Talks
Everything I can account for. Big conferences, small community meetups, listed the same way here, because they were the same job.
Slides and recordings where they exist. If something is missing from an entry, I couldn’t verify it. That doesn’t mean it didn’t happen.
Topics
- cloud security
- community
- detection
- incident response
- offensive security
- phishing
- red team
- strategy
- threat intel
- tooling
2025
From Snowflake to Snowstorm: Navigating Breaches and Detections
The Snowflake talk taken to x33fcon, a year after CODE BLUE. Same campaign, one that reached more than 165 companies through misconfiguration rather than any vulnerability.
From Snowflake to Snowstorm: Navigating Breaches and Detections
The Snowflake campaign at RSAC. Sensitive data out of more than 165 customers, and not a vulnerability among the causes.
Beyond Simulations: Advancing Detection Validation in Cybersecurity
A room arguing about whether the way we test detections resembles anything an attacker actually does, and what to do instead without burning a quarter of the budget on it. Facilitated, not presented, so there is no recording.
2024
Attackers Aren't Breaking In, They're Logging In: Cloud Security Asymmetry
A twenty-five minute cut of the DeepSec talk, same trip. Same argument, far less room to hedge it.
From Snowflake to Snowstorm: Cloud Breaches and Detections
The Snowflake-related breaches: how one class of credential problem turned into a season of incidents, and what detection should have caught at each step.
Attackers Aren't Breaking In, They're Logging In: Cloud Security Asymmetry
The asymmetry argument. In the cloud an attacker needs a credential, not an exploit, and most of the defensive budget is pointed at the wrong door.
Adversaries Also Lift & Shift: Cloud Threats Through the Eyes of an Adversary
With Adi Belinkov
The cloud attack path from the adversary's side, not the defender's. Attackers moved to the cloud the same way enterprises did. They lifted and shifted what already worked.
2022
Intelligize Your Red Team
With Ohad Zaidenberg
What changes when threat intelligence actually drives red team planning, instead of being a slide at the front of the report nobody reads.
2021
Get Busy Phishing, or Get Busy Paying
A phishing walkthrough for defenders. How the campaign gets assembled in gophish, and where detection has a real chance of catching it.
2020
Meet Caldera
Adversary emulation with MITRE Caldera, set up as something a defending team can run for themselves instead of buying.
2019
Pentesting Isn't Red Teaming
The definitional argument, made early and made bluntly. It later became the first half of a two-part written series, because the misconception never went away.