Alex is an American technology executive and former hacker. In the 1980s and 90s in Los Angeles, he ran with a group of young hackers and phone phreaks that included Kevin Mitnick, with whom he created and taught the Certified Social Engineering Prevention Specialist (CSEPS), the world's first social engineering prevention certification. He now researches AI deception and is writing a book on the subject. Alex married a Canadian, recently immigrated to Montreal, and is now learning French.
- Scammers Keep Winning: Why Humans and AI Fall for the Same Hustles
- Proofpoint Insider Threat Management (ITM) & Adaptive Email DLP: Detecting Malicious Users and Preventing Data Exfiltration
- Your unwritten data security control is fear, hesitation, and laziness. AI has none.
Amanda Kollmorgan is a Security Architect Lead for Veolia North America with nearly 20 years across federal and state government service, most recently as Deputy IT Director for the WI Dept. of Military Affairs. That dual seat, building compliance programs auditors sign off on while running operations meant to survive an attacker, taught her the widest gaps in cyber rarely show up on paper. She brings the same level of passion for mentoring people as she does for the cybersecurity profession.
- Ctrl + Alt + Lead: Rebooting Cyber Culture with Human Skills
Security Operations Manager and investigator — I spend my days untangling cases, diving into logs, and figuring out what actually happened. Curiosity is what drives me, and I've been in tech long enough to know that the best part of this field is the people in it. Happy to be part of this community and always excited to learn from the folks around me!
- Your Brain is Lying to You: Cognitive Bias in Security Investigations
Après près de 20 ans dans les TI, Audrey Shink a vu le meilleur et le pire du monde des MSP. Croissance, succès, acquisitions, clients stratégiques… mais aussi mauvaises décisions, manipulations, compromis coûteux et échecs. Son approche est simple : dire les vraies affaires. Sans filtre, sans jargon et sans langue de bois, elle partage les leçons que l’on apprend habituellement à ses dépens.
- I Have Failed - MSP edition : l’ingénierie sociale en affaires
- [Ghost Talk]Jedi contre les pirates : l'Eden de l'enfer
Bee Mallory is a graduate of the University of King's College. She is passionate about privacy and security. Bee has spoken about living in a privacy-conscious household at BSides Toronto, the Association for Computer Science Educators, and virtually for Hackfest in 2020, as well as facilitating numerous workshops on Sexual Violence Prevention and Bystander Intervention at their alma mater.
- Data, "Bullshit", and Post-Truth
Cheryl Biswas is a Canadian cybersecurity analyst engaged in strategic threat intelligence, tracking trends and emerging threats, and helping defend critical infrastructure. Her work experience across various sectors includes KPMG, CP Rail and TD Bank. She actively engages in the security community as a presenter, podcast contributor, volunteer, and mentor. She helped found “The Diana Initiative” and champions women and diversity in cybersecurity. She loves to ask “What if …”
- Take Off! It's Our Great White North
Chris Carlis is an unrepentant penetration tester with an extensive background in network, wireless and physical testing. Across his career, Chris has worked to expand the value offensive testing provided via open communication and goal driven engagements. Additionally, Chris has presented at a variety of conferences, including Thotcon, Hushcon, Hackfest, ShowMeCon, DeepSec, CypherCon and helps to organize “BurbSec”, the best attended Information Security monthly gatherings in the US.
- HASHCHAT - A Discussion on Password Cracking
Chris d'Eon is a threat intelligence researcher at Flare. With a focus on Asian cybercrime and nation-state activity, he is particularly interested in the social and geopolitical motivations of threat actors, painting a more qualitative picture of the human environment in which threat actors emerge.
- Inside the North Korean Infiltrator Threat
As a Cybersecurity Solution Consultant at Palo Alto Networks and ethical hacking professor at the University of Sherbrooke, Clément Cruchet is backed by experience in offensive security, network security, and incident response. This provides a holistic view of the full attack lifecycle. In this talk, he applies this expertise to cloud identity platforms to show how attackers exploit OAuth implementations for persistent access.
