Simardeep Singh
Independent Researcher
N/A
Simardeep Singh is a cybersecurity professional with over three years of experience leading network automation for a global cruise line, where he developed tools, dashboards, and APIs. His work frequently uncovered security weaknesses across production infrastructure, including misconfigurations, and architectural gaps, leading him to integrate security validation into every automation initiative. He is currently completing an MSc in Cyber Security Engineering at the University of Warwick, with a focus on penetration testing, and security tooling. An eWPTX, PNPT, and CySA+ certified practitioner, he has presented at Black Hat MEA, Black Hat SecTor, BSides Kent, BSides Birmingham, and Warsaw IT Days.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Trusted, Tuned, Exposed: How Attackers Inherit SOC Trust
Modern SOCs continuously tune detections to manage alert volumes. Trusted accounts are allowlisted, recurring administrative activity is excluded, thresholds are raised, and frequently observed events are classified as benign. Each decision may be operationally justified, but it can also create an opportunity for adversaries to operate inside the same trusted behavior.Drawing on frontline incident response, threat hunting, and multi-environment SOC experience, this session examines real-world detection misses where attackers remained hidden not because they produced no signals, but because their activity resembled an accepted tool, identity, system, or workflow.The session discusses Adversarial Tuning Impact Assessment, a practical approach that evaluates tuning from the attacker�s perspective. Before suppressing an event, defenders assess the trust assumption behind it, determine how an adversary could exploit the same behavior, and identify the resulting loss of visibility.Rather than restoring broad and noisy alerts, the approach uses Detection Branching to create smaller, context-focused detections around meaningful deviations. Routine administrative activity may remain suppressed, for example, while focused detections examine unexpected identities, unusual assets, abnormal execution paths, changes in timing or scope, and relationships with other weak signals.Hypothesis-driven threat hunting bridges the gaps that static detections cannot fully address by converting tuning assumptions into targeted hunts for trusted-entity abuse and behavioral deviation.Through anonymized real-world examples, attendees will see what the SOC observed, why it appeared benign, how the adversary benefited, and how the tuning could have preserved both operational efficiency and investigative visibility.
- 18:00
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote