Secure Ideas

10/13/2026

🚨 WELL, TIMMY'S GONE AND DONE IT AGAIN! LEAKED ANOTHER KEYNOTE. 🌪️😂

KEVIN (JOHNSON) TACKETT!

Founder & CEO of Secure Ideas, Hacker and InfoSec Guru who's taken the stage at DEF CON, Black Hat and RSA (to name a few). Kevin is headed to the Emerald Stage!

Two keynotes. Zero secrets left. 👀

Good thing this "isn't" a security conference! 😉😂

Timmy's on administrative leave, BTW.

📅 May 17, 2027 | Overland Park, KS



Secure Ideas

10/12/2026

Last year, someone in Zach's family got phished.

A fake Microsoft warning. A phone number to call. Remote access software installed before they realized what was happening. It wasn't until they saw their mouse cursor moving on its own that they knew something was wrong.

For Cybersecurity Awareness Month, Zach wrote about the patterns behind phishing. Not just email, but texts, phone calls, pop-ups, and QR codes. And what to actually do when something doesn't feel right.

No jargon. No scare tactics. Just practical advice anyone can share.

🔗 https://hubs.la/Q04zYBzw0

Learn how to spot phishing scams and protect yourself from online tricks. Discover essential tips to recognize suspicious messages and stay safe online.

10/08/2026

InfoSec World is next week, and Kevin Tackett is speaking. Then he's speaking again. Then a third time. We can't believe it either.

THE KEVIN TACKETT TRILOGY

🎬 Part I: Ship of Theseus as a Service: Security Testing When Nothing Is Truly Yours
Mon, Oct 12 | 2:05 pm | Suwanee 1-2
If every plank has been replaced, is it still your ship? Kevin on finding risk in apps built from parts you didn't write.
🎬 Part II: Raiders of the Lost Architecture: Security Testing in Modern Applications
Tue, Oct 13 | 11:00 am | Suwanee 1-2
Forgotten APIs, outdated integrations, and AI bolted onto legacy systems. Bring a hat.
🎬 Part III: Garbage In, Garbage Owned: Offensive Testing Strategies for AI Systems
Tue, Oct 13 | 1:45 pm | Lafayette 5
Real pentest stories on how AI systems get compromised, from prompt injection to API abuse.

And if you've had your fill of Kevin by then (we won't take it personally), Jeff Man, Executive Director of PCI, has the bonus feature:

🎬 Back to the Future-Proof: Preparing Now for Quantum Decryption Threats
Tue, Oct 13 | 3:45 pm | Lafayette 3-4
A realistic post-quantum roadmap for getting ahead of the problem. No DeLorean required.

Come say hi to the Professionally Evil team in Orlando. We promise there are other people on staff.

10/05/2026

Larry Pesce, our new Executive Director of Research, is heading to Toronto this week for SecTor 2026, and he's got two sessions on the schedule.

First up, he's back on the Fail Panel, SecTor's longest-running panel, alongside Jamie Arlen and Allan Stojanovic, for a candid look at the security industry's collective failures (and what we can actually learn from them). Wednesday, October 7, 2:25pm in Room 718AB. In-person only, so if you want this one, you need to be in the room.

Then on Thursday, October 8 at 3:20pm in Room 801B, Larry's delivering a solo briefing: "Teach the Thing You Just Learned: A Case for Reckless Generosity in Security." It's a challenge to the industry's gatekeeping instincts and a case for sharing what you know before you feel ready.

If you're at SecTor this week, go say hi and catch both talks.

10/05/2026

Please join us in proudly welcoming Larry Pesce to Secure Ideas as our Executive Director of Research!

Larry's taking on something we've wanted to do for a while: standing up an actual research lab here at Secure Ideas. If you know Larry, you know this is going to be fun to watch.

Welcome to the team, Larry.

09/30/2026

GrrCon recap, mustard stain and all.

David hit the floor of a hall packed with hackers, deep in the heart of GrrCon's chaos. We also ran into Jeff Man, the "world's greatest living hacker", a title we're choosing not to fact-check.

Our booth didn't survive the weekend. Stickers gone, merch wiped out, down to just our tabelcloth. We're heading home with an empty suitcase and a full camera roll. Evenings wound down at CigarCon with friends, because even hackers need a break from the badges.

Two days, one hangover, zero regrets.

09/29/2026

We're headed to Davenport, IA for CornCon 12: The 12 Chaos Monkeys of Cyber, October 1-3, 2026.

Two Secure Ideas talks on the schedule:

Kevin Tackett opens the CISO Summit on October 1 (9:15-10:00 AM) with "Ship of Theseus as a Service: Security Testing When Nothing Is Truly Yours."

Jeff Man takes the stage October 3 (9:15-10:00 AM) with "Compliance Equals Security."

If you're at CornCon, come find us. Details and full schedule: https://hubs.la/Q04yzwPD0

09/22/2026

Grand Rapids!

Secure Ideas will be at Booth 24 this week at GrrCON. If you're attending this year, make sure to stop by to talk pentesting, grab some swag, and say hey to the Professionally Evil crew.

See you there!

09/12/2026

🏆 Congratulations to Zach Tackett, our 2026 Blog Champion! 🏆

At our all hands meeting this month, Zach took home a very real, very heavy championship belt for topping our blog leaderboard all year.

Throughout the year, Zach's "Paths to Power in Active Directory" series (https://hubs.la/Q04xjKTG0) became a fan favorite among readers, breaking down real world attack paths with the kind of clarity that keeps people coming back for the next installment.

He also stepped outside the AD series to share "Building a Dedicated Web App & API Pentesting Lab" (https://hubs.la/Q04xjKXn0), proving his range goes well beyond one topic.

This kind of consistent, high quality content is exactly what makes our blog a resource people actually want to read. Congrats, Zach. Defend that belt.

09/10/2026

What if an attacker doesn't need a phishing link or malware, just a PDF?

At InfoSec Nashville 2026, our own Jordan Bonagura is presenting "Weaponizing PDF JavaScript for Browser-Based Attacks," a technique that uses embedded PDF forms to harvest credentials inside trusted browsers like Chrome and Edge. By mimicking common workflows and using native PDF features, attackers create seamless, legitimate-looking interactions that slip past traditional phishing defenses by exploiting what users trust most: their own applications.

Catch Jordan's talk Friday, September 18 in Room 209A.

Register now: https://hubs.la/Q04x7Dd90