Patrick Garrity
Coordinated vulnerability disclosure was built for a world where a handful of researchers reported bugs one at a time. That world is gone. AI-assisted discovery is multiplying the volume of findings, research teams are colliding on the same bugs independently, and vendors are struggling to keep pace with response timelines built for a slower era. This panel brings together veteran voices in vulnerability research and disclosure policy to dig into what coordination actually means in practice, not just in theory, and how researchers, vendors, and platforms should adapt. Expect candid, practitioner-level discussion on disclosure deadlines, vendor silence, undisclosed patches, and when publishing a public proof-of-concept is the right call.
General Paul Nakasone (Ret.) is one of the foremost authorities on cyber operations and national security in the world. As the former Commander of U.S. Cyber Command and Director of the National Security Agency, he led the nation's most consequential offensive and defensive cyber missions, shaping U.S. strategy against state-sponsored threats, ransomware, and election interference. A four-star general with decades of service, Gen. Nakasone brings unmatched operational insight to the intersection of technology, policy, and national security.
Gen. Paul Nakasone (Ret.)
Aayush Vishnoi is a Security Researcher with over five years of experience, specializing in web application security and automation. His core focus lies in engineering custom tools and frameworks designed to scale security and resolve complex manual challenges. He demonstrated this research drive by presenting CertMon, a tool for automated SSL certificate monitoring and vulnerability discovery, at the Bug Bounty Village during Seasides Goa 2025.
Aayush Vishnoi
Benjamin Harris is the CEO & Founder of watchTowr, the Preemptive Exposure Management capability trusted by Fortune 500 companies and critical infrastructure providers. By combining proactive threat intelligence, real attacker telemetry, and automated red teaming, watchTowr continuously identifies and validates real exposure – so security teams can outrun real-world threats. When exploitation happens in hours, watchTowr delivers what no one else can: time to respond.
With over a decade of experience building and leading elite offensive cybersecurity teams worldwide, he brings deep expertise in helping some of the world's most targeted organizations and industries prepare for and defend against sophisticated cyberattacks. Recognized for his work, he was named within Forbes' 30 Under 30 for Enterprise Technology in 2022 and Prestige's 40 Under 40 in 2023.
Benjamin Harris
Eric Forte is a Sr. Security Research Engineer at Elastic. He has worked in technical leadership roles for designing Low Size Weight and Power (SWaP), network security, and IOT reverse engineering capabilities for various organizations. Currently, he is focusing on building network security protections and Detection as Code (DaC) tooling. When not pressing buttons on a keyboard, he enjoys presenting at cyber security conferences including BlueHat, DEF CON's IOT village, and BSides St. Pete.
Eric Forte
John Rodriguez is founder of CyberDagger LLC and an Air Force veteran with over a decade in red team leadership and offensive security. He is a recurring conference speaker on offensive security and threat emulation. His independent vulnerability research isn't limited to one platform — it spans network firmware, EDR/AV internals, and even game engines, from CVE-2026-4837 (Rapid7 Insight Agent RCE) and CVE-2026-7431 (Ivanti Pulse Secure) to a Lua sandbox-escape RCE in a commercial game engine. Rodriguez moved from bug-bounty platforms to direct-to-vendor disclosure and CNA-issued CVEs in March 2026 ~222 vetted findings across 25 targets.
John Rodriguez
Chris Holt is a seasoned bug bounty program leader with over 15 years of experience in application and product security. Certified by GAIC, NTISSI, Guinness, PADI, and the USSF, he has spent the last 8 years building and scaling some of the industry's most respected bug bounty programs. His expertise spans the full spectrum of vulnerability management: from offensive security and researcher engagement to program operations and strategic growth.
Chris Holt
Based in Colorado, Jonathan Person has been in the security industry for over 10 years, working primarily as a penetration tester and security researcher.
Currently, an exploit developer for VulnCheck’s Initial Access Team, Jonathan spends his days creating and weaponizing exploits while also discovering new vulnerabilities for products that span from simple Github projects to IoT devices to full enterprise software suites.
