Let security fully blend into development and team culture.
Seek simple solutions for complex problems, for their power lies in easy application.
Empower customers, teams, and the community by sharing knowledge and tools.
I’m a security architect, ethical hacker, and trainer with over 20 years of experience in software engineering and cybersecurity. Based in Cologne, Germany, I help companies worldwide improve the security of real-world systems.
A growing focus of my work is AI security: securing LLM-based applications, agentic AI systems, and GenAI integrations.
I conduct in-depth penetration tests of applications, APIs, cloud environments, and container platforms—combining automated scanning with deep manual testing to find vulnerabilities that tools miss.
To cover the full security lifecycle, I also help organizations integrate security into their development practices through DevSecOps coaching and agile threat modeling, supporting engineering teams with clear, actionable recommendations.
Through my web security bootcamp and review & reflect workshop, I’ve trained thousands of developers and software engineers, emphasizing hands-on exercises from both attacker and defender perspectives.
To support the next generation of security professionals, I give an annual guest lecture on Security Architecture and Threat Modeling in the Business Informatics program at the University of Cologne, featuring an interactive threat modeling exercise with students.
I regularly speak at national and international conferences and write about security topics. I’m a member of OWASP, the Allianz für Cybersicherheit, and the Chaos Computer Club.
My goal is simple: make security understandable, actionable, and effective.
A web-based tool for creating and analyzing attack trees, using a scenario-driven approach for top-down threat modeling.
Try it outAn open-source, agile threat modeling toolkit that generates risk reports from YAML-based architecture definitions.
Try it outA real-time collaboration platform I built to enhance interactivity in my security trainings and workshops.
Try it outAs a speaker with international conference experience (Black Hat Arsenal USA, DEF CON AppSec Village USA, RSA Conference USA, Oracle JavaOne, Black Hat Arsenal Europe, Black Hat Arsenal Asia, DeepSec, BruCON, OWASP AppSecEU, OWASP AppSec Days, DevOpsCon Berlin/Munich/London/Singapore, JAX, Heise DevSec, Heise Sec-IT, Heise Herbstcampus, RuhrSec, JCon, JavaLand, Internet Security Days, IT-Tage Frankfurt, OOP, and others) I’m definitely enjoying to speak, present keynotes, and train about IT-Security topics.
From time to time I write articles in IT-Security journals about topics like DevSecOps automation and vulnerability research. The most recent ones include:
As part of my security research, I have discovered and responsibly disclosed multiple security vulnerabilities, resulting in over 30 CVE assignments (including a Java one with a CVSS score of 10), as well as a bug bounty payout from Google for identifying a vulnerability in Google Chrome.
My research on WebSocket security discovered an entirely new vulnerability class, Cross-Site WebSocket Hijacking (CSWSH). This vulnerability class later received its own CWE entry: CWE-1385: Missing Origin Validation in WebSockets.
Low-volume newsletter to announce new trainings, services, and conference talks (about four mails per year)