ⓘ Boardwalk Bytes 2026 Homepage (Previous Version) is still available — Click here to view the 2026 site.
BOARDWALK BYTES
Meet Our SPEAKERS
Mike Miller - Keynote Speaker
A Founder, executive, and growth strategist with 25+ years of experience starting, scaling, and exiting companies across technology, consumer, and services industries. Founded organizations from ISPs to retail stores to cybersecurity firms – while driving growth through marketing, sales, and brand-building. Leveraged personal brand (180K+ cross-platform followers) to partner with global enterprises on visibility, go-to-market strategy, and social selling.
In addition to growth expertise, He brings a strategic background in cybersecurity and compliance, including third-party risk management, supply chain resilience, and frameworks such as SOC 2, PCI, and ISO 27001. This unique mix allows me to not only build and scale businesses but also ensure they are resilient, compliant, and trusted.
In 2024 he was listed as the top LinkedIn Creator in my niche by Favikon. My LinkedIn Social Selling Index currently ranks in the Top 1% in his Industry and in his Network.
CISO (Chief Information Security Officer) specializing in GRC (Governance, Risk, and Compliance), PCI, Defensive (SOC / Intrusion Detection) and Offensive Security (Penetration Testing), Incident Response
SEE HIS SESSION DETAILS
Your Career DRP (Disaster Recovery Plan)
This will focus on the exciting career of Cybersecurity, building a network (the hand-shaking kind), and locking your career in for full potential. Whether we like it or not, we’re all in business. We’re in the business of selling our knowledge, experience, and wisdom to your next client or employer. This session will help you learn how to take yourself to market.
Mike Miller - Keynote Speaker
A Founder, executive, and growth strategist with 25+ years of experience starting, scaling, and exiting companies across technology, consumer, and services industries. Founded organizations from ISPs to retail stores to cybersecurity firms – while driving growth through marketing, sales, and brand-building. Leveraged personal brand (180K+ cross-platform followers) to partner with global enterprises on visibility, go-to-market strategy, and social selling.
In addition to growth expertise, He brings a strategic background in cybersecurity and compliance, including third-party risk management, supply chain resilience, and frameworks such as SOC 2, PCI, and ISO 27001. This unique mix allows me to not only build and scale businesses but also ensure they are resilient, compliant, and trusted.
In 2024 he was listed as the top LinkedIn Creator in my niche by Favikon. My LinkedIn Social Selling Index currently ranks in the Top 1% in his Industry and in his Network.
CISO (Chief Information Security Officer) specializing in GRC (Governance, Risk, and Compliance), PCI, Defensive (SOC / Intrusion Detection) and Offensive Security (Penetration Testing), Incident Response
SEE HIS SESSION DETAILS
Your Career DRP (Disaster Recovery Plan)
This will focus on the exciting career of Cybersecurity, building a network (the hand-shaking kind), and locking your career in for full potential. Whether we like it or not, we’re all in business. We’re in the business of selling our knowledge, experience, and wisdom to your next client or employer. This session will help you learn how to take yourself to market.
Phillip Wylie - Speaker
Phillip Wylie is a globally recognized offensive security professional and Chief Security Evangelist at Suzu Labs. He co-authored The Pentester Blueprint, hosts The Phillip Wylie Show, Simply Offensive, and CYBR.HAK.CAST, and is a frequent speaker in the US and internationally.
SEE HIS SESSION DETAILS
Invisible Gateways: How Threat Actors Exploit IoT to Breach Organizations
Threat actors increasingly exploit vulnerable IoT devices to breach organizations and are becoming more of a threat due to endpoint protection improvements. This talk reveals real-world tactics, common misconfigurations, and practical defenses to help security teams protect against IoT-based intrusions.
Phillip Wylie - Speaker
Phillip Wylie is a globally recognized offensive security professional and Chief Security Evangelist at Suzu Labs. He co-authored The Pentester Blueprint, hosts The Phillip Wylie Show, Simply Offensive, and CYBR.HAK.CAST, and is a frequent speaker in the US and internationally.
