Thomas Mackenzie

General Paul Nakasone (Ret.) is one of the foremost authorities on cyber operations and national security in the world. As the former Commander of U.S. Cyber Command and Director of the National Security Agency, he led the nation's most consequential offensive and defensive cyber missions, shaping U.S. strategy against state-sponsored threats, ransomware, and election interference. A four-star general with decades of service, Gen. Nakasone brings unmatched operational insight to the intersection of technology, policy, and national security.

‍

Product Management

Aayush Vishnoi is a Security Researcher with over five years of experience, specializing in web application security and automation. His core focus lies in engineering custom tools and frameworks designed to scale security and resolve complex manual challenges. He demonstrated this research drive by presenting CertMon, a tool for automated SSL certificate monitoring and vulnerability discovery, at the Bug Bounty Village during Seasides Goa 2025.

‍

Benjamin Harris is the CEO & Founder of watchTowr, the Preemptive Exposure Management capability trusted by Fortune 500 companies and critical infrastructure providers. By combining proactive threat intelligence, real attacker telemetry, and automated red teaming, watchTowr continuously identifies and validates real exposure – so security teams can outrun real-world threats. When exploitation happens in hours, watchTowr delivers what no one else can: time to respond.

‍

With over a decade of experience building and leading elite offensive cybersecurity teams worldwide, he brings deep expertise in helping some of the world's most targeted organizations and industries prepare for and defend against sophisticated cyberattacks. Recognized for his work, he was named within Forbes' 30 Under 30 for Enterprise Technology in 2022 and Prestige's 40 Under 40 in 2023.

‍

Doc McConnell is a public policy and cybersecurity leader with over a decade of experience, Head of Policy and Compliance at Finite State.

‍

Jacob is VulnCheck's CTO. When he isn't spending his time bothering everyone, he enjoys immersing himself in VulnCheck's Canary and Target Intelligence data. Sometimes he hunts for zero days and writes exploits. Sometimes. Mostly he bothers everyone.

‍

Eric Forte is a Sr. Security Research Engineer at Elastic. He has worked in technical leadership roles for designing Low Size Weight and Power (SWaP), network security, and IOT reverse engineering capabilities for various organizations. Currently, he is focusing on building network security protections and Detection as Code (DaC) tooling. When not pressing buttons on a keyboard, he enjoys presenting at cyber security conferences including BlueHat, DEF CON's IOT village, and BSides St. Pete.

‍

John Rodriguez is founder of CyberDagger LLC and an Air Force veteran with over a decade in red team leadership and offensive security. He is a recurring conference speaker on offensive security and threat emulation. His independent vulnerability research isn't limited to one platform — it spans network firmware, EDR/AV internals, and even game engines, from CVE-2026-4837 (Rapid7 Insight Agent RCE) and CVE-2026-7431 (Ivanti Pulse Secure) to a Lua sandbox-escape RCE in a commercial game engine. Rodriguez moved from bug-bounty platforms to direct-to-vendor disclosure and CNA-issued CVEs in March 2026 ~222 vetted findings across 25 targets.

‍

Chris Holt is a seasoned bug bounty program leader with over 15 years of experience in application and product security. Certified by GAIC, NTISSI, Guinness, PADI, and the USSF, he has spent the last 8 years building and scaling some of the industry's most respected bug bounty programs. His expertise spans the full spectrum of vulnerability management: from offensive security and researcher engagement to program operations and strategic growth.

‍

Based in Colorado, Johnathan Peterson has been in the security industry for over 10 years, working primarily as a penetration tester and security researcher.

Currently, an exploit developer for VulnCheck’s Initial Access Team, Jonathan spends his days creating and weaponizing exploits while also discovering new vulnerabilities for products that span from simple Github projects to IoT devices to full enterprise software suites.

‍

A globally recognized cybersecurity authority and recipient of the Global Infosec Trailblazing CEO of the Year award, Reuven Aronashvili is the founder and CEO of Cye, a cyber exposure management company. Serving 500+ organizations worldwide, Cye enables security teams to understand, quantify, and reduce cyber exposure over time. With over two decades of elite experience, including founding the Israel Defense Forces' Red Team (Section 21), leading red team and incident response operations for Israel's critical infrastructure, and serving as a trusted advisor to Fortune 500 executives; Reuven brings unique insight into managing AI-amplified cyber threats and translating technical risk into strategic business decisions.

‍

Gal Zaban is the Research Tech Lead at Zafran with over a decade of experience in security research and reverse engineering. She specializes in low-level research and vulnerability research, and has developed and taught a C++ reverse engineering course for Open Security Training 2. Gal has also presented her work at a range of security and development conferences including SANS Cyber Security Summits, REcon, Troopers, Cppcon, and more.

‍

Will Dormann has been in the vulnerability world since 2004. He has discovered thousands of vulnerabilities using custom tooling and automation and sometimes with his brain.

‍

Kazuki Omo is a security researcher and practitioner with over 25 years of experience in Unix/Linux, Windows, and cybersecurity technologies. He has extensive experience in security technologies including SIEM, antivirus, OSINT, vulnerability management, and threat intelligence.

