Intro:
Andy has been consulting in offensive security for over a decade, focusing on red teaming and simulated attacks with a side of threat intelligence and purple teaming. Leading engagements of varying sizes and lengths, helping grow teams and encouraging risk-driven understanding.
Creator of ZephrSec LMS and ZephrSec.
Projects:
- pR1 - serverless URL shortener built on Cloudflare Workers
- LCA - Local Code Agent, a similar idea to Claude Code but for lmstudio usage locally instead, useful for tool development
- pyLDAPGui - Python based GUI LDAP browser app thing
- GoClipC2 - Clipboard for C2 on Windows
- ChunkyIngress - A tool for ingressing large blocks of text in limited environments
- DynamicMSBuilder
- RepoMan - Dynamic Git Commits using LLMs
- HelloJackHunter - Dynamic DLL Hijacking and Exports
- CredMaster - I actively help with Credmaster, having written several modules and helped overhaul Credmaster 2.0.
- AzureAttackKit
- AutoHoneyPoC
- SandboxSpy
- BurpFeed
- PrintNightmare Detection Info
- SlinkyCat
- Offensive Sysadmin Suite
- HelpColor Aggressor Script - I try to keep Outflank's aggressor up to date with new cool BOFs and things :)
- Malleable-C2 - I actively contribute to Malleable C2 at each release, explaining the different options to help you make better C2 profiles within Cobalt Strike.
- OmniProx - An IP rotation tool similar to how FireProx operates but for different providers
Pages
Blog:
I post most of my research and other interesting tutorials on my blog; I also have a photos blog where I share pics I take; ZephrSnaps
Course:
I have written a course aimed at professionals wanting to learn more about red teaming, it focuses on red teaming from the perspective of not depending upon C2 and traditional malware but also teaches the background to red teaming that a lot of courses miss. https://lms.zsec.red
Book:
For those that don't know Andy, he is a firm believer in passing knowledge on and supporting the infosec community he does this by providing tutorials on his blog running his local DEF CON Chapter & has also published two books Breaking into Information Security and LTR102. He also helps out at DEF CON as a SOC Goon (Red Shirt) too each year (since DC24), assisting the SOC with operations and people flow.
Talks:
2026
- TBC. -
- TBC. -
- TBC. -
2025
- Securi-Tay 2025. - Think Like An Adversary - Recording
- Steelcon 2025. - Drinking from the Same Firehose - How Red Teams Outrun Threat Actors - Recording
- Hack Glasgow. - From Framing Risks to Framing Scenes - Transferable Skills Between Security and Hobbies- Was not recorded sadly!
- FalCon Europe 2025. DORA and Friends - Navigating Regulatory Red Teaming - Was not recorded sadly!
2024
- Securi-Tay 2024. - Measure Twice, Cut Once - The Importance of Lab-ing out Attack Paths - Recording
- Steelcon 2024. - Mastering Shadows: Blending [Offensive] Intelligence with Adversarial Emulation - Was not recorded sadly!
- FalCon Europe 2024. - Think Like an Adversary - Was not recorded sadly!
2023
- Securi-Tay 2023. - Demonstrating Actionable Value, Why the Business Hates Pentesters
- Steelcon 2023. - Adversaries Have It Easy. Live FAFO Pwning A Network
- BSides Leeds 2023. - Pentests: The Jason Bourne Approach Turning Regular Biros Into Weapons
2022
2021
2020
- Securi-Tay 2020. - So You want to learn Red Teaming
- DC44141 April 2020. - So You Want To Learn Red Teaming
- TUDublin HackerSoc. Red Team Talk
- CRESTCon 2020. Nijūshiho - A Year Targeting Nippon
2019
- BSides Leeds 2019. Hacking Companies For Internet Glory While Not Dying In A Sarlacc Pit
- Steelcon 2019. Hunting Sh*t Up - "Red Team" with a Bug Hunter's Mindset
- Steelcon 2019. PwnShop LollyPop - Workshop
- G3C Glasgow 2019. Sniffing Routes to Pwnage - An Introduction to Bloodhound
- Cyber Careers Summit 2019. Learning To Test Pens 101
2018
- Leanpub.com. Leanpub Interview - LTR101
- BSides Leeds 2018. Hacker of All Trades: Master of None
- BSides Glasgow 2018. Internet of Death: Modern Murder
- Steelcon 2018. Breaking Into Information Security: Learning The Ropes 101
Bug Bounty:
Badges
Andy has been in the IT security industry for just over 15 years, a decade of which has been dedicated to security and offensive operations. Currently holds CREST's Certified Red Team Specialist (CCRTS) and he has previously held CREST’s CCT Infrastructure certification, which is highly sought-after, and CHECK Team Leader status. In addition to his years in the industry, he holds several other certifications and accolades, including CCRTS, CRTO, OSCP, and OSWP.