- OAuth Abuse & Exploitation: Implicit Trust is the New Attack Surface
Enseignante en francisation et initiée au Hackfest depuis plusieurs années, je suis passionnée pour l'ingénierie sociale.
- "Level up" ta vie avec l'ingénierie sociale
Damien Bancal (damienbancal.fr) est un expert internationalement reconnu en cybersécurité. Il a fondé le projet Zataz en 1989. ZATAZ.com est devenu une référence en matière d'information sur la sécurité informatique et les cybermenaces pour le grand public. Avec plus de 30 ans d'expérience, Damien Bancal s'est imposé comme une figure majeure dans la sensibilisation et à la protection des internautes contre les cyberattaques. Cela fait 10 ans qu'il vient au Hackfest.
- Et si votre enfant était un pirate
Dmitriy Beryoza is a Principal Security Researcher at Vectra AI. Before going into research, he was a penetration tester and secure software development advocate at IBM. He presented talks at SecTor, DEF CON Cloud Village, AtlSecCon, BSides LV/SF/Ottawa, HackFest, and other conferences. Dmitriy holds a Ph.D. in Computer Science and several industry certifications, including OSCP, GREM and CISSP. His interests include reverse engineering, secure software development, and CTF competitions.
- Playing Defense: Improving Blue Team Skills Through Competitions
Don Mallory has over 30 years of experience in enterprise IT, primarily in critical infrastructure, specializing in operations, data storage, disaster recovery, and security for critical infrastructure. Professionally, Don is a Senior Security Analyst in the healthcare sector. He is a co-author of “Applied Data Security Strategy - A Leader’s Guide”, and has been involved in various volunteer activities including C3X, Hak4Kidz Toronto, and teaching darkroom photography.
- Cloud Security Posture Management (CSPM) on a Shoestring
Dorota Kozlowska, known as 'Woman in Red' as a renowned offensive security specialist, and keynote speaker, she has captivated audiences at the most prominent events. Her passion for knowledge was awarded with CEFCYS Cyber Woman of Hope 2023 award, and the '40 Under 40 in Cybersecurity 2023' listing. She hosts popular cybersecurity themed podcasts where she host inspiring guests from the industry.
- Mindgames: How to Hack a Human Being
Éric Hébert œuvre en cybersécurité depuis 1994. Ancien CISO de Québecor, du Fonds de solidarité FTQ et du Groupe Pages Jaunes, il a dirigé d’importantes équipes et transformations en sécurité. Fondateur de Sandstorm Cyber, il conseille aujourd’hui des dirigeants en stratégie, gouvernance et gestion des risques. Conférencier, mentor, CISSP et CISM, il partage une vision pragmatique nourrie autant par ses réussites que par les décisions qu’il prendrait autrement aujourd’hui.
- J’étais le CISO qui n’a pas corrigé votre vulnérabilité critique.
Dustin Heywood, otherwise known as EvilMog® is an IBM Senior Technical Staff Member, semi-retired member of "Team Hashcat", black badge collector, and sometimes pretends to know a thing or two about passwords.
- Not an engineer as defined by APEGA, IANAL, offer void in the province of Quebec (j/k on the last part, J'Adore Quebec)
- HASHCHAT - A Discussion on Password Cracking
Faan Rossouw (Val-David, QC) is a security researcher focused on the intersection of security engineering, threat hunting, and agentic AI. Faan is currently working on aionsec.ai, a complete educational ecosystem that helps defenders master AI agents – from using them effectively, to building their own, to securing them. In his free time, Faan likes to hang out with his family, practice Brazilian Jiujitsu, and go for forest runs with his dog.
- Build Your Own AI Security Agent"
A venir
- Quand la sécurité des infrastructures essentielles n'est pas essentielle
François Harvey est consultant en cybersécurité offensive et défensive. