- Jamie Butler
- Dino Dai Zovi
- Matt Devost
- Mark Dowd
- Chris Eagle
- Trey Ford
- Nathan Hamiel
- Robert Hansen
- Jeff Horne
- Vincenzo Iozzo
- Ping Look
- Shawn Moyer
- Kymberlee Price
- Thomas Ptacek
- Billy Rios
- Chris Rohlf
- Jen Savage
- Adam Shostack
- Robert Stratton
- Yuji Ukai
- Alex Wheeler
- Neil R. Wyler
- Chris Wysopal
- Stefano Zanero
Emeritus Review Board
Jamie Butler is the Chief Technology Officer and Chief Scientist at Endgame, where he leads Endgame’s research on advanced threats, vulnerabilities and attack patterns. He has directed research teams at some of the most prominent and successful security companies of the last decade. Most recently, Butler was Chief Architect at FireEye and Chief Researcher at Mandiant. A recognized leader in attack and detection techniques, he has over 17 years of experience and knowledge in operating system security. Butler was a computer scientist at the National Security Agency and co-authored the bestseller Rootkits: Subverting the Windows Kernel. Butler is also a frequent speaker at the foremost computer security conferences and serves as a Review Board member for Black Hat. He co-developed and instructs the popular security courses “Advanced Memory Forensics in Incident Response,” “Advanced 2nd Generation Digital Weaponry,” and “Offensive Aspects of Rootkit Technology.”
Dino Dai Zovi is the Mobile Security Lead at Square. He has been working in information security for over 15 years with experience in red teaming, penetration testing, software security, information security management, and cybersecurity R&D. Dino is also a regular speaker at information security conferences having presented his independent research on memory corruption exploitation techniques, 802.11 wireless client attacks, and Intel VT-x virtualization rootkits at conferences around the world including Black Hat, RSA, DEFCON, and CanSecWest. He is a co-author of the books "The iOS Hacker's Handbook" (Wiley, 2012), “The Mac Hacker’s Handbook” (Wiley, 2009) and “The Art of Software Security Testing” (Addison-Wesley, 2006). In 2008, eWEEK named him one of the 15 Most Influential People in Security. He is best known in the information security and Mac communities for winning the first PWN2OWN contest at CanSecWest 2007.
Matt Devost is a technologist, entrepreneur, and international security expert specializing in counterterrorism, critical infrastructure protection, intelligence, risk management and cybersecurity issues.
Currently, Mr. Devost is President & CEO of FusionX, LLC, a cybersecurity consultancy that helps international corporations identify and manage dynamic threats in complex operational environments. Additionally, Mr. Devost has been an Adjunct Professor at Georgetown University since 2002 where he teaches a graduate course on Information Warfare and security, and is a Founding Director of the Cyberconflict Studies Association. Mr. Devost founded the Terrorism Research Center, Inc. (TRC) in 1996, where he served as President and CEO until November 2008. As founder and President, Mr. Devost oversaw all research, analysis, intelligence, assessment, and training programs. Previously, Mr. Devost held leadership positions at iSIGHT Partners, Technical Defense, Security Design International, iDEFENSE and SAIC. Mr. Devost has been a speaker at hundreds of international conferences and a contributor/author to several books on terrorism and information security.
Mark Dowd is an expert in application security, specializing primarily in host and server based Operating Systems. He is currently the director of Azimuth Security, a botique security company he founded that specializes in code review and cutting edge security research. Prior to starting Azimuth, his professional experience includes several years as a senior researcher at a fortune 500 company, where he uncovered a variety of major vulnerabilities in ubiquitous Internet software. He also worked as a Principal Security Architect for McAfee, where he was responsible for internal code audits, secure programming classes, and undertaking new security initiatives. Mark has also co-authored a book on the subject of application security named "The Art of Software Security Assessment," and has spoken at several industry-recognized conferences.
