
Executive Vice President and Head of DivisionHex at @Coalfire, hacker, media spokesperson, and speaker at @RSAConference, @BlackHatEvents, @defcon, & @SXSW.
Austin, Texas, USA
Joined May 2009
- Tweets2.2K
- Following782
- Followers2.5K
- Likes2.5K
Charles Henderson retweeted
That’s a wrap on Black Hat Asia 2026. We networked the network so hard and we secured all the security while AI-ing the AI. It was glorious. #BHAsia #blackhat @BlackHatEvents
Charles Henderson retweeted
After 13 incredible years at IBM, I’m stepping away to start building something new.
IBM has been a defining part of my life. I’m especially proud to have founded and grown the Adversary Simulation team and to have served as a Distinguished Engineer focused on AI and offensive security. What began as a small idea became one of the greatest red teams, pushing the boundaries of what real-world adversary simulation can look like - made possible by an exceptional group of people I learned from every day.
I’m deeply grateful to the X-Force leadership and to the teammates, mentors, researchers, and operators who made the journey what it was. The team is in great hands and will continue to do important, impactful work.
Looking ahead, I’m excited to focus on building what’s next - continuing to raise the bar for offensive cyber and exploring how AI can enable high sophistication offensive cyber operations and capabilities at a speed, scale, and intensity never before seen. It’s still early, but I’m looking forward to sharing more soon.
I truly appreciate everyone who’s been part of the journey.
I had the opportunity to share my thoughts on the New York cybersecurity defense tax in @SCMagazine. It is a short read but it is something I feel strongly about given the security posture and readiness of critical infrastructure in New York that it impacts: scworld.com/perspective/new-…
When governments ask tech companies to unlock the digital world, we all lose. I spoke about this on a SXSW keynote panel years ago in 2016: schedule.sxsw.com/2016/event…
The U.K. government's secret order for Apple to build a back door into iCloud is a HORRIBLE idea for many reasons.
Let's start with the basics. A back door == a vulnerability.
Any back door, no matter how secure it seems, is a vulnerability waiting to be exploited.
According to the EFF ( eff.org/deeplinks/2024/10/sa… ) Salt Typhoon orchestrated one of the largest telco breaches via a mandated back door just last year.
Even if it’s for government access, it’s only a matter of time before cybercriminals and even other governments take advantage of it.
But it’s not just about security risks. If Apple goes through with this order, the consequences could ripple globally.
Weakening encryption in one country sets a dangerous precedent for others to follow, opening even more doors for attackers to target millions of users worldwide.
As cyberattacks continue to grow in scale and sophistication, we need stronger encryption, not weaker. There is no such thing as a back door that only the "good guys" can access.
Charles Henderson retweeted
I’m hiring a Director of Threat Hunting to help us build and manage a client facing hunt program at Coalfire. If you are the person I should hire, or know someone I should, hit the link below.
jobs.lever.co/coalfire/904a4…
This is a quick reminder that the @BlackHatEvents Call for Papers opens tomorrow, February 5th! I know that every year folks ask for advice on their submission. I would encourage anyone looking for advice to read this blog post filled with guidance:
blackhat.com/html/blog/2025-…
While everyone is rushing to deploy AI, let's be clear: IP theft happens. Regularly. It's going to accelerate with new technology rollouts. IP is a huge part of many economies; secure it, or it will be stolen and used against you.
Google's recent run in with ad impersonation highlights two things:
First, crimes and scams like this continue to get more sophisticated and difficult to guard against. Attackers are now using Google's own tools to create fake ads that are difficult to differentiate.
Second, it points to just how creative motivated criminals can be. While Google has been proactive developing and deploying countermeasures quickly, the scale of these attacks is interesting to me.
Trump's exec order on international cartels is a start, but we need more.
What about cybercriminals attacking hospitals or phishing employees? It's time for tougher measures - sanctions & indictments for nations enabling cyberterrorism.