SEE HIS SESSION DETAILS
Invisible Gateways: How Threat Actors Exploit IoT to Breach Organizations
Threat actors increasingly exploit vulnerable IoT devices to breach organizations and are becoming more of a threat due to endpoint protection improvements. This talk reveals real-world tactics, common misconfigurations, and practical defenses to help security teams protect against IoT-based intrusions.
Larry Snyder - Speaker
Dr. Lawrence Snyder III is a professor in the Department of Mathematics, Computer Science, and Digital Forensics at Commonwealth University in Bloomsburg, Pennsylvania, where he teaches in a NSA/DHS NCAE-C designated cybersecurity program. He has over twenty years of experience in cybersecurity, with a background in military police, and previously directed the M.S. in Cybersecurity program at Bay Path University. He holds a Ph.D. in Information Systems and an M.S. in Network Security, with an M.S. in Conflict Analysis and Resolution at Nova Southeastern University.
His research challenges the “human error fallacy” in cybersecurity, arguing that incidents attributed to user error are predominantly products of systemic design failures. This work has produced the Systemic Error Model, Cyber-Phronetic Conflict Theory, and the Post-Incident Conflict Diagnostic, frameworks now in use through his advisory practice, CPCS Advisory, which focuses on post-incident organizational conflict resolution. He is the inventor on a provisional patent for a ransomware-resilient distributed file system architecture and is currently leading development of MTD-CR/DFS, a moving-target defense system built on chunk rotation.
Dr. Snyder has delivered a TEDx talk on cybercrime, testified before the Massachusetts House of Representatives, and appeared as an expert commentator on regional television news. His forthcoming book with Taylor & Francis extends his work on systemic failure and accountability in cybersecurity.
SEE HIS SESSION DETAILS
Cybersecurity’s Favorite Fiction: Human Error
Cybersecurity repeatedly claims that human error is the leading cause of incidents. This presentation argues that the claim is false, intellectually lazy, and professionally convenient. “Human error” is not an explanation. It is a label applied after the fact to avoid examining system design, organizational pressure, and managerial decision-making. When breaches occur, people are blamed because systems cannot testify.
Larry Snyder - Speaker
Dr. Lawrence Snyder III is a professor in the Department of Mathematics, Computer Science, and Digital Forensics at Commonwealth University in Bloomsburg, Pennsylvania, where he teaches in a NSA/DHS NCAE-C designated cybersecurity program. He has over twenty years of experience in cybersecurity, with a background in military police, and previously directed the M.S. in Cybersecurity program at Bay Path University. He holds a Ph.D. in Information Systems and an M.S. in Network Security, with an M.S. in Conflict Analysis and Resolution at Nova Southeastern University.
His research challenges the “human error fallacy” in cybersecurity, arguing that incidents attributed to user error are predominantly products of systemic design failures. This work has produced the Systemic Error Model, Cyber-Phronetic Conflict Theory, and the Post-Incident Conflict Diagnostic, frameworks now in use through his advisory practice, CPCS Advisory, which focuses on post-incident organizational conflict resolution. He is the inventor on a provisional patent for a ransomware-resilient distributed file system architecture and is currently leading development of MTD-CR/DFS, a moving-target defense system built on chunk rotation.
Dr. Snyder has delivered a TEDx talk on cybercrime, testified before the Massachusetts House of Representatives, and appeared as an expert commentator on regional television news. His forthcoming book with Taylor & Francis extends his work on systemic failure and accountability in cybersecurity.
SEE HIS SESSION DETAILS
Cybersecurity’s Favorite Fiction: Human Error
Cybersecurity repeatedly claims that human error is the leading cause of incidents. This presentation argues that the claim is false, intellectually lazy, and professionally convenient. “Human error” is not an explanation. It is a label applied after the fact to avoid examining system design, organizational pressure, and managerial decision-making. When breaches occur, people are blamed because systems cannot testify.