Chris Eagle is a Senior Lecturer of Computer Science at the Naval Postgraduate School (NPS) in Monterey, CA. A computer engineer/scientist for 28+ years, his research interests include computer network operations, forensics and reverse engineering. He has been a speaker at conferences such as Black Hat, Defcon, Infiltrate, and Shmoocon and is the author of "The IDA Pro Book", the definitive guide to IDA Pro. A former winner of the Defcon Capture the Flag Competition, he is currently working with DARPA to build their Cyber Grand Challenge competition.
Trey Ford is the Head of Trust at Heroku, a division of Salesforce. Heroku's Trust organization is responsible for the service reliability engineering and information security of the platform.
Over the last 15 years, Trey ran Black Hat events worldwide as General Manager, and provided services ranging from strategy, incident response, product management, PCI QSA and security engineering for a variety for industry leaders including Rapid7, Zynga, McAfee, FishNet Security and WhiteHat Security.
Nathan Hamiel is a Managing Consultant for FishNet Security's Application Security Practice. He is also an Associate Professor of Software Engineering at the University of Advancing Technology. He spends most of his time focusing in the areas of application, Web 2.0, and enterprise security. Nathan has been a speaker at security events around the world including: Black Hat, DefCon, ShmooCon, ToorCon, SecTor, OWASP and many others. He is also a developer of several open source security projects including the pywebfuzz and RAFT.
Robert Hansen is the CEO of OutsideIntel. He is the former VP of Labs at WhiteHat security and the former Chief Executive of SecTheory and Falling Rock Networks which focused on building a hardened OS. Mr. Hansen began his career in banner click fraud detection at ValueClick. Mr. Hansen has worked for Cable & Wireless doing managed security services, and eBay as a Sr. Global Product Manager of Trust and Safety. Mr. Hansen contributes to and sits on the advisory board of several companies. Mr. Hansen has co-authored "XSS Exploits" by Syngress publishing and wrote the eBook, "Detecting Malice." Robert is a member of WASC, APWG, IACSP, ISSA, APWG and contributed to several OWASP projects, including originating the XSS Cheat Sheet. He is also a mentor at TechStars.
Jeff Horne is currently the Senior Director of Information Security at SpaceX. Jeff is an accomplished security professional with over 16 years in reverse engineering, vulnerability assessment, antivirus engine creation, incident response, and malware research experience. Prior to SpaceX Jeff was the Vice President of R+D and Chief Architect with Accuvant LABS where he oversaw teams of researchers specializing in malicious code, incident response, breach analysis, and vulnerability assessment. Prior to Accuvant LABS, Jeff pursued a variety of roles in research and software engineering at other major security companies. Jeff worked as a Vulnerability Researcher at Internet Security Systems, where he was responsible for vulnerability discovery, exploit creation, IDS evasion research, and behavioral detection of malware. At Webroot Software, Jeff was the Director of Threat Research where he led several teams of malware researchers, reverse engineers, and a development organization specializing in creating anti malware functionality and signatures for all Webroot products. Jeff is well known for his insight in interviews for numerous news channels and publications, speaking roles at various security conferences, as well as authoring several vulnerability disclosures and patents.
Vincenzo Iozzo is an Entrepreneur in Residence at Rakoku Holdings where he focuses on Information Security. In addition to his work at Rakoku Holdings, Vincenzo is a Partner at the Italian business incubator iStarter SpA. Prior to that, Vincenzo was the Chief of Staff and Principal Security Engineer at Trail of Bits. Prior to Trail of Bits, Vincenzo founded Tiqad, an information security consulting firm, worked as a penetration tester for Secure Network srl and was a reverse engineer for Zynamics GmbH. His specialized research in Mac OS X security, smartphone exploitation, and exploit payloads has been presented at information security conferences around the world including Black Hat, CanSecWest and Microsoft BlueHat. In 2008, he was selected to participate in the Google Summer of Code and developed a testing infrastructure for TrustedBSD, the Mandatory Access Control system that became the foundation for sandboxing technologies included in Mac OS X. Vincenzo serves as a committee member on the Black Hat Review Board and is a co-author of the "iOS Hacker's Handbook" (Wiley, 2012). He is perhaps best known for his participation in Pwn2Own, where he co-wrote the exploits for BlackBerryOS and iOS that won the contest in 2010 and 2011 and where he co-wrote exploits for Firefox, Internet Explorer, and Safari that placed second in 2012.
