fwd:cloudsec

Speakers: Priya Puranik & Akshay Mahajan

Priya Puranik is a Senior Security Engineer at Wayfair specializing in cloud infrastructure and governance. Her focus is on operationalizing cloud security and streamlining security processes for infrastructure deployment.

Akshay is a seasoned technologist leading Production Security at Wayfair. He specializes in steering complex security initiatives across large-scale enterprise environments, with a dedicated focus on driving resilience and scalable innovation in the e-commerce sector. https://www.linkedin.com/in/mahajanak

Talk:

For nearly ten years, companies using public cloud infrastructure have struggled to secure against risks like exposed service account keys, weak access control, and misconfiguration leading to public data leaks.

We set out to tackle this problem by balancing practicality with the engineering expectation of velocity. We committed to a multi-year path to make Data security our core pillar by operationalizing VPC Service Controls (VPC-SC) across our Data Assets.

This talk will walk you through how we approached the design, trade-offs, and the lessons learned in execution, including managing millions of error logs and identifying hidden Google-managed service dependencies. We will showcase the impact this roll-out has had on our security posture with practical recommendations and key takeaways for integrating VPC-SC with other essential security processes, including; change management and third-party risk management. Attendees will leave with a practical playbook for moving from "Default Allow" to "Enforced Deny" without causing massive production outages.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Service-specific Guidance: https://github.com/aws-samples/data-perimeter-policy-examples/tree/main/service_specific_guidance

Speaker: Matt Luttrell

Matt is a Principal Security Engineer at AWS and spends most of his day working on IAM. Matt focuses on the customer experience of security - helping make complex systems simpler to secure.

Talk:

Data perimeters are the way to build your own identity-isolated piece of AWS. Sounds perfect, right? In reality, effectively implementing a data perimeter requires understanding multiple policy types, carving out exceptions for legitimate edge cases, navigating service-specific considerations, and rolling out controls without breaking your customers. The good news? With the right approach, implementing a data perimeter at scale is absolutely doable.

This talk takes you beyond the marketing and into the weeds of real data perimeter implementations. Which perimeter (resource, network, or identity) should you start with? How do you inventory existing traffic patterns before you lock things down? How do you slowly and safely roll out an organization-wide control?

You'll leave with practical strategies for implementing data perimeters at scale and hard-won lessons from real deployments, including the mistakes you can avoid and the patterns that actually work.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Corey Quinn

Corey is the Chief Cloud Economist at Duckbill, where he specializes in helping companies improve their AWS bills by making them smaller and less horrifying. He also hosts the "Screaming in the Cloud" and "AWS Morning Brief" podcasts; and curates "Last Week in AWS," a weekly newsletter summarizing the latest in AWS news, blogs, and tools, sprinkled with snark and thoughtful analysis in roughly equal measure.

Talk:

What if I told you there's a class of product on the AWS Marketplace that charges up to 18x the underlying infrastructure cost, makes your instances less secure than the free alternative, carries a "Deployed on AWS" trust badge, and has been operating for seven years despite violating AWS's own published seller policies?

This talk presents original technical research comparing what you're sold versus what you get, names the players, quantifies the financial impact, and asks the uncomfortable question: what exactly is AWS curating?

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Cole HorsmanI've built and operated cloud security systems at Global Atlantic Financial and KKR before joining Sonrai Security as Field CTO. I've spoken at AWS re:Invent and re:Inforce on cloud identity, serves as CISO for ISSA Des Moines, and founded VibeDSM, an AI Builder Community. He believes production scars teach more than conference slides.Talk:Most security teams I talk to don't have a dedicated cloud identity person. IAM cleanup is everyone's side gig and nobody's priority. I decided to fill the gap by hiring AI agents.I built a hiring process. Agents submitted applications, competed in blind skill tournaments scored and reviewed by an independent and external AI evaluator. The highest qualified agents got onboarded to a four agent security team; an IAM agent, a red team agent, a threat intelligence agent and a UEBA agent. Each agent got its own machine identity via IAM roles Anywhere with X.509 certs running on my work machine. Different agents, different blast radii, different permission boundaries.The IAM agent's first assignment was a real AWS account with over 500 identities. Day 1 assess - score every identity across four risk dimensions (permissions risk, usage risk, exposure risk, activity risk). Day 2 surgically reduce risk with a hit list, rather than a backlog of 100k identity findings. Each day I got a summary of what was completed and a remediation plan for the following day.The red team agent consumed attack patterns in AWS IAM from open source intelligence (sources in Github repo) and passed prioritized recommendations to the IAM agent. IAM applied the surgical controls that gate dangerous api actions with approval workflows and a permissions firewall. Red team agent then validated each control blocked the attack path.5 days later the risk score dropped by 42.7% from critical to moderate, 11 attack paths addressed, 8 permission controls across 19 api actions, 9 identities quarantined, and stale keys disabled. The agent also repaired its own bug on the 5th day that fixed quarantine operations by reading vendor docs.This talk covers how to use roles anywhere for agent identity to get started, a plan/apply approach, ABAC for agents, and feedback loops.I'll also show what the agents did to the account, what broke and what auto-remediation guardrails should look like when the operator is autonomous.Recorded at fwd:cloudsec North America 2026 - Bellevue, WAhttps://fwdcloudsec.org/conference/north-america/

