Andre Piazza
Andre Piazza is a cybersecurity strategist at BforeAI who works left of boom, catching adversary infrastructure during its staging window, before ransomware, account fraud, or brand and supplier impersonation reaches a target. He treats attacks as infrastructure and behavior rather than content, working from public signals like WHOIS, DNS, certificate transparency, and ASN data, and linking domains by registration velocity, shared certificate fingerprints, and hosting overlap to surface lookalike and impersonation infrastructure before it goes live. His work spans verification fraud, impersonation built with AI, scams that spin up around breaking news, and operational technology, and it gives as much weight to the human trust attackers exploit as to the technology. He turns published threat research into methods practitioners can use the next day, and he is a regular speaker at the SANS AI Cybersecurity Summit, BSides conferences including Seattle, Hou.Sec.Con, and Cybr.Hak.Con. He cares about building a more resilient community through collective defense.
Session
Most of us measure success one host at a time: find a malicious domain, file an abuse report, and wait days to weeks (or months) for a single domain to come down. That is a takedown. It is an essential part of mitigation, but it is slow, buying the attacker time to re-host the moment it works. Underneath it runs a faster layer most defenders never learn exists: an ecosystem of collective defense made of the internet's core infrastructure operators, such as browser and OS blocklists, public resolvers, mail reputation, and verdict aggregators, that can revoke an attacker's reach in minutes, sometimes faster than DNS propagation. I did not appreciate how much reach this layer has until I pulled the operators' own numbers. In this session I show how disruption and takedown work as two complementary layers, trace how one reported verdict propagates across the fabric of the internet, ground it in public documented cases, and show you how to tap in: point your resolvers at a public option, ingest open feeds, and report your own indicators to the community platforms built for it.