Ping Look has over a decade of experience building, promoting and managing events in the IT space including two of the most iconic and massively influential IT security events: The Black Hat Briefings+Training and DEF CON. At Black Hat she managed the growth of brand from obscurity to profitability and grew the event from a three track, two day event to a six day, 11 track and training intense event that brought together the best and the most relevant (and occasionally the most obscure) speakers and content providers to Black Hat events in Asia, Europe, the Middle East and the US. During her tenure at Black Hat she was often referred to as the "The One You Don't Want to Piss Off (or you will die)".
Prior to entering the information security and events space, she worked in brand development and management in publishing, textiles and consumer products. She has extensive experience in design and marketing as well as product development.
Ping is currently engaged at Accuvant LABS working with one of the most technically proficient pentest and research teams in the world.
Shawn Moyer is a Founding Partner at Atredis Partners, a private security research and software security consultancy created with frequent BlackHat speakers Josh Thomas and Nathan Keltner, performing on-spec vulnerability research and reverse engineering as well as advanced penetration testing for clients all over the world. Shawn has been involved professionally in information security for 20 years, and unprofessionally for longer than he'd care to admit. Shawn's most recent work has focused on mobile and embedded security, as well as continued work with Smart Grid, SCADA, and other industrial technologies.
Previously, Shawn created the Applied Research at Accuvant Labs, helped launch the Penetration Testing practice at FishNet Security, and has written on emerging threats and other topics for Information Security Magazine and ZDNet. Shawn's research has been featured in the Washington Post, BusinessWeek, NPR, and the New York Times, as well as countless other industry publications. Shawn has been a ten-time speaker at the BlackHat Briefings, and has been an invited speaker at other notable security conferences in the US, China, Canada, and Japan. Shawn has been a member of the BlackHat Briefings Review Board since 2008.
Kymberlee Price With over 13 years' experience in the information security industry specializing in application security incident response and investigations, Kymberlee Price got her start by pioneering the first security researcher outreach program in the software industry at Microsoft. Kymberlee was later a principal investigator in the Zotob criminal investigation, and analyzed APT's at Microsoft. She then spent 4 years investigating product vulnerabilities in BlackBerry's Security Response Team. Today at Bugcrowd, she is responsible for directing the efforts of Bugcrowd's more than 29,000 Crowd members in web application, mobile application, IoT and host infrastructure penetration testing as well as optimizing vulnerability reporting performance for customers and researchers.
Kymberlee co-chairs the Department of Commerce NTIA Working Group on Multi-Party Vulnerability Disclosure and speaks regularly on vulnerability management and product incident response best practices at conferences around the world including Black Hat, RSA, Kaspersky Security Analyst Summit, Nullcon, and Metricon.
Thomas Ptacek is a principal at Latacora, which runs security teams for startups.
A software security practitioner since 1995, Thomas worked at Secure Networks, Network Associates, McAfee, and Arbor networks before cofounding Matasano Security, which is now part of NCC Group.
Billy Rios is the founder of Whitescope LLC, a startup focused on embedded device security. His interests include: web applications, browser, Industrial Control Systems (ICS), Critical Infrastructure (CI), and, medical devices. Billy has worked at Google where he provided security engineering support and led the front line response for externally reported security issues. Prior to Google, Billy was the Security Program Manager for Internet Explorer (Microsoft). Billy is also the 2008 Pwnie award winner for “Best Client Side Bug.”
