FIRST and the CVE Program jointly host the annual vulnerability management conference.
The event runs from March 30 to April 2, 2027, in Scottsdale, Arizona. Its venue is the DoubleTree Resort by Hilton Paradise Valley. VulnCon also hosts the annual summit of CVE Numbering Authorities (CNAs), organizations authorized to assign identifiers for publicly disclosed vulnerabilities.
The 2027 Program Chairs are Tomo Ito of JPCERT/CC and Maggie Morganti of Worldpay.
What the committee will do
From October 2026 to April 2027, the committee reviews and scores submissions. Members discuss proposals and select talks and workshops for the program.
They also promote the Call for Submissions. Members cannot present their own work at VulnCon 2027.
FIRST received a large number of applications this year. Selection criteria included subject matter expertise and regional diversity.
Who organizes VulnCon
VulnCon draws researchers, product security groups, government agencies and CNAs.
Founded in 1990, FIRST is the international association of incident response teams. It had more than 820 members in over 110 countries at the end of 2025.
The CVE Program assigns identifiers that vendors, researchers and defenders use to refer to the same publicly disclosed vulnerability.
Three editions, from Raleigh to Scottsdale
Raleigh, North Carolina
The first edition took place at North Carolina State University's McKimmon Center, with more than 40 sessions over three days. Speakers came from CISA, MITRE, ENISA, national CERT teams and OpenSSF.
AI on the agenda
Raleigh hosted again from April 7 to 10. CISA presented its vision for the CVE Program. NIST gave an update on the National Vulnerability Database.
The agenda included NVIDIA, Dell and RAND on identifying and assigning vulnerabilities in AI models and systems.
Scottsdale, data quality and agentic triage
The conference moved to Scottsdale from April 13 to 16 and drew more than 500 attendees. CISA and ENISA opened with a joint session on the future of the CVE Program.
Other sessions covered agentic triage for product security teams, AI bills of materials and bug reports written by language models.
The 2026 committee included practitioners from Dell, Juniper, GitHub, Qualys and Tenable, plus a CVE Board member.
Why it matters now
FIRST expected 2026 to be the first year with more than 50,000 published CVEs.
The CVE Program nearly lost its funding in 2025. CSO reported in March 2026 that CISA and MITRE had renegotiated the contract supporting its operation.
Aragón's research work
Aragón has reported more than 250 security findings to vendors and project maintainers through coordinated disclosure.
He maintains Aguara, an open source scanner that checks AI agent tools, skills and dependencies for supply chain risk.
AI agents add components such as MCP servers, plugins and skills to organizational software. In Aragón's view, most vulnerability programs are still determining how to identify, report and fix their flaws.
Disclosure quality, coordination and software supply chains are recurring topics at VulnCon. They are also at the core of Oktsec's research.
“Our industry is going through one of its most critical moments, with serious incidents almost every week. Taking part in this committee alongside global leaders and the people who define the standards is a unique opportunity to bring a different perspective to problems that affect everyone. I hope we see many submissions from Latin America and the Caribbean, and I look forward to meeting the community in Arizona.”
From Barranquilla to Scottsdale
The appointment follows Aragón's participation in the 24th Americas Competitiveness Exchange (ACE) in Barranquilla, Colombia. The Organization of American States convened the gathering.
He spent a week with representatives of governments, companies and institutions from across the Americas. Aragón received the Partnership Catalyst Award.
During the exchange he signed 15 letters of intent with people and organizations from 10 countries. These explore work in cybersecurity, AI and training.
About Gustavo Aragón
Gustavo Aragón is the founder of Oktsec. He has more than 20 years of experience in technology, including 14 as CTO focused on cybersecurity.
His career includes leading product and engineering in regulated capital markets and fintech in Argentina and Brazil. He also cofounded Brelo, a microlending company in São Paulo.
He is an Ambassador for the Agentic AI Foundation, part of the Linux Foundation.
Aragón gives talks and hands on training on cybersecurity, AI and entrepreneurship for companies, governments and universities.
About Oktsec
Oktsec is the security platform for AI agent work. Control applies runtime policies and keeps audit evidence of what agents do.
Assessment finds attack paths through scoped AI red teaming. Signal checks agent dependencies for supply chain risk.
Oktsec also provides professional Training. The company works with banks, enterprises and startups across the United States, Latin America and the Caribbean.
Sources and further reading
Appointment and biographical details provided by Oktsec. Conference information checked against FIRST's public pages on October 21, 2026.
- FIRST: VulnCon 2027 dates, venue and organizers
- FIRST: 2027 Program Chairs
- FIRST: VulnCon 2024
- FIRST: VulnCon 2025 program
- FIRST: VulnCon 2026 agenda and Program Committee
- SecurityBrief: VulnCon 2026 attendance and conference recap
- SecurityBrief: FIRST's membership at the end of 2025
- SecurityBrief UK: FIRST announces 2026 conference trio
- CSO Online via ThreatBeat: CVE program funding secured