Drew Wade
Andrew Wade is a Principal Security Consultant with NCC Group, where he leads and delivers penetration testing and cloud security engagements across application, container, Kubernetes, and cloud environments. He also leads NCC Group’s Cloud Security Community of Practice and guides the global Cloud Security Practice, including service design, delivery standards, scoping improvements, and consultant enablement.
Andrew’s work sits at the intersection of hands-on technical testing, practice leadership, and client advisory. He focuses on helping organizations turn security testing into clearer risk understanding, better remediation decisions, and more mature security programs. Prior to cybersecurity consulting, Andrew worked in academic research and university teaching, bringing a background in anthropology, communication, and human behaviour that directly informs his perspective on why penetration testing succeeds or fails in practice.
Session
Penetration tests often fail before testing begins: unclear scope, missing access, vague expectations, and teams that are not ready to act on the findings. This talk covers the real-world parts of pentesting that do not show up in CTFs or exploit write-ups: scoping calls, messy asset lists, delayed credentials, defensive reactions, and reports that never become remediation work. Using anonymized consulting examples, we will look at how to prepare for a pentest, stay engaged during testing, and turn findings into actual security improvement.