Shesha Reddy Kandula - Speaker
An Application Security Expert, Speaker, and Researcher with over 16 years of hands-on experience helping organizations build secure software — from large-scale enterprise systems to cutting-edge mobile apps. I currently lead Application Security initiatives at Adobe, focusing on protecting Document Cloud products such as Acrobat Sign and Acrobat Mobile.
With 16 years of experience in Application Security, focusing on web, mobile, and APIs, I have developed deep expertise in identifying and mitigating vulnerabilities, particularly in alignment with the OWASP Top 10 for both web and mobile security. Throughout my career, I’ve gained hands-on experience addressing real-world security challenges and hold certifications such as OSWE, OSCP, and CISSP, which further validate my skills.
SEE HIS SESSION DETAILS
Prompt to Breach: Attack Paths in Enterprise AI Assistant Adoption
Organizations are rapidly adopting AI assistants across development, security, and business workflows, but this adoption introduces data exposure risks that traditional security controls are not designed to detect. Employees routinely share sensitive information such as source code, internal documents, and credentials with AI tools that retain and integrate this data across sessions and external systems, often without realizing it.
This talk examines real-world enterprise scenarios in which AI assistants create unintended leakage paths. Consider a developer who pastes an internal API key into a coding assistant that persists context across sessions, or a security analyst whose AI-summarized incident report gets routed through a third-party plugin with its own data retention policy. We will walk through concrete attack vectors, including prompt injection in enterprise workflows, cross-context data exposure between applications, and risks introduced by third-party integrations.
Attendees will leave with actionable defenses covering usage policies, secure integration patterns, isolation controls, and logging strategies they can apply immediately.
Shesha Reddy Kandula - Speaker
An Application Security Expert, Speaker, and Researcher with over 16 years of hands-on experience helping organizations build secure software — from large-scale enterprise systems to cutting-edge mobile apps. I currently lead Application Security initiatives at Adobe, focusing on protecting Document Cloud products such as Acrobat Sign and Acrobat Mobile.
With 16 years of experience in Application Security, focusing on web, mobile, and APIs, I have developed deep expertise in identifying and mitigating vulnerabilities, particularly in alignment with the OWASP Top 10 for both web and mobile security. Throughout my career, I’ve gained hands-on experience addressing real-world security challenges and hold certifications such as OSWE, OSCP, and CISSP, which further validate my skills.
SEE HIS SESSION DETAILS
Prompt to Breach: Attack Paths in Enterprise AI Assistant Adoption
Organizations are rapidly adopting AI assistants across development, security, and business workflows, but this adoption introduces data exposure risks that traditional security controls are not designed to detect. Employees routinely share sensitive information such as source code, internal documents, and credentials with AI tools that retain and integrate this data across sessions and external systems, often without realizing it.
This talk examines real-world enterprise scenarios in which AI assistants create unintended leakage paths. Consider a developer who pastes an internal API key into a coding assistant that persists context across sessions, or a security analyst whose AI-summarized incident report gets routed through a third-party plugin with its own data retention policy. We will walk through concrete attack vectors, including prompt injection in enterprise workflows, cross-context data exposure between applications, and risks introduced by third-party integrations.
Attendees will leave with actionable defenses covering usage policies, secure integration patterns, isolation controls, and logging strategies they can apply immediately.
Atdhe Buja - Speaker
Atdhe Buja is an assistant Professor of computer science, digital forensics, and cybersecurity at the Commonwealth University of Pennsylvania, USA (Bloomsburg University) – Profile page link. Atdhe is a world-renowned cybersecurity expert with decades of experience. He has spoken at many conferences worldwide, including BSides Philly, Boardwalkbytes, FIRST TC, CyberTalks, and EC Council University, etc. As PM, Atdhe has established and led the CERT team in academia and the private sector in Southeast Europe.
Atdhe is certified CISO, an EC-Council Instructor (CEI), Ethical Hacker (CEH), Microsoft IT Professional, and Oracle Administrator for RDMBS, and a leading authority on information technology, Industrial IOT, and ICS/SCADA cybersecurity.