Slides: https://docs.google.com/presentation/d/1uIO9UufUdU83CBaAwJb9aENqa2SBr-yIlntp5mk9vWw/Speaker: James BerthotyJames Berthoty is the Founder and Analyst at Latio, the only analyst firm that independently tests every product it reviews.With over a decade of engineering and security experience across companies like VGS, ReliaQuest, and PagerDuty, James has hands-on experience deploying and evaluating nearly every major CNAPP on the market.Talk:Over the last 10 years, cloud security has experienced the rise and fall of many acronyms: CSPM, CWPP, CNAPP (remember CIEM or WAAS?), each promising to be and define the future. For users and vendors, the question remains the same: are we doing cloud security the right way? This talk is tailored to help practitioners navigate the present of cloud security tooling by understanding its origins and what tools are building towards today.We’ll start by mapping early approaches to cloud security: what differentiators mattered for security teams versus what technology was ahead of its time. How did early advancements like agent vs. agentless scanning, runtime insights, and eBPF create the tradeoffs many teams are still living with?We’ll prepare a live walkthrough that unpacks the technical investments vendors made and how those decisions shaped the workflows we know today. We’ll discuss why “platformization” happened, where it genuinely adds value, and where it obscures fundamental gaps.Attendees can expect to leave with:1. A clear sense of what to prioritize when building a modern cloud security program2. What tools and capabilities are available on the market3. A technical framework for evaluating modern tooling beyond marketing acronyms4. Insight into architectural tradeoffs that impact scale, signal quality, and responseThis talk is for those who want to understand cloud security beyond the acronyms, the current tools landscape and learn what capabilities actually matter for modern cloud security efforts.Recorded at fwd:cloudsec North America 2026 - Bellevue, WAhttps://fwdcloudsec.org/conference/north-america/

Blog: https://labs.reversec.com/posts/2026/06/observing-privilege-escalation-in-kubernetes

Speaker: William Taylor

Security consultant with a background in embedded engineering and DevOps, which has lead to an interest in mobile, Cloud, and Kubernetes security. I used to make things work; now I break things, professionally and ethically.

Talk:

Kubernetes famously has a lot of moving parts; clusters can get complicated very quickly and maintaining best security practice can be a challenge. What can make this harder is when good intentions to enhance security backfire and actually introduce risk. This talk looks at observability tools in Kubernetes environments and how the nature of their positioning within a cluster, along with often higher privileges, can expose privilege escalation paths to attackers. This talk will cover specific examples of managed cluster observability tools exposing such risks with their 'out-of-the-box' configuration, as well as how these have been exploited inside real-world production environments. Attendees will also take away recommendations for how cluster administrators can identify and mitigate such risks in their own workloads.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WAhttps://fwdcloudsec.org/conference/north-america/

Speaker: Pavel LineitsevPavel is a Senior Security Engineer on the Detection and Response team at Confluent, where he builds detection rules, designs logging pipelines, and investigates security incidents across multiple cloud providers. With nearly a decade of experience in cybersecurity, he has developed a deep focus on cloud security, detection engineering, and incident response.Talk:Cloud detection rules break silently. You write one, deploy it, and the only feedback is silence — which could mean no attacks, or could mean your rule stopped working three months ago. When you're maintaining rules across multiple cloud providers, the problem compounds: different telemetry, different log formats, etc. We wanted a better feedback loop, so we reached for attack simulation.We started with Threatest, Datadog's open-source framework for pairing cloud attack execution with detection validation. It gave us a solid foundation — but we hit its limits fast. We run a different SIEM, we needed custom attack techniques, and we wanted tighter control over execution and results. So we extended it. This talk is about what we built, what surprised us along the way, and the mistakes we'd avoid if we were starting over.If your team is weighing whether to invest in building something like this rather than buying a commercial alternative, we hope our experience gives you an honest picture of what that actually looks like.Recorded at fwd:cloudsec North America 2026 - Bellevue, WAhttps://fwdcloudsec.org/conference/north-america/

Speakers: Achia Rosenfeld & Kobi Rubin

Achia Rosenfeld is a software engineer with 10 years of experience, currently at ACT Security. I specialize in the analysis of Azure cloud networks to design and develop innovative products. My work focuses on translating deep network research into functional, high-impact security solutions

Kobi Rubin is Head of Research at Act Security, where he focuses on modeling least-privilege infrastructure access. Kobi brings extensive experience in securing CPS and enterprise networks from his years leading Data at Claroty and Medigate. He began his cybersecurity career spending 8 years in Unit 8200 of the Israel Defense Forces.