He has been involved in OSS security and Linux security for more than 25 years, including professional work on SELinux since 2005. Since 2015, he has focused on vulnerability management, tracking CVEs, analyzing vulnerability trends, and applying vulnerability intelligence to enterprise security.

For the past three years, he has been working in threat intelligence, including threat research, OSINT analysis, and security intelligence training. He is a trainer for Recorded Future's Certified Analyst Lab (CAL), providing threat intelligence training for security professionals.

He is the author of "How to Use OSINT for Security" (Nikkei Linux, 2024) and "The Ransomware Defense Handbook: Cybersecurity Case Studies and Defense Strategies" (2026). He has published security-related articles since 2004 and has presented at international security conferences, including COSCUP Taiwan 2023 on exploited OSS vulnerabilities.

‍

Landon Rice develops exploits and offensive tooling for VulnCheck's Initial Access Intelligence team, with research focused on network edge devices and operating system internals. He co-led this year's Red Team Village training "Writing Production-Grade Exploits in go-exploit" at DEFCON 34, and has previously spoken at HackSpaceCon, SAINTCON, HackMiami, and many local Denver security conferences.

Landon previously worked as a threat researcher, primarily analyzing the Eastern European ransomware ecosystem, including BlackBasta, Zeon, BlackCat, and other post-Conti derivatives.

‍

Mehul is a seasoned cybersecurity product leader with a proven track record of building award-winning products and scaling B2B SaaS and open-source solutions. With over 20 years of experience in enterprise security, he has led product, engineering, and research teams at industry leaders including Qualys and Tenable.

Johnny Shaieb is currently working on his PhD at the University of Tulsa, where his dissertation focuses on vulnerability database history and scoring. He is the Global Delivery Leader and Chief Architect of IBM’s Cyber Threat Exposure Management practice, an elite unit specializing in penetration testing, adversary simulation, and vulnerability management. His cybersecurity journey began in 1998 at WorldCom after earning a bachelor’s in management information systems from Oklahoma State University. He later pursued a master’s in Telecommunications at OSU and a second master’s in Computer Science at the University of Tulsa, focusing on NSA CyberCorps security.

With over 25 years of experience, Johnny has honed his offensive security skills through academic and professional endeavors. Since 2011, he has taught ethical hacking at institutions like Houston Community College and created the "Hac-King-Do" framework for free ethical hacker training. At IBM, he patented a methodology to automate hacker research and co-founded the X-Force Red Hacker internship with "Space Rogue" to recruit top cybersecurity talent.

‍

Yotam Perkal leads security research at Pluto Security, a next-generation AI security and governance platform designed to protect the rapidly emerging ecosystem of AI builders, low-code/no-code tools, and agentic applications. His work focuses on securing AI-native development environments and building scalable methods for detecting, validating, and mitigating risks in AI-driven software workflows.

Previously, Yotam led the Threat Research team at Zscaler, headed the Vulnerability Research team at Rezilion, and held multiple roles within PayPal’s security organization across vulnerability management, threat intelligence, and insider threat.

Yotam is an active participant in several cross-industry working groups dealing with AI security, vulnerability management, and supply chain security.

‍

Mike Reed is a principal at Realis Solutions Group, a senior-only advisory firm at the intersection of AI, emerging technology, and enterprise risk, whose advisors have served 28 percent of the Fortune 100. He holds a Master of Science in Management and Leadership and brings a dual-path career spanning technology and channel strategy alongside active emergency services leadership, where accountable judgment under ambiguity is a daily discipline rather than a metaphor. He is the author of "Beyond MDR: How AI Is Reshaping the Security Services Market," an executive strategy paper publishing summer 2026.

‍

Coordinated vulnerability disclosure was built for a world where a handful of researchers reported bugs one at a time. That world is gone. AI-assisted discovery is multiplying the volume of findings, research teams are colliding on the same bugs independently, and vendors are struggling to keep pace with response timelines built for a slower era. This panel brings together veteran voices in vulnerability research and disclosure policy to dig into what coordination actually means in practice, not just in theory, and how researchers, vendors, and platforms should adapt. Expect candid, practitioner-level discussion on disclosure deadlines, vendor silence, undisclosed patches, and when publishing a public proof-of-concept is the right call.

‍

Previously led vulnerability response at CISA and spent over a decade in vulnerability research and coordinated disclosure roles at Rapid7. Serves on the CVE Board.

‍

Previously led global vulnerability research teams at Rapid7, with deep experience in CVD and exploit lifecycle tracking. Chaired the CVE Program’s Researcher Working Group.

‍

John Fitzpatrick has spent many years leading offensive and defensive cyber teams across some of the world's most critical industries. He is the founder of Lab539, where he focuses on tracking adversary infrastructure, particularly identity-focused attacks and Adversary-in-the-Middle (AiTM) campaigns.

With a background spanning offensive security, vulnerability research, and defensive operations, John combines attacker mindset with practical defence experience to understand how modern campaigns are built and how they can be disrupted. He has spoken at and delivered keynote addresses for leading cybersecurity conferences internationally, and spends much of his time tracking adversaries, uncovering their infrastructure, and finding ways to make their operations fail before they achieve their objectives.