Putting this out there to support @Grifter801
It’s my mom. I don’t talk about my personal life on here a lot, ok…ever, but in this case it’s my mom. She’s been battling breast cancer, isn’t able to work, and we’re trying to get her some help. Thanks to anyone who can donate, we really appreciate it.
gofundme.com/f/kexk7q-help-s…
Charles Henderson retweeted
.@DisrupTVShow interviewed @ron_miller, Enterprise Reporter @TechCrunch, @angus_tx, EVP of Cyber Security Services @coalfire, and @cristina_alaimo & @JannisKallinik1, Co-authors of Data Rules zurl.co/NYrw @rwang0 @lizkmiller #DisrupTV
Charles Henderson retweeted
#defcon32 is better with tacos and Beer 3900 Paradise Road, Vegas :) tacosandbeerlv.com/
Charles Henderson retweeted
I'm putting out a new newsletter for anyone who wants to get regular updates of interesting things in the news. Check it out here: rsnakereport.rsnake.com/p/rs…
Charles Henderson retweeted
Next week I’ll be at @BlackHatEvents & @defcon !
August 6th
- speaking on IoT/OT security platforms & a debate panel
- judging the Startup Spotlight Competition at the Innovators and Investors Summit
August 8th
- chairing the first ICS Micro Summit
Hope to see you there! 🙌🏼
Charles Henderson retweeted
The cascading outage from #CrowdStrike's content update creates a heightened state of vigilance for affected organizations. Some thoughts from @angus_tx on potential #phishing and typosquatting attacks to follow and enabling #security readiness: ow.ly/BGrN50SGgNk
Charles Henderson retweeted
Today marks a year since your passing. To dwell on the difficult times when remembering and honoring you is simply not befitting.
To know Kevin as I did was a privilege. A relationship like none other.
Globally, Kevin’s story and body of work inspired many individuals to pursue a career in cybersecurity when the industry was in its infancy. For people entering the world of cybersecurity today, his work continues to draw people in. His stories are readily available in books, movies, recorded demos, and speeches.
Yes, he was a public figure in cybersecurity and to the tech community and beyond, but to know him personally was different from the public persona people knew him as.
Over the past 12 months, I have reflected on and mourned the gravity of the loss. Not many truly knew the real Kevin. As his wife and mother to our dear son Morty Mitnick, I cherish all my memories.
I’ve laughed many times when I’ve shared stories with loved ones. Kevin was an anomaly in many senses. He enjoyed his privacy yet was a public speaker and thrived in social settings—his love of magic, performing on stage and behind the camera, was oh so evident. He loved traveling around the world and hanging out with his friends, yet he had a huge fear of flying.
Kevin was known for many titles over his lifetime. Those titles meant little to him. What mattered were the people in his life. He cared.
He cared about the people who stood by him during his difficult upbringing and childhood years, his trials and tribulations, and those who were close to him after his ‘vacation’ (a term he coined and laughed wholeheartedly at).
Kevin worked restlessly to rehabilitate his reputation. His desire to educate and help protect the everyday person on the street to global organizations was admirable. Sprinkling in levity, sharing his favorite hacks over the years and teachings from his pentesting engagements delighted many.
Kevin mastered the art of storytelling. He captivated and drew people in a way that so few people can do. It is no wonder why he excelled and was legendary in his social engineering skills. The ability to break down complex concepts in cyber for the everyday person to understand and for them to care is never to be underestimated.
It shocked countless people that he continued to hack and keynote till the very end. On calls with clients, I shared that Kevin would be joining in on the red team engagements (his favorite kind). Not just leading the team in devising ways to get in but also participating in the engagements - getting in and exfiltrating their assets that were agreed flags. He loved seeing the evolution of security products and services being implemented and still finding a way to bypass their security controls. More importantly, he took pride in writing the deliverable and handing over the report – the sheer number of hours he poured into writing reports was commendable. Raising the bar and improving the security posture for our clients was deeply important to him.
Today is a day I celebrate the Kevin I knew. He was an undeniably loyal, adventurous man with an insatiable ability to continually evolve and learn. He was detail-oriented and a larger-than-life figure who always found ways to laugh despite any obstacle in his way. Your one-of-a-kind laugh will forever be in my heart and mind.
I will carry on the Mitnick legacy, but more importantly, I aim to raise Morty with love. Seeing Morty's smile is the greatest gift of all.
I have several logistical questions but I am still processing cnn.com/2024/07/10/travel/sn…
Athens, I wish I could have stayed longer. Thanks so much to @XOffensive21584 for having me. I encourage everyone to take a trip next summer to the coolest conference in Greece!


