Talk:

Every Azure VNet ships with invisible infrastructure you didn't configure and can't fully see. System routes that bypass your firewall. Service endpoints that create direct PaaS paths outside your inspection stack. Private Link DNS that resolves differently depending on where you ask. Observability tools that go blind at the boundaries that matter most. This talk maps Azure's "shadow network" — the implicit connectivity that doesn't appear in your Terraform, your portal, or your CNAPP — and shows how to surface what your workloads are actually connected to.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Seth Art

Seth Art is currently a Security Researcher & Advocate at Datadog. Prior to joining Datadog, Seth created and led the Cloud Penetration Testing practice at Bishop Fox. He is the author of pathfinding.cloud, an AWS IAM privilege escalation library, and has published many open source tools including BadPods, IAMVulnerable, and CloudFoxable, and is the co-creator of the popular cloud penetration testing tool, CloudFox.

Talk:

LLMs can surface new attack vectors quickly. They also hallucinate issues that are not actually exploitable, wasting valuable time. As a result, having a way to deterministically evaluate their findings is vital.

In this talk, I present an agentic, skill-based workflow that combines fast AI-driven discovery with deterministic integration tests. Every potential attack is validated before publication, protecting against hallucinations.

Using this approach, I identified over a dozen new AWS IAM privilege escalation paths. I'll walk through the open source lab-based infrastructure and testing system that made this validation possible, and show how the approach scales to broader security research. I will also introduce a brand new Metasploit-style exploitation framework for IAM privilege escalation built on the same methodology.

Attendees will learn how to apply deterministic validation to their own AI-assisted research, and leave with new IAM privilege escalation paths to look for in their own environments.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speakers: Ron Popov & Clément Notin

Ron Popov is a Senior Security Researcher at Tenable, where he spends his days untangling the complexities of modern cloud environments.

With over seven years of experience, Ron comes from a background of on-prem networks and network security. Today, he focuses on the intersection of identity, vulnerability management in cloud environments, and the increasingly volatile software supply chain.

Clément Notin is a Staff Security Researcher at Tenable dedicated to dismantling identity-based risks. Drawing on ten years of experience in offensive security, ranging from boutique consulting to securing global industrial infrastructure, Clément now focuses on identifying systemic weaknesses in Entra ID, Okta, and Active Directory. His research helps bridge the gap between legacy identity management and modern cloud security, providing actionable insights for the world's most complex environments.

Talk:

The rapid adoption of autonomous AI agents, driven by the alluring “song of the Siren”, raises many security questions, including: how should we handle the identity aspect of agentic AI?

When talking security wise, we like to think that AI Agents can be considered a type of cloud workload, which makes AI Agent Identities, a type of NHI (Non-Human Identity). While AI agent identities share some concerns with human identities (like least privilege), they are fundamentally more akin to NHIs due to their machine-driven, programmatic nature and potential for high-velocity, automated actions.

While there are a lot of NHI security solutions, in the fast-paced world of AI agents, it’s very easy to accidentally introduce misconfigurations, including in their attached identities who may be over-privileged. Furthermore, the rapid, sometimes unsanctioned, proliferation of these agents introduces a "shadow AI" problem, where ungoverned agents become "out of control" security risks.

This raises the need for identity solutions custom tailored for agentic AI.

In this session, we venture into the “Abyssal Control Plane” to explore how AI agents function as a specialized, high-velocity breed of Non-Human Identity (NHI).

We will perform a technical teardown of the emerging identity models currently in the glow of the “neocloud”, specifically Microsoft Azure’s Entra Agent ID and Google Cloud Platform’s Vertex AI Agent Identities. Moving beyond the hype, we will map the "hidden rocks" of these preview implementations.

Whether you are securing your CSP, IdP, or SaaS ecosystem, this talk provides the coordinates needed to ensure your organization’s shift toward agentic AI doesn't founder on the hidden “reefs” of ungoverned permissions sprawl and identity drift.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/