‍

Joseph Szczerba is a Senior Executive in the FBI’s Cyber Division, leading personnel responsible for strategic cyber planning, intelligence analysis/production, and cyber program management across multiple cybersecurity verticals. Previously, he was responsible for cybercrime and emerging technology/critical infrastructure cyber threat analysis and led the FBI’s CISO Academy. In his 15-year career he has worked in the FBI’s Counterterrorism Division, the Directorate of Intelligence, and the Charlotte Field Office before coming to Cyber Division in early 2021. Joe received his Juris Doctor degree from the University of Buffalo and is admitted to the bar in the District of Columbia. He holds multiple information security certifications including CISM, CISSP, GISP, GPEN, GCIH, and CIPP/US.

‍

A technology executive, published author, and security strategist with over three decades of engineering and leadership experience. He holds 14 patents and is the author of Agentic AI Security: Designing, Defending, & Governing Autonomous Systems (May 2026), alongside six previous cybersecurity volumes. He currently serves as a Chief Information Officer, specializing in the deployment and governance of enterprise-grade cloud infrastructure, next-generation AI gateways, and advanced autonomous systems.

‍

Ethan Muntz is a Strategic Threat Analyst II at Health-ISAC. Ethan has spearheaded many strategic initiatives, such as joint research with members, a biweekly geopolitical newsletter, and monthly deep-dive reports into influential policy. Ethan also acts as the Health-ISAC liaison in joint research into the developing security risks facing healthcare, such as AI model poisoning and large-scale social engineering. Finally, Ethan facilitates two working groups at Health-ISAC, the Artificial Intelligence Working Group and the Regional Tensions Working Group.

‍

Tim Roberts is Head of Sales Engineering for the Americas at VulnCheck, where he helps enterprise security teams and OEM partners operationalize vulnerability and exploitation intelligence, both inside their security operations and embedded in the products they build. He comes to this talk from the operator's seat as a retired Air Force cyber operator. During his Air National Guard service, Tim served as a defensive cyber operator on cyber protection teams, conducting threat hunting and incident response for the Air Force, and later ran the standards and evaluations program that trained and certified its operators. He built his foundation as a Linux engineer before moving into cybersecurity, administering large production environments across healthcare and defense. Before VulnCheck, he led public sector security operations modernization at Palo Alto Networks across the Cortex portfolio. He prepared this talk from both sides of the problem: running the hunt, and arming the teams that do.

‍

Peter Allen brings more than 25 years of experience in enterprise technology and cybersecurity, working with large enterprises and federal agencies to address complex security and infrastructure challenges. His career includes roles with Asimily, runZero, World Wide Technology, Cisco, and Lucent Technologies.

Throughout his career, Peter has worked with organizations navigating the intersection of cybersecurity and network infrastructure, with experience spanning asset visibility, attack surface management, Zero Trust, network segmentation, and the security of mission-critical environments. Prior to joining Asimily, he was an early member of the go-to-market team at runZero, where he helped establish and grow the company's presence within the U.S. Federal Government.

Today, Peter works extensively with healthcare, government, manufacturing, and critical-infrastructure organizations addressing the challenges created by increasingly dynamic IT, IoT, IoMT, and OT environments. His work focuses on helping organizations understand what is actually connected to their networks, identify meaningful risk, and ensure security controls—including segmentation policies—continue to reflect the environments they are intended to protect.

‍

Guillermo Menjivar is a Research Engineer at VulnCheck, where he builds systems for observing and understanding real world exploitation at Internet scale. His work focuses on Internet canaries, exploit telemetry, runtime analysis, and transforming attacker behavior into operational knowledge that improves production security.

Previously, Guillermo was the first engineer and later Vice President of Engineering at GreyNoise, where he helped build one of the industry's largest Internet telemetry platforms. He has also held engineering roles at Elastic and Endgame, designing cloud infrastructure, telemetry pipelines, malware analysis systems, and security platforms.

His current research focuses on AI agent runtime design, operational memory, security harnesses, and autonomous systems that enable defenders to continuously learn from real world exploitation. Guillermo is a frequent speaker on security engineering, SRE, AI infrastructure, and the future of autonomous security operations.

Alex Waintraub is the Practice Leader and Director of Threat Management at DTG, where he leads strategic and hands-on work across DFIR, ransomware response and negotiation, threat hunting, and cyber-resilience services.

With more than a decade in IT, security operations, and incident response, Alex has helped organizations navigate high-pressure cyber events, from initial compromise through containment, investigation, recovery, and executive decision-making. His work blends technical depth with the ability to translate rapidly changing incident details into clear, actionable guidance for security teams and business leaders.

Known for an energetic, practitioner-first speaking style, Alex focuses on the lessons defenders need when theory meets reality: how attackers operate, why incidents escalate, and how teams can respond with discipline under pressure. He is also an active cybersecurity community builder and the organizer of CyberFiresideNJ, creating space for candid conversations, practical education, and real-world cyber war stories.