Topics

Attacks against on-⁠premises Active Directory and how to secure it. In 2020 and 2021 I wrote eight parts of my iX article series on the subject. Since late 2021 I have been teaching the workshop “Angriffsziel lokales Active Directory,” and since 2026 also one on pentesting with NetExec. More recent webinars deal with Net-⁠NTLM, tiering and securing authentication.

Attacks with AI and on AI. Language models and agents help attackers with vulnerability research and, by now, with the attack itself. Organizations that use them have to secure them in turn. I cover both sides in my five-part webinar series “KI in der Cybersecurity” at heise academy. On the attack by OpenAI agents on Hugging Face I have written an iX article and given a talk. The chronology of AI attacks lists publicly reported cases in which AI played a part.

Attacks on Azure, Entra ID and AWS and how to secure these environments. Azure came first, in 2022: I wrote a series of articles for iX and taught workshops on it until 2024; back then Entra ID was still called Azure Active Directory. AWS followed in 2024, with a workshop of its own and, in 2025, three iX articles.

Luring attackers into a trap with honeypots, canarytokens and other lures. Nobody touches these lures in normal operation, so an alert almost always points to an intruder. In 2021 my article on the subject concluded the Active Directory series in iX, and in 2025 I followed up with a piece in the iX special issue on security tools. Since late 2025 I have been teaching the workshop “Cyber Deception,” and in 2026 I gave talks at secIT in Hanover and on the heise security Tour.

Configuring Microsoft 365 and Entra ID securely, protecting them with Defender and reading the cloud logs after an incident to see what happened. That is the subject of the five-part webinar series “M365 Security” at heise academy; I teach four parts, and a second speaker teaches the one on Conditional Access. My older pieces date from the time when Entra ID was still called Azure Active Directory.

Approaches that are not tied to any one system. The focus is on attacking your own environment with free tools before someone else does. I show how in talks, workshops and two webinar series on ethical hacking for admins. I also write and speak about OSINT, malware and living off the land. In 2023 I took on the security myths that many organizations fall for, in two iX articles and several talks.

Attacks on web applications and APIs along the OWASP Top 10 and the OWASP API Security Top 10, and what developers can do about them. From 2019 to 2024 I gave talks on this, most of them at developer conferences. In 2022 I wrote two iX articles on API security.

In Windows networks, attackers get a long way with what the system already ships with, PowerShell above all. In 2018 I wrote a six-⁠part blog series about it, from the basics to defense. In more recent pieces I show how administrators harden clients, servers and authentication, for example with tiering and Privileged Access Workstations.