George Coldham
Cloud Solution Architect at Microsoft | Global Security Community Founder | Securing AI & AI for Security
Perth, Australia
Actions
George Coldham is a Cloud Solution Architect at Microsoft, helping enterprise and public-sector organisations tackle identity, cloud security, and the growing challenges of securing AI. His work spans Zero Trust, securing agentic systems, and using AI to improve security operations—with a focus on reducing risk without making life unnecessarily difficult for the humans involved.
An international speaker, educator, and community organiser, George turns complex security concepts into practical stories, demonstrations, and guidance. His talks explore everything from why passkeys finally make sense to what happens when AI agents gain the ability to act, and who remains accountable when they do.
George is the founder of Global Security Community and lead organiser of the Perth Microsoft Security Meetup. He brings a practitioner’s perspective, a willingness to question assumptions, and occasional hardware experiments that demonstrate why “it works” and “it’s trustworthy” are different conclusions.
Area of Expertise
Topics
Developers, the new targets in the cyber battleground.
Developers are the driving force behind value creation in today's digital age. They have the superpower to turn code into revenue-generating products that can scale to unicorn proportions. However, with great power comes great responsibility. Developers are granted extensive permissions to do their work, but these same permissions can also pose a security risk if they fall into the wrong hands. That's why it's crucial to implement security measures that protect your organization without hindering your developers' productivity.
Join us for a talk on practical tips for securing your developers. We'll discuss tools, techniques, and procedures for securing both human and automated workflows. You'll learn how to:
* Identify and mitigate common security risks in the developer environment
* Implement security controls that balance protection and productivity
* Empower developers to work securely and efficiently
Don't let security be an afterthought. Join us and learn how to build a culture of security that starts with the developer.
From Tech Confidence to Cyber Victim: The Irony of Pig Butchering Scams
"From Tech Confidence to Cyber Victim" offers a compelling look into the world of 'pig butchering' scams, where the very strengths that define IT professionals can become their greatest vulnerabilities. This talk explores the ironic twist where high confidence in technological expertise leads even the most seasoned IT experts into the traps of sophisticated online fraud.
We'll examine how the unique skills and attributes of IT professionals—such as a deep understanding of complex systems, problem-solving abilities, and routine exposure to cyber risks—can paradoxically make them more susceptible to these emotionally driven scams. Delving into real-life examples, we illustrate how scammers artfully blend technical jargon with psychological manipulation, exploiting the blind spots created by tech confidence.
This session is designed to bridge the gap between technical know-how and the often-overlooked human element of cybersecurity. Attendees will learn about the subtle intricacies of 'pig butchering' scams, why their professional expertise might not be the complete armour they thought it was, and how to develop a more holistic approach to digital safety and scepticism.
Join us for an enlightening journey from the peaks of tech confidence to the unforeseen valleys of cyber victimhood and arm yourself with the knowledge to defend against the ironies of modern cyber threats.
From Prompt to Production: Who’s in Control?
Coding agents can turn an issue into a pull request: gathering context, editing files, running tests and calling external tools. Each capability makes them more useful. It also raises a question: whose authority are they exercising, and where does that authority stop?
An AI-native development practitioner and a security architect follow one coding task from specification to a tested, reviewable pull request. We explore how context engineering, clear specifications, tool integrations and an agent harness support effective development, then demonstrate how untrusted content can steer that same workflow beyond its intended scope.
We examine six control boundaries across local and cloud agents: execution, capabilities, identity, tools, context, and observability. We then follow the handoff from reviewed code to production, where permission to implement a change must remain separate from authority to release it. Along the way, we consider where human approval adds value, how controls can fail, and what risk remains.
You’ll leave with a practical approach to adopting coding agents: define the task, delegate the authority it needs, preserve engineering accountability, and verify the boundaries from the first prompt to the production release.
I Built a Tiny Passkey Authenticator, Then Had to Explain Why You Shouldn’t Trust It
Passkeys promise a cleaner future: no shared secrets, less phishing, and fewer humans being blamed for typing passwords into the wrong box. But what happens when you build the authenticator yourself?
In this session, we’ll take a cheap microcontroller, some open-source firmware, and turn it into a working FIDO2 authenticator capable of storing and using passkeys. Then, instead of congratulating ourselves, we’ll start asking uncomfortable questions.