Chris Rohlf is currently a security engineer at Square in NYC. He specializes in vulnerability discovery, exploitation, and reverse engineering. Chris has over thirteen years of experience in various security roles including software engineer, researcher, and consultant. Prior to Square he led the Red Team at Yahoo, founded Leaf Security Research, a boutique security consulting firm acquired by Yahoo; a Principal Security Consultant at Matasano Security; and previously worked as a Security Researcher for the US Department of Defense.
Jen Savage is an independent security consultant. She performs penetration testing, vulnerability assessment, and security research. She has performed penetration testing services across all industries from startups to Fortune 100 companies. Prior to joining the information security community, she spent 10 years in software development, and focused on secure development. In her spare time, she enjoys hacking on various home electronics, doing yoga, and raising her daughter Ada.
Adam Shostack helped found the CVE, the Privacy Enhancing Technologies Symposium and the International Financial Cryptography Association. He has been a leader at a number of successful information security and privacy startups. He is the author of “Threat Modeling: Designing for Security” and the co-author of “The New School of Information Security.” Shostack is currently a principal program manager on the Microsoft Trustworthy Computing Usable Security team, where among other accomplishments, he shipped the Microsoft Security Development Lifecycle (SDL) Threat Modeling Tool and the Elevation of Privilege threat modeling game as a member of the SDL team.
Robert J. Stratton III is a serial entrepreneur, technologist, and researcher specializing in commercial development of early-stage security technologies, multinational network security, technology policy, and innovation management.
Mr. Stratton is a General Partner in MACH37, a Virginia startup accelerator supporting new information security companies. Previously, he was Chief Strategy & Security Officer at WiTopia, and Director of Government Research at Symantec Research Labs. Before joining Symantec, he was co-founder and CTO at StackSafe, a startup focused on self-healing software and automated software assurance. Mr. Stratton was the first Director of Technology Assessment at In-Q-Tel, a private venture capital firm investing for the benefit of the U.S. Intelligence Community. Mr. Stratton also co-founded and served as Chief Technologist at Security Design International, a services firm specializing in multinational and critical infrastructure network security. Before founding SDI, Mr. Stratton established the Security Posture Assessment™ practice at WheelGroup Corporation and the security organization at UUNET, one of the first tier 1 Internet service providers.
Yuji Ukai is the chief executive officer of FFRI, Inc, known as a technical opinion leader in Japanese security industry.
After completing his Ph.D. in computer science at the National University of Tokushima, he began his employment at Kodak research and development center in Japan where he worked on research and development for digital device and embedded security.
In 2003, he moved to United States and started working on development of vulnerability scanner product at eEye Digital Security as a Senior Software Engineer. He also worked for research of vulnerability analysis, vulnerability auditing, malware analysis, embedded system security, P2P network security, etc. as a Senior Research Engineer at eEye research group. In 2007, he moved back to Japan and became a co-founder of Fourteenforty Research Institute, Inc. Over the last several years, he discovered many critical security vulnerabilities affecting various software products as well as pioneered vulnerability analysis and exploitation of embedded system based on real time operating systems.
Alex Wheeler is the VP of Research and Chief Scientist at Exodus Intelligence. Wheeler is an noted expert in software reverse engineering, code auditing, exploit development, and evasion techniques. With over 15 years of applied security research, Alex's pedigree includes security product pioneers such as Internet Security Systems X-Force R&D and TippingPoint DVLabs. His skill is evidenced by world-wide industry recognition. Wheeler's public research received Pwnie awards for both "Best Server Side Bug" and "Best Client Side Bug."
