Passing an audit and being hard to attack are no longer the same thing in cloud-native environments. Identities, pipelines, and managed services now decide who can reach production, and those relationships rarely show up in a screenshot of a control.
Trevor Horwitz, co-founder and CISO of TrustNet, has more than two decades in cybersecurity and is a PCI Qualified Security Assessor. In this session, he walks through where audit posture and real attack surface diverge, and what assessors now ask engineering teams to show.
In this session
How assessments changed as production moved to containers, managed services, and Kubernetes
Why effective privilege is often greater than assigned privilege
How secrets move through engineering workflows and end up in logs
Why a shared CI/CD identity can defeat network segmentation
Where a managed provider’s responsibility ends
How to prioritize findings by what they connect to
Why vector databases deserve more protection than they get
He is speaking from his own experience, and the views he shares are his own. TrustNet did not sponsor this content.
Hosted by Shant Ebenezer Jena, volunteer host for Offensive Engineering.
