AI
📙 The Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud 🏗️
cloud securityidentity and access
Topic
Identity & Access
Who can do what, and how you prove it — IAM, zero trust, OAuth/OIDC/SAML, passkeys, Active Directory, Entra ID, PAM, and ITDR.
- IAM
- zero trust
- authentication
- authorization
- OAuth
- OIDC
- SAML
- SSO
- MFA
- passwordless
- passkeys
- Active Directory
- Entra ID
- Okta
- PAM
- identity governance
- RBAC
- ABAC
- federation
- ITDR
52
Talks
7
Conferences
BSidesSF 2026
10 talksBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
identity and accessapplication security
📗 Threat Chords: Tuning into Persistent Patterns in Adversary Behavior 🔥
malware and threat intelidentity and access
📗 Building an open source security project with 1M+ installations ⚖️
identity and accessgovernance and risksecurity leadership
📗 How the Vietnam War created single sign-on — and how it's evolved since
identity and access
📙 The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns 🔥
identity and accessdefensive security
📙 A blueprint for building a generic authorization service for your organization 🏗️
identity and access
📙 Breaking Endpoint Anti-Ransomware: Going Browser Native 🏗️
offensive securityapplication securityidentity and access
📙 RBAC Atlas: Mapping Real-World Kubernetes Permissions and Exposing Risky Projects 🏗️
cloud securityidentity and access
📙 Practical (and impractical) git commit signing 🏗️
identity and accessapplication security
Signed, Sealed, Delivered: Why Reverse Proxies Outperform VPNs - Peter ONeill, Teleport & Boris Kurktchiev, Independent
identity and accessnetwork and infrastructure
Sovereign Identities for Your Cloud Native Architecture With Keycloak - Alexander Schwartz, IBM & Sebastian Łaskawiec, Defense Unicorns
identity and accesscloud security
Tailor Made: Dynamic Fine-Grained Authorization for API Traffic - Erica Hughberg, Tetrate & Andres Aguiar, Okta
identity and accessapplication securitycloud security
Open Policy Agent. (OPA) Intro & Deep Dive - Charlie Egan & Anders Eknert, Apple
identity and accessapplication securitygovernance and risk
SPIFFE Meets OAuth: Federated Identity for Cloud Native Workloads - Yoshiyuki Tabata, Hitachi, Ltd.
identity and accesscloud security
WIT Happens: Exploring the Latest Evolution of the SPIFFE and WIMSE Workload Identity Standards.
identity and accesscryptographycloud security
The Shared Service Blueprint: A Guide to Multi-Tenancy, Illustrated With KEDA - Aya Igarashi, Preferred Networks, Inc.
cloud securityidentity and accessgovernance and risk
Invisible Guardrails: Enabling Developer Velocity With a Secure Platform - James Elías Sigurðarson & Vignir Hafsteinsson, Asana
cloud securityapplication securityidentity and access
[un]prompted 2026
2 talksBrendan Dolan-Gavitt & Vincent Olesen - Agents Exploiting "Auth-by-One" Errors | [un]prompted 2026
offensive securityidentity and access
Capability-Based Authorization for AI Agents: Warrants That Survive Prompt Injection
ai securityidentity and access
NDC Security 2026
5 talksHow to Know Your Client Is Real: Hardware-Backed Authentication Patterns
identity and access
sshlogin: securely authenticating to remote Linux systems via a serial or a text-based interface
identity and accessapplication security
MCP Security: Keep Your AI Agents from Spilling the Tea
ai securitycloud securityidentity and access
Who Gave the Agent Admin Rights?! Securing Cloud & AI Machine Identities
ai securityidentity and access
Getting Authorization Right in .NET: Patterns, Pitfalls, and Practical Guidance
application securityidentity and access
DefCamp 2025
3 talksInitial Access & Workflow: Ransomware Insights at DefCamp 2025
offensive securityidentity and access
Access Denied (eventually) at DefCamp 2025
defensive securityidentity and access
New Kerberos Attack Vector : Disabled SPN Kerberoasting at DefCamp 2025
offensive securityidentity and access
DEF CON® 33 Hacking Conference
14 talksZero Trust, Total Bust - Breaking into thousands of cloud-based VPNs with one bug
offensive securityidentity and accessnetwork and infrastructure
Turning Microsoft's Login Page into our Phishing Infrastructure
offensive securityidentity and access
Passkeys Pwned: Turning WebAuthn Against Itself
identity and accessoffensive securityapplication security
Original Sin of SSO: macOS PRT Cookie Theft & Entra ID Persistence via Device Forgery
identity and accessoffensive security
CTRAPS: CTAP Impersonation and API Confusion Attacks on FIDO2
identity and accesscryptography
#ReclaimTech - A community movement
governance and riskidentity and access
No Brain No Gain
identity and access
Turning your Active Directory into the attacker’s C2: modern Group Policy Objects enumeration and exploitation
identity and accessoffensive security
SCCM: The tree that always bears bad fruits
offensive securityidentity and access
The (Un)Rightful Heir: My dMSA Is Your New Domain Admin
identity and accessoffensive security
Private, Private, Private: Access Everywhere
identity and accessgovernance and risk
OverLAPS: Overriding LAPS Logic
identity and accessoffensive security
Here and Now: Exploiting the Human Layer at the Right Moment
offensive securityidentity and access
Your Passkey is Weak: Phishing the Unphishable
identity and accessoffensive security
Black Hat USA 2025
10 talksBack to the Future: Hacking and Securing Connection-based OAuth Architectures in Agentic AI and Integration Platforms
identity and accessapplication security
Unix Underworld: Tales from the Dark Side of z/OS
offensive securityidentity and access
Windows Hell No for Business
offensive securityidentity and access
ECS-cape – Hijacking IAM Privileges in Amazon ECS
cloud securityidentity and access
Vaulted Severance: Your Secrets Are Now Outies
offensive securityidentity and access
Advanced Active Directory to Entra ID Lateral Movement Techniques
identity and accessoffensive security
FACADE: High-Precision Insider Threat Detection Using Contrastive Learning
defensive securityidentity and access
Clustered Points of Failure - Attacking Windows Server Failover Clusters
offensive securityidentity and access
Abusing Entra OAuth for Fun and Access to Internal Microsoft Applications
identity and accesscloud security
Lost & Found: The Hidden Risks of Account Recovery in a Passwordless Future
identity and accessapplication security