Neil R. Wyler (a.k.a. Grifter) is an Information Security Engineer and Researcher located in Salt Lake City, Utah. Neil is currently with RSA Security as a Threat Hunting and Incident Response Specialist. He has spent over 16 years as a security professional, focusing on vulnerability assessment, penetration testing, physical security, and incident response. He has been a staff member of the Black Hat Security Briefings for over 14 years and is a member of the Senior Staff at DEF CON where he is the Department Lead for Contests/Events/Villages/Parties and the Demo Labs. Neil has spoken at numerous security conferences worldwide, including Black Hat, DEF CON, and the RSA Conference. He has been the subject of various online, print, film, and television interviews, and has authored several books on information security. Neil is also a member of the DEF CON CFP Review Board and Black Hat Training Review Board. Follow him on Twitter at @Grifter801.
Chris Wysopal, Veracode's CTO and Co-Founder, is responsible for the company's software security analysis capabilities. In 2008 he was named one of InfoWorld's Top 25 CTO's and one of the 100 most influential people in IT by eWeek. One of the original vulnerability researchers and a member of L0pht Heavy Industries, he has testified on Capitol Hill in the US on the subjects of government computer security and how vulnerabilities are discovered in software. He published his first advisory in 1996 on parameter tampering in Lotus Domino and has been trying to help people not repeat this type of mistake for 15 years. He is also the author of "The Art of Software Security Testing" published by Addison-Wesley.
Stefano Zanero received a PhD in Computer Engineering from Politecnico di Milano, where he is currently an associate professor with the Dipartimento di Elettronica, Informazione e Bioingegneria. His research focuses on mobile malware, malware analysis, and systems security. Besides teaching “Computer Security” at Politecnico, he has an extensive speaking and training experience in Italy and abroad. He co-authored over 50 scientific papers and books. He is an associate editor for the “Journal in computer virology and hacking techniques”. He's a Senior Member of the IEEE (covering volunteer positions at national and regional level), the IEEE Computer Society (for which he is a member of the Board of Governors), and a lifetime senior member of the ACM. Stefano co-founded the Italian chapter of ISSA (Information System Security Association), of which he is a senior member. He sits in the International Board of Directors of the same association. A long time op-ed writer for magazines (among which “Computer World”), Stefano is also a co-founder and chairman of Secure Network S.r.l., a leading Italian information security consulting firm, and a co-founder of 18Months, a cloud-based ticketing solutions provider.
Emeritus Review Board
Jeremiah Grossman, Founder of WhiteHat Security. World-Renowned Professional Hacker. Brazilian Jiu-Jitsu Black Belt. Published Author. Influential Blogger. Off-Road Race Driver.
Jeremiah Grossman's career spans nearly 20 years and has lived a literal lifetime in computer security to become one of the industry's biggest names. Mr. Grossman has received a number of industry awards, been publicly thanked by Microsoft, Mozilla, Google, Facebook, and many others for his security research and privately informing them of weaknesses in their systems. He has written hundreds of articles and white papers. Collectively, it's no surprise Jeremiah has been featured in the Wall Street Journal, Forbes, CNN, NY Times and hundreds of other media outlets around the world who regularly rely upon his expertise. And an highly experienced industry veteran, Jeremiah has been a guest speaker on six continents at hundreds of events including TED, BlackHat Briefings, RSA, and many top universities. All of this was after Mr. Grossman served as information security officer at Yahoo!
Mr. Grossman is also a co-founder of the Web Application Security Consortium (WASC), a previously named InfoWorld Top 25 CTO, and he serves on the advisory board of three hot start-ups, Risk I/O and SD Elements, and BugCrowd.
Chris Hoff is currently vice president of strategy and planning at Juniper Networks, after serving as the company's chief security architect. He has held similar roles at Cisco, Unisys Corp. and Crossbeam Systems. Hoff is a founding member and technical advisor to the Cloud Security Alliance, founder of the CloudAudit project and HacKid Technology conference and writes the Rational Survivability blog. Follow him on Twitter @Beaker
Felix 'FX' Lindner is the founder as well as the technical and research lead of Recurity Labs GmbH, a high-end security consulting and research team, specializing in code analysis and design of secure systems and protocols. Well known within the computer security community, he has presented his research for over a decade at conferences worldwide. Felix holds a title as German State-Certified Technical Assistant for Informatics and Information Technology as well as Certified Information Systems Security Professional, is highly specialized in digital attack technologies, but recently changed the direction of his research to defense, since the later seems to be a lot less fun.