Atdhe research work focused on cybersecurity countermeasures for Industrial IOT, IOT security, ICS/SCADA infrastructures, wireless sensor network WSN, cybersecurity of ML and artificial intelligence, and database management systems. He has scientific contributions to these fields and has published articles, books, and papers in journals, conferences, and workshops. His work was recognized as unique, for which he holds patents.
He has held a variety of roles in the cybersecurity industry, including database administrator, CIO, CERT team manager, cybersecurity trainer, and penetration tester. Atdhe is passionate about helping organizations protect their critical infrastructure from cyberattacks. He is a sought-after speaker and consultant, and his work has been featured in numerous publications and media outlets. He also holds a PhD in Cyber Security, a Master’s in Computer Science, and a Bachelor of Management and Informatics.
SEE HIS SESSION DETAILS
From IOT Attack Data to Actionable Defense: Machine Learning Insights from Real-World Threat Intelligence
The introduction of the expansion of Internet of Things (IoT) and Industrial IoT (IIoT) systems has increased the attack surface, making traditional security mechanisms lacking for detecting modern cyber threats.
Introduction: The research results of the study leverage a dataset containing real attack scenarios, including brute-force attempts and unauthorized access patterns, to train and evaluate multiple machine learning models.
Beyond detection, this work highlights the transition from predictive analytics to actionable cybersecurity insights. Showing 1st prototype of this model, where it predicts results (attack %, total attacks) on any given dataset.
This presentation will provide practical insights into dataset utilization, model selection, evaluation techniques, and the operational relevance of machine learning in cybersecurity.
Atdhe Buja - Speaker
Atdhe Buja is an assistant Professor of computer science, digital forensics, and cybersecurity at the Commonwealth University of Pennsylvania, USA (Bloomsburg University) – Profile page link. Atdhe is a world-renowned cybersecurity expert with decades of experience. He has spoken at many conferences worldwide, including BSides Philly, Boardwalkbytes, FIRST TC, CyberTalks, and EC Council University, etc. As PM, Atdhe has established and led the CERT team in academia and the private sector in Southeast Europe.
Atdhe is certified CISO, an EC-Council Instructor (CEI), Ethical Hacker (CEH), Microsoft IT Professional, and Oracle Administrator for RDMBS, and a leading authority on information technology, Industrial IOT, and ICS/SCADA cybersecurity.
Atdhe research work focused on cybersecurity countermeasures for Industrial IOT, IOT security, ICS/SCADA infrastructures, wireless sensor network WSN, cybersecurity of ML and artificial intelligence, and database management systems. He has scientific contributions to these fields and has published articles, books, and papers in journals, conferences, and workshops. His work was recognized as unique, for which he holds patents.
He has held a variety of roles in the cybersecurity industry, including database administrator, CIO, CERT team manager, cybersecurity trainer, and penetration tester. Atdhe is passionate about helping organizations protect their critical infrastructure from cyberattacks. He is a sought-after speaker and consultant, and his work has been featured in numerous publications and media outlets. He also holds a PhD in Cyber Security, a Master’s in Computer Science, and a Bachelor of Management and Informatics.
SEE HIS SESSION DETAILS
From IOT Attack Data to Actionable Defense: Machine Learning Insights from Real-World Threat Intelligence
The introduction of the expansion of Internet of Things (IoT) and Industrial IoT (IIoT) systems has increased the attack surface, making traditional security mechanisms lacking for detecting modern cyber threats.
Introduction: The research results of the study leverage a dataset containing real attack scenarios, including brute-force attempts and unauthorized access patterns, to train and evaluate multiple machine learning models.
Beyond detection, this work highlights the transition from predictive analytics to actionable cybersecurity insights. Showing 1st prototype of this model, where it predicts results (attack %, total attacks) on any given dataset.
This presentation will provide practical insights into dataset utilization, model selection, evaluation techniques, and the operational relevance of machine learning in cybersecurity.
