FEATURED SPEAKERS

Ladislav Baco

Ladislav is a Senior Security Consultant, Malware Analyst, and Network Analyst with more than 10 years of experience in computer security, computer science, and education. Currently he works as a Network Analyst at ESET, with focus on Network Forensics, Threat Hunting, Threat Intelligence, and Research of Intrusion Detection.

Shivani Bhardwaj

Shivani graduated in 2016 and started her career with Python development. She was an intern with the Netfilter project and also a recipient of a scholarship from The Linux Foundation. She has been associated with several open-source communities ever since and promotes women in STEM. Shivani does not have a particular place of stay but she’s found somewhere in India for most of the year.

Charles Blanc-Rolin

Charles is a “swiss knife in cybersecurity.” A Suricata enthusiast, he finally joined a CERT Team as Lead SOC analyst a year ago, after 17 years in the French healthcare sector. He’s sharing his discoveries through detection rules with PawPatrules ruleset.

Sake Blok

Sake has been analysing packets for over 25 years. While working for a reseller of networking equipment, he discovered many bugs in devices from multiple vendors and presented his findings to the vendors to fix the issues. He also discovered many configuration issues that have led to functional problems or performance issues in applications running over the network, resulting in changes that solved the issues. In 2009, Sake started the company SYN-bit to provide dedicated root cause analysis and training services to his customers across Europe.

During his work Sake started developing functionality for Wireshark that he missed while working with Wireshark in his day-to-day job. He also enhanced multiple protocol dissectors to suit his analysis needs. In 2007 Sake joined the Wireshark Core Development team.

Randy Caldejon

Randy Caldejon is the founder and CEO of Caldorion (caldorion.com), a startup applying pattern-of-life analysis to perimeter security with autonomous ground vehicles (AGVs). Because the platform runs on ROS 2, securing the robot’s own network traffic is part of the work, and that is where his Suricata support for RTPS began. He holds an MEng in Computer and Systems Engineering from Rensselaer and lives on a farm in central Virginia.

Champ Clark III

Champ is the CEO of Key9, Inc., where he leads the development of next-generation security solutions for global organizations. A veteran of the industry, he previously served as CTO at Quadrant Information Security and has spent decades consulting for Fortune 100 companies.

He is a lifelong open-source advocate and the original creator of the Sagan Log Analysis Engine. A frequent presence on the global stage, Champ has shared his research at multiple Suricons, DEFCON, HOPE, CCC Congresses, B-Sides, and other major industry forums.

Beyond the terminal, he is a published author, a musician, and an avid traveler. Champ credits his success to the support of his wife, Whitney, and his daughter, Alex, who have mastered the art of living with a lifelong hacker.

William Hedenskog

William works as a SOC Analyst at Truesec, with a Master’s degree in Cybersecurity at KTH Royal Institute of Technology. This research was conducted as part of his Master Thesis in collaboration with Truesec.

Susan Hinrichs

Susan is a distinguished engineer at Aviatrix leading efforts on the Distributed Cloud Firewall. She is a committer on the Apache Traffic Server project and a member of the Apache Software Foundation. Before Aviatrix Susan led efforts with the Edge team at Yahoo. For several years she taught network and computer security courses at the University of Illinois. Susan participated in the tech bubble by working with a network security company that got acquired by Cisco. Susan earned a PhD in Computer Science at Carnegie Mellon University and a BS in Computer Science from the University of Illinois. In her spare time, Susan practices yoga and hikes.

Victor Julien

Victor has been active as a software developer in the infosec community for many years. He is the creator of the Vuurmuur Firewall project and has been one of the developers at the Snort_inline IPS project. Victor has spent the last few years doing contract development on Open Source security software, including significant additions to Snort. At the end of 2007, he started development on the OISF codebase on which he now leads the development effort. Victor resides in Amsterdam, The Netherlands.

Nicklas Keijser

Nicklas is one of Sweden’s most experienced cybersecurity experts, with deep expertise in OT security, incident investigations, and advanced cyberattacks. He began his career programming industrial control systems, which has given him a strong technical foundation and a practical understanding of how cyberattacks impact physical processes and critical infrastructure. Prior to joining Truesec, he worked at CERT SE, focusing on incident response related to critical infrastructure.

Today, Nicklas works at Truesec as Technical Lead OT within Detection Services, where he drives the technical development of monitoring and detection capabilities for OT environments. He is also a frequently invited speaker and expert commentator, sharing practical insights and real world experience on the current cyber threat landscape.

Patrick Kelley

Patrick is the CEO of Léargas Security and Critical Path Security, with over 25 years of experience in critical infrastructure, the defense industrial base, and cybersecurity operations.

He has spent his career helping organizations understand how trust, identity, and access interact across modern environments, particularly as cloud, SaaS, and AI-driven systems reshape the threat landscape. Patrick has served as a network news expert featured on NBC, CNN, Bloomberg, and Fortune, and regularly advises organizations on adopting AI and advanced security technologies without losing operational control.

