CV

“I help organizations understand attackers and defend against them efficiently, with state-of-the-art training, talks and articles.”

since 2025
Corporate Trust, Munich: Principal Consultant Cybersecurity and Head of CORE (Cyber Operations and Research)
2017⁠–⁠2024
Oneconsult Deutschland, Munich: senior penetration tester and security consultant, Chief Technical Officer from 2020 to 2021, Head of Research from 2022
before that
Software vendor in Berlin: head of corporate communications and documentation, later responsible for user systems and IT security
education
Master’s degree in Security Management, Brandenburg University of Applied Sciences (part-time); Diplom (German degree, master’s level) in Technical Writing, Karlsruhe University of Applied Sciences

Frank Ully is Principal Consultant Cybersecurity and head of the CORE unit (Cyber Operations and Research) at Corporate Trust in Munich. He has worked in information security for more than ten years, most recently with a focus on developments in offensive IT security. His main subjects are on-premises Active Directory, the security of public clouds and AI: its abuse by attackers, its safe use and its value in defense.

He shares what he knows in talks, webinars, training courses and articles, for example in the German IT magazine iX and at heise academy. In this way he helps organizations understand attackers and defend against them efficiently.

He speaks in German or English. The contact page explains how to request a talk, an interview or a workshop.

Articles (selection)

iX 10/2026
OpenAI-Agenten greifen Hugging Face an Published early on heise+ on 2026-⁠09-⁠03 as “Alarmstufe Rot: Security-Analyse zum Angriff von OpenAI-Agenten auf Hugging Face”
Cover story · AI and security
iX 11/2025
Identität ist der neue Perimeter: IAM bei AWS
Amazon Web Services series, part 2/3 · Cover story · Cloud
iX 5/2025
Living off the Land: Cyberangriffe ohne Malware Angriffe ohne Malware – Living off the Land (LOTL) und RMM Abuse
iX 11/2023
OSINT: Sammeln öffentlich verfügbarer Information
Sich selbst hacken series, part 4/5 · Pentesting and methodology
iX 6/2023
Gefühlt sicher: Sicherheitsmythen und -irrtümer
Sicherheitsmythen series, part 1/2 · Cover story · Pentesting and methodology
iX 4/2022
Angriffe auf das Azure Active Directory und auf Azure-Dienste
Azure Active Directory (heute Entra ID) series, part 2/3 · Cover story · Cloud · Microsoft 365
iX 11/2020
Passwörter und Hashes: Wie Angreifer die Domäne kompromittieren
Active Directory series, part 4/11 · Active Directory · Windows
All 40 articles since 2018