Matt Barnett - Speaker
Matt Barnett is a cybersecurity executive and incident response leader who has worked on high-stakes ransomware incidents affecting organizations across multiple industries. He is frequently seen on NBC as a go to resource in Philadelphia for cyber events.
Throughout his career, Matt has developed a deep understanding of the complexities involved in protecting sensitive information and responding to security breaches. His work has involved collaborating with various organizations to implement robust security measures and conducting thorough investigations to uncover and address vulnerabilities. His dual background in law enforcement and cybersecurity uniquely positions him to tackle the challenges of modern security threats, making him a sought-after consultant and speaker in the industry.
As a certified forensic analyst, Matt conducts various investigations for clients in the public and private sectors. It is with his technical competency, professionalism, and strategies, that he is able to protect his clients from threats and cyberterrorism.
Because of his expertise and recognition in the field, Matt is consistently regarded as the go-to cybersecurity expert for NBC in Philadelphia. As a seasoned interviewer, he has made countless appearances on the news as well as on web and podcast shows.
SEE HIS SESSION DETAILS
Dealing with Shadows: The Art of Threat Actor Negotiations
This talk offers a practitioner’s perspective on negotiating with threat actors during live extortion events. Drawing on real-world cases, it examines how threat actors communicate, what their behavior signals, and how disciplined negotiation strategy can influence outcomes beyond the final payment amount. Attendees will learn how pacing, message control, and delay are used to buy time, reduce risk, and preserve decision-making authority under crisis conditions.
Matt Barnett - Speaker
Matt Barnett is a cybersecurity executive and incident response leader who has worked on high-stakes ransomware incidents affecting organizations across multiple industries. He is frequently seen on NBC as a go to resource in Philadelphia for cyber events.
Throughout his career, Matt has developed a deep understanding of the complexities involved in protecting sensitive information and responding to security breaches. His work has involved collaborating with various organizations to implement robust security measures and conducting thorough investigations to uncover and address vulnerabilities. His dual background in law enforcement and cybersecurity uniquely positions him to tackle the challenges of modern security threats, making him a sought-after consultant and speaker in the industry.
As a certified forensic analyst, Matt conducts various investigations for clients in the public and private sectors. It is with his technical competency, professionalism, and strategies, that he is able to protect his clients from threats and cyberterrorism.
Because of his expertise and recognition in the field, Matt is consistently regarded as the go-to cybersecurity expert for NBC in Philadelphia. As a seasoned interviewer, he has made countless appearances on the news as well as on web and podcast shows.
SEE HIS SESSION DETAILS
Dealing with Shadows: The Art of Threat Actor Negotiations
This talk offers a practitioner’s perspective on negotiating with threat actors during live extortion events. Drawing on real-world cases, it examines how threat actors communicate, what their behavior signals, and how disciplined negotiation strategy can influence outcomes beyond the final payment amount. Attendees will learn how pacing, message control, and delay are used to buy time, reduce risk, and preserve decision-making authority under crisis conditions.
Stephen Bondurich - Speaker
Stephen Bondurich is an accomplished penetration tester and expert social engineer who conducts advanced adversary simulations to help organizations improve their technical, strategic, and human security postures.
As a senior security consultant at SEVN-X, Stephen is dedicated to safeguarding systems and data against modern threats. With a blend of technical prowess and strategic insight, he specializes in penetrating networks, uncovering vulnerabilities, and advising organizations on enhancing their security posture. Stephen has experience assisting companies navigate the unique challenges present across many diverse industries, including healthcare, finance, education, technology, and more.
In addition to his cybersecurity expertise, Stephen is a practiced expert in the art of social engineering. This expertise is leveraged to go beyond testing purely technical controls to asses the human element of security and understand the complete risks associated with a system. All this done with one goal in mind: helping organizations protect their people, customers, and information.