His work focuses on bridging the gap between detection, visibility, and real-world attack behavior, with an emphasis on identity-driven threats and emerging risks introduced by autonomous systems.

Markus Kont

Markus is a threat researcher and software engineer at Stamus Networks. In this role, he is focused on threat intelligence, data science and engineering, and backend research and development. Before joining Stamus Networks, Markus spent over 5 years as a technology researcher in the NATO Cooperative Cyber Defense Center of Excellence, where he specialized in monitoring and intrusion detection, and conducted classroom trainings for Suricata and Moloch. Prior to that he worked as a server administrator for an Estonian hosting and software development company. Markus holds a Master of Science degree in Cyber Security and has published several academic papers while pursuing a PhD. He resides in Tallinn, Estonia.

Jamie Lavigne

Jamie is a Principal Software Dev Engineer with over 10 years of experience building and operating highly resilient network security services at AWS. Jamie has been a technical lead of the AWS Network Firewall service since its inception and continues to focus on ensuring that it meets the security, compliance, and availability needs of its internal and external customers.

Éric Leblond

Éric is the co-founder and chief technology officer (CTO) of Stamus Networks and sits on the board of directors at Open Information Security Foundation (OISF). He has more than 20 years of experience as co-founder and technologist of cybersecurity software companies and is an active member of the security and open-source communities. He has worked on the development of Suricata – the open-source network threat detection engine – since 2009 and is an emeritus member of the Netfilter Core team, responsible for the Linux kernel’s firewall layer. He is a respected expert and speaker on all things network security and resides in Escalles, France.

Peter Manev

As an OISF executive team member, Suricata Project Evangelist, and co-founder/CSO of Stamus Networks, Peter brings over 20 years of IT security expertise with a strong focus on open-source network detection and response. Involved with Suricata since 2009, he is also a maintainer of ClearNDR Community (formerly SELKS) and co-author of The Security Analyst’s Guide to Suricata. Peter has authored scientific papers on cyber strategy and delivered over 100 hands-on workshops and trainings for elite entities like NATO, the US Space Command, and the US Missile Command—including a decade of instruction for major live-fire cyber exercises like Locked Shields and Crossed Swords. Peter frequently speaks and conducts trainings at global conferences including Bsides, BlackHat, DEFCON, RSA, Troopers, FOSDEM, and SuriCon.

Konstantinos Margaritis

Konstantinos Margaritis has over 20 years of experience in algorithm optimization using SIMD on both open-source and proprietary software on multiple platforms: Arm NEON/SVE2, x86 SSE/AVX2/AVX512, Power VSX, s390x ZVector and others.

He is a Debian Developer since 1999, a Distinguished Arm Ambassador and also a Silver member of the ISA Working Group of OpenPower Foundation.

He is the Founder and CTO of VectorCamp, a niche company that specializes in SIMD and Software Optimizations. VectorCamp is the creator of SIMD.info, the best online knowledge-base on SIMD intrinsics for all major architectures. VectorCamp is an official Arm Partner.

His passion is retro computers.

Kelley Misata, PhD

Kelley is a strategic leader, speaker, and innovator who combines over 15 years in business leadership roles with a passion for facilitating critical conversations around responsible digital citizenship, digital safety, and privacy. Her work with The Open Information Security Foundation and past work at The Tor Project spans across fundraising, advocacy, policy discussions, marketing, and outreach activities with an array of stakeholders. She is also expanding her groundbreaking dissertation research in the information security of non-profits workings with victims of violence. Kelley combines professional and research endeavors with a unique perspective as a survivor of cyberstalking. She continually draws on current trends and conversations in information security and privacy to create strategies that focus on intersect people, process, and technology. Bringing to the table a fearless and unique perspective on privacy and security drives Kelley’s successes in her professional and academic endeavors. Kelley holds a PhD in Information Security from Purdue University specializing in the information security of organizations working with victims of violence, a MA in Business Administration, and BS in Marketing.

Sam Mohammad

Sam is a Threat Detection Engineer, Proactive Defense Consultant at Malcrove EMEA LLC based in the UAE, and an Outreachy alum with OISF.

With a background in capabilities engineering, Sam works across threat research, threat hunting, and detection engineering, translating offensive tradecraft into deployable behavioral detections across SIEM, EDR, and network detection environments. Sam’s current research focuses on Iranian APT tradecraft and intelligence-led detection for government and industrial sectors.

Kseniia Naumova

Kseniia is a Senior Malware Analyst at Positive Technologies, where she focuses on malware research, network-based threat detection, and improving network traffic analysis techniques and tooling. Her work is centered around identifying malicious behavior in network traffic and developing new approaches for detecting emerging threats.

She holds both bachelor’s and master’s degrees in cybersecurity. Earlier in her career, Kseniia actively participated in CTF competitions, helped organize cybersecurity events for students, and taught in educational programs. Today, she regularly presents her research at international cybersecurity conferences, including Botconf and AVAR. She also shares network threat research, and interesting C2 communication findings on X (@naumovax).

