Secure Ideas is a security consulting firm focused on helping clients have the best penetration testing and training experience.

Jacksonville FL
Joined March 2008
So according to the @battlenet website, I own Diablo II Resurrected (correct), but the desktop app is asking me to purchase it again. The support site has no way I can find to actually fix this. Just a chat that is automated and presents irrelevant answers.
1
2
543
I have been discussing speaking slots at local org meetings such as OWASP, ISSA, ISACA, and the like. As far as I know, all of these orgs have policies that forbid sales pitches as presentations. Yet I constantly see them. 1/2
3
2
748
How do we help these local orgs get real useful presentations? I currently go to as many as I can and offer to speak. But that doesn't scale, and many think I am going to pitch my company. (Ignoring my public history) Thoughts? 2/2
1
129
Kevin "Johnson" Tackett retweeted
As hot AI lab breakout summer comes to a close, I wrote up a couple of thoughts on the OpenAI presentation at Black Hat USA, felony humble-bragging, and low-hanging fruit. perilous.tech/felony-humble-…
1
1
5
452
User awareness focuses on the wrong thing. We don't need to make users more aware; we need developers and businesses to pay attention to how they increase risk and implement useless controls. Our systems are designed to make it harder to be aware. 1/3
2
2
2
511
We have built systems specifically to require clicking a link in an email and then complain when users click links. 2/3
1
202
I literally just paid for a subscription where my 16 digit CC# was masked while I entered it, but the CVV was not. The system also blocked ctrl-v so password managers are blocked. Make it make sense please. 3/3
114
Kevin "Johnson" Tackett retweeted
'The Value of Cybersecurity Operations' (shop.montance.com) Tactical guidance and metrics needed to bridge the gap between management and cyber ops.
1
1
350
Kevin "Johnson" Tackett retweeted
Current price break ends Friday! See you in Vegas for Agentic AI-aided Kubernetes Attack and Defense! @BlackHatEvents
Come join my updated Black Hat class in Las Vegas, "Agentic AI-Aided Kubernetes Attack and Defense!" Kubernetes and AI are more tightly-coupled than you think - about two thirds of organizations hosting generative AI models use Kubernetes to manage inference workloads (CNCF). And Kubernetes is growing in popularity for hosting streamable MCP servers and remote agents. We're going to have a blast with new cutting-edge exercises that integrate AI agents into attacking and defending Linux, containers, and Kubernetes. We'll also be attacking a multi-user agentic AI system running on Kubernetes, using both direct and indirect prompt injections, gaining access to the cluster, and adding indirect prompt injection backdoors to the vector database. As in all the other exercises, we'll turn around and harden the system against this. You can learn more and register here: blackhat.com/us-26/training/… Here's an excerpt of the class description: Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers, from Jay Beale, who has led development of the Kubernetes CTF at DEF CON and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters. This well-reviewed training focuses on giving you practical attack skills from real penetration tests, coupled with solid defenses to break attacks. You'll create an agentic AI platform with skills and tools that allow your agents to enumerate a cluster, analyze configuration weaknesses, and recommend attack paths. Every topic in the class has an attack exercise, where you will first compromise a Kubernetes cluster or application. Most have a matching defense exercise, where you will use new skills to break that attack, confident that it will break others.
1
1
4
445
Since I can't get my account manager or anyone useful in support to call me, maybe this will work. @justworks
343
Jay is one of the best people and instructors I know. If you haven't taken a class from him, you are missing out. You will learn more than you imagine. He makes people be better.
Time to level up your K8s security. I won't oversell the class - I'll just let 4 people I respect tell you what they got out of it. Hack some #Kubernetes with me this August at @BlackHatEvents in Las Vegas! Agentic AI-Aided Kubernetes Attack and Defense tinyurl.com/bhus26-kube-agen…
1
3
346
I saw a meme I can't forget. 5 IS absolutely the most even odd number.
121
Jay is one of the great ones. If you can attend one class this year, attend this one.
Come join my updated Black Hat class in Las Vegas, "Agentic AI-Aided Kubernetes Attack and Defense!" Kubernetes and AI are more tightly-coupled than you think - about two thirds of organizations hosting generative AI models use Kubernetes to manage inference workloads (CNCF). And Kubernetes is growing in popularity for hosting streamable MCP servers and remote agents. We're going to have a blast with new cutting-edge exercises that integrate AI agents into attacking and defending Linux, containers, and Kubernetes. We'll also be attacking a multi-user agentic AI system running on Kubernetes, using both direct and indirect prompt injections, gaining access to the cluster, and adding indirect prompt injection backdoors to the vector database. As in all the other exercises, we'll turn around and harden the system against this. You can learn more and register here: blackhat.com/us-26/training/… Here's an excerpt of the class description: Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers, from Jay Beale, who has led development of the Kubernetes CTF at DEF CON and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters. This well-reviewed training focuses on giving you practical attack skills from real penetration tests, coupled with solid defenses to break attacks. You'll create an agentic AI platform with skills and tools that allow your agents to enumerate a cluster, analyze configuration weaknesses, and recommend attack paths. Every topic in the class has an attack exercise, where you will first compromise a Kubernetes cluster or application. Most have a matching defense exercise, where you will use new skills to break that attack, confident that it will break others.
1
1
229
Kevin "Johnson" Tackett retweeted
New Layer 8 Podcast with Jennifer Shannon and Kevin Tackett of @secureideas. Fun chat about social engineering and covert entry. What do you do when you lose your coat during an engagement? open.spotify.com/episode/16g…
2
1
268
Kevin "Johnson" Tackett retweeted
I like to keep this screenshots around from a friends onboarding deck 10+ years ago.
5
11
52
4,466
Excited to announce that I married a wonderful woman last week. I have chosen to take her name, and so I am now Kevin Tackett.
3
1
1
13
1,200
Kevin "Johnson" Tackett retweeted
Current status: There's a conflict between Google cybersecurity researchers and the @ffmpeg project that doesn't have the resources to fix the vulns Google finds. So I'm busy trying to understand the bug to figure out how to patch it. Google provided enough information to easily reproduce the bug, so I simply compile everything, then watch it crash in the debugger, then step through the code before it gets to that point to see what went wrong. I've spent about 5 hours so far on this, mostly getting everything built properly on macOS, which is my preferred environment for debugging. I should be learning how to use VSCode on the Linux desktop as my source-level debugger. Fuck using raw gdb without a GUI frontend -- my philosophy for (checks notes) over 30 years.
47
53
9
1,357
261,709
Some days I wonder why we all can't see the other side of the debate. The FFMPEG vs Google is interesting in lots of ways. But the one I am most interested in is how the sides "debate".
1
336
We all want to prove our point and lose sight of the importance of what we are doing. We need to do better.
1
1
188
Of course, I know I am guilty of the same at times. And I look forward to the ways I am misunderstood in this post. :)
2
1
176