Stephen holds a Master’s degree in Management and Organizational Leadership from the Penn State Smeal College of Business and graduated Summa Cum Laude from Penn State University with a major in Information Sciences and Technology and a minor in Security and Risk Analysis. Stephen also maintains the prestigious CISSP certification.
SEE HIS SESSION DETAILS
I Am You, and I Can Prove It: Defeating and Redesigning Help Desk Identity Verification
By impersonating employees and outwitting common identity verification procedures, threat actors use phone-based social engineering attacks against IT help desks to achieve account takeover in ways that bypass security controls. This talk will reveal just how easy it is to circumvent common verification procedures and explain why and how these processes fail.
Drawing on hundreds of real-world vishing calls, this talk equips attendees with practical, best-practice methods for verifying employee identities over the phone. These strategies will reduce the risk of account takeover and empower help desk teams with secure, repeatable steps to identify and thwart social engineering attacks.
Stephen Bondurich - Speaker
Stephen Bondurich is an accomplished penetration tester and expert social engineer who conducts advanced adversary simulations to help organizations improve their technical, strategic, and human security postures.
As a senior security consultant at SEVN-X, Stephen is dedicated to safeguarding systems and data against modern threats. With a blend of technical prowess and strategic insight, he specializes in penetrating networks, uncovering vulnerabilities, and advising organizations on enhancing their security posture. Stephen has experience assisting companies navigate the unique challenges present across many diverse industries, including healthcare, finance, education, technology, and more.
In addition to his cybersecurity expertise, Stephen is a practiced expert in the art of social engineering. This expertise is leveraged to go beyond testing purely technical controls to asses the human element of security and understand the complete risks associated with a system. All this done with one goal in mind: helping organizations protect their people, customers, and information.
Stephen holds a Master’s degree in Management and Organizational Leadership from the Penn State Smeal College of Business and graduated Summa Cum Laude from Penn State University with a major in Information Sciences and Technology and a minor in Security and Risk Analysis. Stephen also maintains the prestigious CISSP certification.
SEE HIS SESSION DETAILS
I Am You, and I Can Prove It: Defeating and Redesigning Help Desk Identity Verification
By impersonating employees and outwitting common identity verification procedures, threat actors use phone-based social engineering attacks against IT help desks to achieve account takeover in ways that bypass security controls. This talk will reveal just how easy it is to circumvent common verification procedures and explain why and how these processes fail.
Drawing on hundreds of real-world vishing calls, this talk equips attendees with practical, best-practice methods for verifying employee identities over the phone. These strategies will reduce the risk of account takeover and empower help desk teams with secure, repeatable steps to identify and thwart social engineering attacks.
Chris Maenner - Speaker
Chris is Head of Security at Ybor Technologies, where he focuses on securing Kubernetes platforms, AI workloads, and cloud-native infrastructure. He has been working in security engineering since 2006, spanning roles from early-stage startups to enterprise platform teams.
Chris serves as a board member of BSidesPhilly and is a frequent speaker at security conferences, including multiple BSides events, Boardwalk Bytes, and corporate conferences. He’s passionate about helping fast-moving teams build secure systems without sacrificing velocity.
Outside of security, Chris builds music applications and spends his free time visiting music venues around the world.
SEE HIS SESSION DETAILS
Securing AI Workloads in Kubernetes: Lessons from Scaling Startups
Startups move fast—often faster than their security can keep up. When AI workloads enter the mix, that gap widens fast. This talk breaks down real failure modes we’ve seen in production Kubernetes environments and shows how to apply identity-first security, service mesh controls, and observability patterns to secure AI systems without slowing teams down.
Chris Maenner - Speaker
Chris is Head of Security at Ybor Technologies, where he focuses on securing Kubernetes platforms, AI workloads, and cloud-native infrastructure. He has been working in security engineering since 2006, spanning roles from early-stage startups to enterprise platform teams.
Chris serves as a board member of BSidesPhilly and is a frequent speaker at security conferences, including multiple BSides events, Boardwalk Bytes, and corporate conferences. He’s passionate about helping fast-moving teams build secure systems without sacrificing velocity.