What exactly are we trusting? What assurance do we have over the hardware and its supply chain? Where are credentials actually stored? If someone gets physical access to the device, can they dump its storage, recover private key material, modify the firmware, or clone a credential onto another device? And what changes when we start enabling hardware security controls such as secure boot, protected storage and debug restrictions?
Along the way, we’ll pull apart concepts such as user presence, credential protection, hardware-bound keys and device trust, using a real authenticator rather than an architecture diagram.
The result is less a guide to building your own security key and more a live risk assessment of one: a practical look at the gap between “it implements FIDO2” and “I trust it with my identity.”
The Human Factor, Evolving Responses to Insider Threats
Insider risk remains one of the most complex and underestimated threats facing modern organizations. This session explores how insider threats evolve over time, from overlooked vulnerabilities to sophisticated, automated responses.
Through anonymized real-world examples, we’ll trace the journey from reactive detection to proactive investigation and autonomous triage. Attendees will gain insight into how solution maturity transforms not just technical capabilities, but also team processes, cultural norms, and trust across the organization. Rather than focusing on tools, the talk emphasizes the human impact of insider risk management: how visibility changes behavior, how automation reduces burnout, and how adaptive security can empower rather than alienate.
Whether you're in security operations, governance, or leadership, this session offers a grounded, story-driven perspective on building resilient defences from the inside out.
What Happens After You Press Enter?
You submit a pull request. You ask a coding assistant to build a feature. An email lands in a shared mailbox. A service desk ticket is raised. An API receives a request. What happens next?
For decades, software followed workflows designed by people. Now, reasoning models can analyse objectives, plan, delegate to specialist agents, weigh approaches and adapt as they learn. Software may begin deciding what the workflow should be.
This session explores why agent teams are emerging and what this shift means for engineers building systems with dynamic execution. We’ll examine planning, delegation, identity, governance and trust, and why these challenges may matter as much as model capability.
This isn’t about replacing engineers. It’s about understanding a new execution model and our role when software helps decide how work gets done.
From prompt to protocol, securing AI agents and MCP
AI isn’t just about asking chatbots questions anymore, it’s about building agents that think, act, and share context automatically. Each evolution from basic LLM hacks like prompt injections and jailbreaks, to full-blown agent workflows open new doors for attackers.
In this session, I’ll take you on a journey through real-world examples of how these risks multiply, and then zero in on the Model Context Protocol’s own blind spots.
You’ll walk away confident with four straightforward mitigations, leaving you ready to implementing Monday morning to make your AI systems tougher.
Authentication for humans, why passkeys finally make sense.
Authentication continues to fail not because users ignore security advice, but because the systems we built require humans to manage reusable secrets under pressure. Despite decades of improvements such as password managers, complexity rules, and multi-factor authentication, phishing and credential theft remain the most common causes of account compromise.
This talk starts by examining why password-based authentication fails at a structural level. We will look at the assumptions passwords make about human behaviour, why those assumptions break down in real-world use, and why layered controls like MFA often add friction without eliminating core failure modes.
From there, we will introduce passkeys as a human-centred redesign of authentication rather than another security add-on. We will explain what passkeys are, how they work using public-key cryptography, and why removing shared secrets fundamentally changes the security model while improving usability at the same time.
Using two real-world examples, we will explore why passkeys succeed where passwords struggle. First, we will examine phishing attacks that bypass traditional MFA by exploiting user trust and show how passkeys remove the need for users to identify real login pages through cryptographic origin binding. Second, we will look at common consumer account breaches caused by password reuse across services, and how passkeys prevent cross-site compromise without increasing cognitive load.
Attendees will leave with a clear mental model of how passkeys work in practice, including the role of biometrics as a local unlock mechanism rather than an authentication secret. We will conclude with practical guidance on how individuals can start using passkeys today, and what developers need to consider when adding passkey support to their own applications using modern, open web standards.
From Demo to Trusted Agent
AI agents become much more interesting when they stop being chat windows and start using tools: reading files, writing drafts, calling APIs, creating issues, and shaping real workflows. At that point, they are no longer just prompts. They are software with permissions.