Jonathan Peterson
A globally recognized cybersecurity authority and recipient of the Global Infosec Trailblazing CEO of the Year award, Reuven Aronashvili is the founder and CEO of Cye, a cyber exposure management company. Serving 500+ organizations worldwide, Cye enables security teams to understand, quantify, and reduce cyber exposure over time. With over two decades of elite experience, including founding the Israel Defense Forces' Red Team (Section 21), leading red team and incident response operations for Israel's critical infrastructure, and serving as a trusted advisor to Fortune 500 executives; Reuven brings unique insight into managing AI-amplified cyber threats and translating technical risk into strategic business decisions.
Reuven Aviad
Gal Zaban is the Research Tech Lead at Zafran with over a decade of experience in security research and reverse engineering. She specializes in low-level research and vulnerability research, and has developed and taught a C++ reverse engineering course for Open Security Training 2. Gal has also presented her work at a range of security and development conferences including SANS Cyber Security Summits, REcon, Troopers, Cppcon, and more.
Gal Zaban
Kazuki Omo is a security researcher and practitioner with over 25 years of experience in Unix/Linux, Windows, and cybersecurity technologies. He has extensive experience in security technologies including SIEM, antivirus, OSINT, vulnerability management, and threat intelligence.
He has been involved in OSS security and Linux security for more than 25 years, including professional work on SELinux since 2005. Since 2015, he has focused on vulnerability management, tracking CVEs, analyzing vulnerability trends, and applying vulnerability intelligence to enterprise security.
For the past three years, he has been working in threat intelligence, including threat research, OSINT analysis, and security intelligence training. He is a trainer for Recorded Future's Certified Analyst Lab (CAL), providing threat intelligence training for security professionals.
He is the author of "How to Use OSINT for Security" (Nikkei Linux, 2024) and "The Ransomware Defense Handbook: Cybersecurity Case Studies and Defense Strategies" (2026). He has published security-related articles since 2004 and has presented at international security conferences, including COSCUP Taiwan 2023 on exploited OSS vulnerabilities.
Kazuki Omo
Landon Rice develops exploits and offensive tooling for VulnCheck's Initial Access Intelligence team, with research focused on network edge devices and operating system internals. He co-led this year's Red Team Village training "Writing Production-Grade Exploits in go-exploit" at DEFCON 34, and has previously spoken at HackSpaceCon, SAINTCON, HackMiami, and many local Denver security conferences.
Landon previously worked as a threat researcher, primarily analyzing the Eastern European ransomware ecosystem, including BlackBasta, Zeon, BlackCat, and other post-Conti derivatives.
Landon Rice
Mehul is a seasoned cybersecurity product leader with a proven track record of building award-winning products and scaling B2B SaaS and open-source solutions. With over 20 years of experience in enterprise security, he has led product, engineering, and research teams at industry leaders including Qualys and Tenable.
Mehul Revankar
Johnny Shaieb is currently working on his PhD at the University of Tulsa, where his dissertation focuses on vulnerability database history and scoring. He is the Global Delivery Leader and Chief Architect of IBM’s Cyber Threat Exposure Management practice, an elite unit specializing in penetration testing, adversary simulation, and vulnerability management. His cybersecurity journey began in 1998 at WorldCom after earning a bachelor’s in management information systems from Oklahoma State University. He later pursued a master’s in Telecommunications at OSU and a second master’s in Computer Science at the University of Tulsa, focusing on NSA CyberCorps security.
With over 25 years of experience, Johnny has honed his offensive security skills through academic and professional endeavors. Since 2011, he has taught ethical hacking at institutions like Houston Community College and created the "Hac-King-Do" framework for free ethical hacker training. At IBM, he patented a methodology to automate hacker research and co-founded the X-Force Red Hacker internship with "Space Rogue" to recruit top cybersecurity talent.
Johnny Shaieb
Yotam Perkal leads security research at Pluto Security, a next-generation AI security and governance platform designed to protect the rapidly emerging ecosystem of AI builders, low-code/no-code tools, and agentic applications. His work focuses on securing AI-native development environments and building scalable methods for detecting, validating, and mitigating risks in AI-driven software workflows.
