CV
Kat Traxler
Security Research | Leadership | Education
As a Principal Security Researcher at Vectra AI, I conduct foundational research into cloud threat landscapes, including managed identities, AI-assisted bug-hunting, and cloud-native ransomware. I am a frequent speaker at cybersecurity conferences including RSA, BlackHat EU, DefCon, and fwd:cloudsec. I authored SANS SEC549: Cloud Security Architecture. Published author and regularly quoted in the media on cybersecurity.
Work Experience
Principal Security Researcher — Vectra AI
July 2021 – Present · San Jose, CA
As a technical subject-matter expert at Vectra AI, a leader in Network/Cloud Detection and Response (NDR/CDR), I guide strategic product direction based on critical threat landscape analysis. I previously architected the core detection logic for the AWS CDR product (2021–2023), successfully defending customers against cloud-native and nation-state-backed attacks. My foundational research on managed identities, AI-assisted bug-hunting, and S3 Ransomware has been foundational groundwork for key product capabilities.
Principal Security Researcher, GCP — TrustOnCloud
January 2024 – June 2024 · Singapore
Performed in-depth threat modeling on GCP services for major financial institutions and governmental organizations, identifying critical threats and architecting mitigating controls, allowing customers to deploy and use cloud services with more confidence.
Lead Author, SEC549 — SANS Institute
September 2021 – December 2023 · Baltimore, MD
I authored and created SANS SEC549: Cloud Security Architecture course, a critical new offering for the globally recognized SANS Institute, envisioning the entire 5-day program. This course delivers foundational training for cutting-edge defensive patterns in cloud security design to a worldwide audience of engineers, analysts, and architects.
Security Engineer & Architect — Best Buy
September 2016 – July 2021 · Richfield, MN
At Best Buy, a Fortune 100 retailer, I leveraged diverse experience across web application penetration testing, security architecture, and cloud security engineering. During the critical, rapid enterprise adoption of the cloud, I functioned as the primary Cloud Security SME, directly enabling a smooth, secure migration. I architected end-to-end cloud incident response capabilities, coordinated cross-functional teams, and designed containment strategies.
Education & Certifications
Education
Full Stack Software Development
Prime Digital Academy — Graduated April 2016
GIAC Certifications
- Public Cloud Security (GPCS) GIAC · 2021
- Cloud Security Automation (GCSA) GIAC · 2020
- Defending Advanced Threats (GDAT) GIAC · 2017
- Certified Windows Security Administrator (GCWN) GIAC · 2016
- Security Essentials (GSEC) GIAC · 2016
Publications, Blogs & Research
- 🔬 You Are The Blackboard – AI Assisted Bug Hunting (2025)
- 🔬 Beyond Configuration Perfection: Redefining 'Cloud Security' (2025)
- 📄 Comparing CSP-Managed Machine Identities — Whitepaper (2025)
- 🔬 GCP IAM 201 – OAuth Scopes (2025)
- 🔬 From Remediation to Mitigation: Addressing Insecure-by-Design Flaws (2024)
- 🔬 Transitive Access Abuse – Data Exfiltration via Document AI (2024)
- 🔬 The Unauditable, Unmanageable HMAC Keys in Google Cloud (2024)
- 🔬 Cloud Threat Detection Capabilities with The DeRF (2023)
- 🔬 Rethinking Your Threat Models for the Cloud (2023)
- 🔬 LastPass Breach: The Pyramid of Pain Perspective (2023)
- 🔬 Abusing the Replicator: Silently Exfiltrating Data with AWS S3 Replication (2022)
- 📄 Cloud-Native Ransomware — Whitepaper (2022)
Speaking Engagements & Podcasts
2025
- RSA (San Francisco) — "GCP Org Policies to Live By – And Their Implementation Pitfalls"
- fwd:cloudsec EU (Berlin) — "Confidence Predicts Accuracy and Other Lies About Cloud Security"
- BSides Las Vegas — "The Not So Boring Threat Model of CSP-Managed NHI's"
- SecTor Cloud Security Summit (Toronto) — "Confidence Predicts Accuracy and Other Lies About Cloud Security"
- SecretCon (Minneapolis) — "GCP Org Policies to Live By – And Their Implementation Pitfalls"
2024
- fwd:cloudsec EU (Brussels) — "Service Agents and the Search for Transitive Access in GCP"
- SecretCon (Minneapolis) — "All Quiet on the Western Front – Exposing Logging Gaps in the Cloud"
- The Cloud Security Podcast by Google — "Kat Traxler and IAM Mysteries"
2023
- BlackHat EU (London) — "Democratizing Attack Techniques in the Cloud with The DeRF"
- DefCon Cloud Village (Las Vegas) — "Attacks as a Service with The DeRF"
- SecretCon (Minneapolis) — "Whether you like it or not, you're on a Cloud Security team"
2022
- fwd:cloudsec US (Boston) — "Abusing the Replicator: Silently Exfiltrating Data with AWS S3 Replication"
- Cyphercon (Milwaukee) — "How Ransomware Can Follow You to the Cloud"
2020
- fwd:cloudsec (Virtual) — "GCP Primitive Roles, An Indictment"
- SANS Cloud & DevOps Security Summit — "A Bug Hunter's Guide To GCP"
Featured In
- TL;DR Sec by Clint Gibler — Episodes 272, 260, 237, 194, 143 (2022–2025)
An industry trade publication with over 90k subscribers. Never pay-to-play and among the most trusted by industry professionals. - The Register (2024) — Coverage of GCP service agent research on overly permissive agents allowing unauthorized data exfiltration
- VentureBeat (2021) — Quoted as a thought leader on cloud security automation strategy across major cloud platforms