In this practical session, I’ll use a real CLI-based speaker agent as the example: an agent that helps take a conference talk from rough idea to draft submission material. We’ll start with the naive version that feels impressive in a demo, then progressively add the controls that make it more trustworthy: scoped tools, workspace boundaries, least privilege, approval gates, logging, diff review, and simple policy checks.
This is a builder-focused talk for people experimenting with agents, coding assistants, and autonomous workflows. The goal is not to cover every possible agent security problem. It is to show a small, repeatable pattern for moving from prototype to controlled automation without burying the whole thing under governance theatre.
Prompts Are Code Now. Where Is Your SDLC?
AI agents are no longer passive chat tools. They write code, run commands, open pull requests, and interact with real systems. And the thing that controls all of that behaviour? Prompts.
We tend to treat prompts like casual text. Something we tweak in a config file or paste into a UI. But when a prompt determines what files can be modified, what commands can run, or what data can be accessed, it becomes executable logic. In other words, it becomes code.
In this five-minute lightning talk, we’ll explore why prompts should be versioned, reviewed, tested, and governed like any other software artifact. We’ll look at common mistakes teams make when deploying AI agents, and outline a minimal, practical baseline for treating prompt design as part of your software development lifecycle.
If an agent can take action, then its instructions deserve engineering discipline.
The Harness is the Hero: Building Trustworthy Agentic Applications
Everyone is talking about AI agents, but most of the attention is still on the model.
We think they're looking in the wrong place.
The real engineering challenge isn't getting an AI to think. It's deciding what it can remember, what it can access, what it can do, and how you keep a human in control.
That's the harness, and it's where trustworthy agentic applications are built.
As AI systems evolve from simple assistants into autonomous, multi-agent applications, the complexity shifts from prompting to engineering. Memory, permissions, tool calling, workflows, approvals, provenance and observability become just as important as the intelligence of the model itself.
In this session, we'll explore the architectural patterns and practical engineering decisions behind building trustworthy agentic systems. We'll examine how specialist agents can collaborate, share context, delegate responsibilities and operate within clearly defined boundaries, without sacrificing security, transparency or human oversight.
Through practical scenarios, architectural examples and lessons from emerging agentic development patterns, we'll unpack what makes an effective harness, where things can go wrong, and how to design systems that remain understandable and governable as their autonomy increases.
Because the future of AI engineering isn't just about better models or cleverer prompts. It's about better harnesses.
You'll leave with practical patterns, design principles and a clearer understanding of how to build agentic applications that are useful, transparent, governable and worthy of your users' trust.
Zero Trust in a SaaS and AI World
Most modern security breaches no longer start on the network. They start in the browser. Engineers paste sensitive code into AI tools. Users approve malicious OAuth apps. Stolen SaaS session tokens bypass MFA and grant attackers' direct access to enterprise data. The common factor is not malware or lateral movement. It is trusted browser activity being abused.
This session explains why the browser has become the most important control point for Zero Trust in a SaaS and AI driven world. Using real security incidents, we break down how common compromises occur in the browser and map them to MITRE ATT&CK techniques that practitioners already use for detection and response.
You will learn practical ways to reduce SaaS and GenAI risk using in browser DLP, tenant restrictions, OAuth consent governance, and session level telemetry without destroying productivity. This talk focuses on how these controls actually work in practice, what they stop, and where they fail.
If you design, deploy, or operate Zero Trust controls, you will leave with a clear mental model for treating the browser as a first-class security boundary rather than a blind spot.
NDC Sydney 2026 Sessionize Event
AI Community Singapore Sessionize Event
Global Security BootCamp [Perth 2025] Sessionize Event
AgentCon 2025 - Perth Sessionize Event
Global AI Bootcamp Perth 2025 Sessionize Event
NDC Sydney 2024 Sessionize Event
NDC Security 2024 Sessionize Event
DDD Perth 2023 Sessionize Event
Copenhagen Developers Festival 2023 Sessionize Event
NDC London 2023 Sessionize Event
NDC Security 2023 Sessionize Event
DDD Perth 2022 Sessionize Event
George Coldham
Cloud Solution Architect at Microsoft | Global Security Community Founder | Securing AI & AI for Security
Perth, Australia
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top