Previously, Yotam led the Threat Research team at Zscaler, headed the Vulnerability Research team at Rezilion, and held multiple roles within PayPal’s security organization across vulnerability management, threat intelligence, and insider threat.
Yotam is an active participant in several cross-industry working groups dealing with AI security, vulnerability management, and supply chain security.
Yotam Perkal
Mike Reed is a principal at Realis Solutions Group, a senior-only advisory firm at the intersection of AI, emerging technology, and enterprise risk, whose advisors have served 28 percent of the Fortune 100. He holds a Master of Science in Management and Leadership and brings a dual-path career spanning technology and channel strategy alongside active emergency services leadership, where accountable judgment under ambiguity is a daily discipline rather than a metaphor. He is the author of "Beyond MDR: How AI Is Reshaping the Security Services Market," an executive strategy paper publishing summer 2026.
Mike Reed
John Fitzpatrick has spent many years leading offensive and defensive cyber teams across some of the world's most critical industries. He is the founder of Lab539, where he focuses on tracking adversary infrastructure, particularly identity-focused attacks and Adversary-in-the-Middle (AiTM) campaigns.
With a background spanning offensive security, vulnerability research, and defensive operations, John combines attacker mindset with practical defence experience to understand how modern campaigns are built and how they can be disrupted. He has spoken at and delivered keynote addresses for leading cybersecurity conferences internationally, and spends much of his time tracking adversaries, uncovering their infrastructure, and finding ways to make their operations fail before they achieve their objectives.
John Fitzpatrick
Joseph Szczerba is a Senior Executive in the FBI’s Cyber Division, leading personnel responsible for strategic cyber planning, intelligence analysis/production, and cyber program management across multiple cybersecurity verticals. Previously, he was responsible for cybercrime and emerging technology/critical infrastructure cyber threat analysis and led the FBI’s CISO Academy. In his 15-year career he has worked in the FBI’s Counterterrorism Division, the Directorate of Intelligence, and the Charlotte Field Office before coming to Cyber Division in early 2021. Joe received his Juris Doctor degree from the University of Buffalo and is admitted to the bar in the District of Columbia. He holds multiple information security certifications including CISM, CISSP, GISP, GPEN, GCIH, and CIPP/US.
Joseph Szczerba
A technology executive, published author, and security strategist with over three decades of engineering and leadership experience. He holds 14 patents and is the author of Agentic AI Security: Designing, Defending, & Governing Autonomous Systems (May 2026), alongside six previous cybersecurity volumes. He currently serves as a Chief Information Officer, specializing in the deployment and governance of enterprise-grade cloud infrastructure, next-generation AI gateways, and advanced autonomous systems.
Raj Badhwar
Ethan Muntz is a Strategic Threat Analyst II at Health-ISAC. Ethan has spearheaded many strategic initiatives, such as joint research with members, a biweekly geopolitical newsletter, and monthly deep-dive reports into influential policy. Ethan also acts as the Health-ISAC liaison in joint research into the developing security risks facing healthcare, such as AI model poisoning and large-scale social engineering. Finally, Ethan facilitates two working groups at Health-ISAC, the Artificial Intelligence Working Group and the Regional Tensions Working Group.
Ethan Muntz
Tim Roberts is Head of Sales Engineering for the Americas at VulnCheck, where he helps enterprise security teams and OEM partners operationalize vulnerability and exploitation intelligence, both inside their security operations and embedded in the products they build. He comes to this talk from the operator's seat as a retired Air Force cyber operator. During his Air National Guard service, Tim served as a defensive cyber operator on cyber protection teams, conducting threat hunting and incident response for the Air Force, and later ran the standards and evaluations program that trained and certified its operators. He built his foundation as a Linux engineer before moving into cybersecurity, administering large production environments across healthcare and defense. Before VulnCheck, he led public sector security operations modernization at Palo Alto Networks across the Cortex portfolio. He prepared this talk from both sides of the problem: running the hunt, and arming the teams that do.