Outside of security, Chris builds music applications and spends his free time visiting music venues around the world.
SEE HIS SESSION DETAILS
Securing AI Workloads in Kubernetes: Lessons from Scaling Startups
Startups move fast—often faster than their security can keep up. When AI workloads enter the mix, that gap widens fast. This talk breaks down real failure modes we’ve seen in production Kubernetes environments and shows how to apply identity-first security, service mesh controls, and observability patterns to secure AI systems without slowing teams down.
Darin Fredde - Speaker
Darin Fredde is a cybersecurity leader with 30+ years of experience across infrastructure, enterprise architecture, and offensive security. He focuses on exposing the gap between perceived and actual security by applying real-world adversarial testing to validate controls.
His work spans penetration testing across enterprise environments, applications, and users bringing an attacker’s perspective to modern security design. In addition to his industry work, Darin teaches ethical hacking, helping others develop practical, threat-informed thinking.
He is known for combining technical rigor with clear communication to drive better security decisions.
SEE HIS SESSION DETAILS
The Art of Cybersecurity | Where Offensive Rigor Meets Persuasion
Modern enterprise security often struggles not because of a lack of tools, but due to misalignment between perceived and actual risk. Organizations rely on architectural assumptions, compliance frameworks, and vendor claims that do not always reflect how real-world attacks succeed.
This talk reframes offensive security—from penetration testing to adversarial emulation—as a mechanism for producing evidence, not just findings. That evidence becomes a tool to influence decisions, challenge assumptions, and align enterprise security architecture with real attacker behavior.
Rather than focusing on isolated vulnerabilities, the session explores how continuous, threat-centric testing exposes systemic weaknesses across identity, access, data, and operational layers. It also shows how these results can be used to drive prioritization, justify investments, and improve communication with leadership.
Attendees will leave with a practical model for integrating offensive rigor into ongoing security strategy, enabling decisions to be based on observed impact rather than assumptions or compliance-driven checklists.
Drawing on hundreds of real-world vishing calls, this talk equips attendees with practical, best-practice methods for verifying employee identities over the phone. These strategies will reduce the risk of account takeover and empower help desk teams with secure, repeatable steps to identify and thwart social engineering attacks.
Darin Fredde - Speaker
Darin Fredde is a cybersecurity leader with 30+ years of experience across infrastructure, enterprise architecture, and offensive security. He focuses on exposing the gap between perceived and actual security by applying real-world adversarial testing to validate controls.
His work spans penetration testing across enterprise environments, applications, and users bringing an attacker’s perspective to modern security design. In addition to his industry work, Darin teaches ethical hacking, helping others develop practical, threat-informed thinking.
He is known for combining technical rigor with clear communication to drive better security decisions.
SEE HIS SESSION DETAILS
The Art of Cybersecurity | Where Offensive Rigor Meets Persuasion
Modern enterprise security often struggles not because of a lack of tools, but due to misalignment between perceived and actual risk. Organizations rely on architectural assumptions, compliance frameworks, and vendor claims that do not always reflect how real-world attacks succeed.
This talk reframes offensive security—from penetration testing to adversarial emulation—as a mechanism for producing evidence, not just findings. That evidence becomes a tool to influence decisions, challenge assumptions, and align enterprise security architecture with real attacker behavior.
Rather than focusing on isolated vulnerabilities, the session explores how continuous, threat-centric testing exposes systemic weaknesses across identity, access, data, and operational layers. It also shows how these results can be used to drive prioritization, justify investments, and improve communication with leadership.
Attendees will leave with a practical model for integrating offensive rigor into ongoing security strategy, enabling decisions to be based on observed impact rather than assumptions or compliance-driven checklists.
Drawing on hundreds of real-world vishing calls, this talk equips attendees with practical, best-practice methods for verifying employee identities over the phone. These strategies will reduce the risk of account takeover and empower help desk teams with secure, repeatable steps to identify and thwart social engineering attacks.