Dead Internet Theory: Fiction, or Future?

AI is here, and it's here to stay. So how do we avoid the fabled Dead Internet, where most content is generated by AI and consumed by AI, cutting the human element out of the system altogether?

This talk goes into the sociology of the internet, the effects of social media on media manipulation, looks into the possibility of auto-generated content, and talks about using solid DevOps tooling to generate a set of guardrails for keeping AI on the path we want.

Delivered:
@ EuroSTAR 2025 in Edinburgh
@ TestNet 2025 in Utrecht
@ Øredev 2025 in Malmö

So Your Attack Surface Just Left the Planet…

As New Space races to catch up with Government Funded Old Space programs, something fascinating has happened: Satellites are no longer exotic. They're servers travelling at 7.8 kilometers per second, quietly underpinning global infrastructure.

This talk explores how space changes cybersecurity; technically, operationally, and, eventually, philosophically. Because the deeper we go, the more we realize that even at 550 kilometers up, the fundamentals of trust, risk, and human error remain stubbornly familiar.

We’ll unpack:

- Why the orbital layer breaks traditional assumptions about perimeter and trust.
- How over-the-air patching, supply chain risks, and autonomy redefine security operations in space systems.
- What STRIDE looks like when you add orbital physics, solar radiation and vacuum latency.
- And how to build resilient architectures when failure means more than downtime; it means debris.

The Great Vibe Coder (Has Better Things To Do)

As we reach a point where the only requirement to create code is the ability to explain what you want, we'll take a look at what it takes to be a high-quality vibe coder from the perspective of a security professional. On this journey, we'll see that the prerequisites for high-quality vibe coding will turn you into something else entirely.

One way or another, Vibe Coding is going to take the world. We're the ones who get to decide whether it is by storm, or as a hostage.

No requirements. Length of 30-45 minutes, ideal for keynotes or track talks. Goes into DevOps aspects, security considerations, looks at case studies.

Not yet delivered. So feel free to be the first :)

What Minesweeper Can Teach Us About Security

Yes. Minesweeper. That game installed on all Windows machines before Windows got boring. You'd be surprised, but it allows us to conceptualize a lot of security principles and (bad) practices.

This session will show you how to look at security from the side of the attacker, and learn that showing our hand too early (or at all) can be a massive detriment. We'll also explore the ideas of entrapment in security, looking at honeypots and how large of an advantage you can gain from breaking these bad habits.

Delivered:
@ Øredev 2025 in Malmö

Let's Stop Pretending that CVSS is Useful

Let's be fair, CVSS scores aren't helpful. They're lightning strike metrics. They tell you how bad it is if you're struck by lightning (as well as allow for alarmist security journalism) but they don't cover impact on the internet at large.

NIS2 is here, and is making some very specific demands. Those countries that don't have one yet need to set up a National Cybersecurity Center, and those that do need to engage in a higher level of cooperation than ever before.

Delivered:
@ Disarray 2025 in Turku/Stockholm

How to Vibe Code (safely)

A security professional will take you on a brief but enlightening journey on exactly what you need to do, today, to start safely vibe coding.

This is not a real talk. This is a troll talk. This talk has an introduction, followed by 2 slides.

The first says:
"What should I do to start vibe coding?"
The second says:
"Don't."

I will not elaborate. I will answer no questions. I will then leave the stage.

Please understand this if, for some god-forsaken reason, you actually want me to do this.