Gábor Matuz

Gábor's introduction to IT security has been pentesting eventually focusing on application security. Changing from consulting to working on secure development at a bank he learned to appreciate what happens after submitting a report: the complexity and other downstream costs of security fixes. In parallel, to add to personal experience, he have seen "high risk" issues open for years but never exploited made him skeptical about the likelihood side of the equation as well. Ever since that time, as Agile Security gave way to Security Automation and more recently DevSecOps allowing more data driven decisions, his passion has been to find the "justified" level of security for products, services or companies. These days, for him this means understanding what attacks actually happen, and being precise testing the coverage (false negative rates) of security solutions to understand what is the realistic level of their mitigation one should reckon with. Even though for the last few years he have been focusing more on strategy and the organizational setup and impact of security, he tries to keep close to the technical side of things. Gábor believes deep understanding is necessary to make good strategic decisions in a dynamic field like cyber security.