Jeff Moss, aka The Dark Tangent
Former Chief Security Officer and VP at ICANN, Founder of Black Hat and DEF CON Conferences
Mr. Moss advises companies on security issues, both, electronic and physical, as well as speaking globally on the topic. He sits on several advisory boards helping enterprises make informed decisions on cyber risks.
In April 2011 Mr. Moss was appointed as the Chief Security Officer for the Internet Corporation for Assigned Names and Numbers (ICANN), a non-profit whose responsibilities include coordinating and ensuring the security, stability and resiliency of the Internet's unique global identifiers as well as maintaining the root zone of the Internet. This position involved managing the IT security of the ICANN networks and information systems, the physical security of ICANN facilities and meetings, and ensuring that ICANN meets its security and resiliency commitments to the multi stake holder community that oversees ICANN. This position involved extensive international travel and coordination with governments, law enforcement, and operational security communities in support of discussions around Internet Governance and security. Mr. Moss left this position at the end of 2013.
Moss is the founder and creator of both the Black Hat Briefings and DEF CON, two of the most influential information security conferences in the world, attracting over ten thousand people from around the world to learn the latest in security technology from those researchers who create it. DEF CON just had its 21st anniversary.
Prior to creating Black Hat Briefings, Jeff was a director at Secure Computing Corporation where he helped establish their Professional Services Department in the United States, Asia, and Australia. His primary work was security assessments of large multi-national corporations. Jeff has also worked for Ernst & Young, LLP in their Information System Security division. Because of this unique background Jeff is uniquely qualified with his ability to bridge the gap between the underground researcher community and law enforcement, between the worlds of pure research and the responsible application of disclosure.
Jeff is currently a member of the U.S. Department of Homeland Security Advisory Council (HSAC), providing advice and recommendations to the Secretary of the Department of Homeland Security on matters related to homeland security. Jeff is a life member of the Council on Foreign Relations, which is an independent, nonpartisan membership organization, think tank, and publisher.
In 2013, Jeff was appointed as a Nonresident Senior Fellow at the Atlantic Council, associated with the Cyber Statecraft Initiative, within the Brent Scowcroft Center on International Security.
In 2014, Jeff joined the Georgetown University School of Law School Cybersecurity Advisory Committee.
Jeff is active in the World Economic Forum, and recently became a member of the Cyber Security Global Agenda Council for 2014-2016.
ICSA President's Award for Public Service, 2011.
Alex Sotirov is an independent security researcher with more than ten years of experience with vulnerability research, reverse engineering and advanced exploitation techniques. He is well-known for his work on exploiting MD5 collisions to create a rogue Certificate Authority, bypassing the browser exploitation mitigations of Windows Vista and developing the Heap Feng Shui exploitation technique. His professional experience includes positions as a security researcher at Determina and VMware. Currently he is working as an independent security consultant in New York. Alexander served as a program chair of the USENIX Workshop on Offensive Technologies and is one of the founders of the Pwnie Awards.
Alex Stamos is the Chief Security Officer at Facebook, where he leads a team of people around the world focused on ensuring the safety of the billions of people who use Facebook and its family of services. Before joining Facebook, Alex served as the CISO of Yahoo and is widely recognized for revitalizing Yahoo’s security program with innovative technology and products. Prior to Yahoo, he was the co-founder of iSEC Partners and founder of Artemis Internet. Alex is a noted expert in global scale infrastructure, designing trustworthy systems, and mobile security. Alex holds a bachelor's degree in Electrical Engineering and Computer Science from the University of California, Berkeley.