Filipi Pires

Filipi has been working as Head of Technical Advocacy at SCYTHE, Founder & Investor at CROSS-INTEL, BSides Porto Organizer, Red Team Village Director (DEF CON), Senior Advisor Raices Cyber Academy, Founder of Red Team Community (Brazil and LATAM) and AWS Community Builder. He is an international speaker at security and new technologies events in many countries, such as US (Black Hat & Defcon), Canada, France, Spain, Germany, Poland, Black Hat MEA (Middle-East), and others. He has served as a University Professor in Master Degree in Portugal, Graduation, and MBA courses at Brazilian colleges and authored a book, TPRM driven Supply Chain Cybersecurity: Connecting TPRM and supply chain security for operational resilience, by Packt.

Juliana Fajardini Reichow

Juliana is one of the developers with the Suricata team. She joined as an Outreachy intern in 2020, and is officially with OISF since 2021. She’s on a constant journey to learn and improve, and tries to share her findings along the way.

Vikrham Saurabh

Vikram is an experienced engineering leader with 20 years of experience in software engineering, primarily in building firewall products and services. He currently leads the AWS Network Firewall engineering team and has previously led the engineering team of Route53 DNS Firewall. Outside of work, Vikram enjoys playing cricket, hiking, and solving math puzzles.

Samaresh Kumar Singh

Samaresh is a Principal Engineer at HP Inc. with more than 21 years of experience designing and implementing large-scale distributed systems, cloud-native platform architectures, and secure Edge AI / ML systems. His expertise spans agentic AI systems, GenAI / LLMs, Edge AI, federated and privacy-preserving learning, and secure hybrid cloud-edge computing.

In addition to building intelligent systems, Samaresh specializes in cybersecurity, Zero Trust architectures, and AI governance frameworks for production environments. He has led initiatives focused on securing AI pipelines across the full lifecycle from data ingestion and model training to deployment, monitoring, and continuous validation. His work integrates secure MLOps practices, model risk management, AI supply chain security, identity-centric access control, and runtime protection for distributed AI systems operating at the edge.

Throughout his career, he has architected high-throughput, low-latency services, and resilient orchestration frameworks that deliver intelligence closer to devices and data sources while maintaining strong security, compliance, and governance controls.

Ted Skinner

Ted is a cybersecurity engineer specializing in Splunk Enterprise Security, detection engineering, and large-scale lab environments for simulating real-world attack scenarios. He designs and builds hands-on security labs that integrate tools such as Zeek, Suricata, Sysmon, and Cisco infrastructure to generate realistic telemetry for SOC operations and threat detection.

His recent work focuses on combining security telemetry with AI-driven workflows, including building MCP-based platforms that enable automated investigation and pivoting across network and endpoint data in Splunk.

Ted is actively preparing content for industry conferences and develops practical, reproducible lab environments to help engineers improve detection coverage, investigation workflows, and SOC efficiency.

Soner Tari

Soner is a dedicated Open-Source Software Developer on Cybersecurity. He specializes in deep inspection of encrypted traffic, having created and evolved FOSS tools like SSLproxy and UTMFW. His current work focuses on bridging the gap between pervasive encryption and real-time threat prevention for IDS/IPS. Explore his projects on https://github.com/sonertari.

Koen Teuwen

Koen is a researcher in the Security research group at Eindhoven University of Technology (TU/e), where his work focuses on the intersection of automation, intrusion detection, and incident response. His research examines the network intrusion detection problem space to better understand the limitations of current intrusion detection systems such as Suricata, with particular attention to data quality for automation, detection rule design, and operational practices in Security Operations Centers. Methodologically, his work combines empirical analyses of real world SOC data, qualitative studies with practitioners, and controlled experimental designs. By grounding his research in operational realities, he aims to derive academic insights that translate into practical methods and tools to improve detection effectiveness and reduce analyst workload in SOCs.

Corey Thomas

Corey’s role in OISF is as Suricata QA lab engineer, and he has been with OISF for over 5 years. Before that he was on the cyber defense engineering team at GM deploying and maintaining Suricata across many global environments. He loves to automate, making things consistent and predictable. He automated the Suricata PRs to be picked up and tested against in the QA lab, created tests, added hardware, made CI/CD dynamic yet serial for hardware constraints and deterministic testing, and generally maintains the QA lab keeping up to date with OS, library, rust and rule changes.

Erik Vanderhasselt

Erik is a cybersecurity consultant with a background in SOC operations based in Belgium where he worked as an incident response analyst and detection engineer. His experience includes threat detection, response, and engineering detection rules to identify and mitigate threats. Erik has contributed to the cybersecurity community by speaking at events like Software Freedom Day at the Brussels Hackerspace. He is the creator of Suritwist, a Python tool that combines Suricata and dnstwist to enhance potential phishing domain detection.

Chris Wakelin

Chris has been part of the Threat Research team at Proofpoint for the last 11 years, primarily working on detection and configuration extraction of malware. Prior to that, after finishing his PhD in Maths, he was a systems administrator for over 20 years at the University of Reading, UK where, amongst other things, he ran early versions of Suricata monitoring the University’s networks and also ran the mail transport system including malware and spam filtering.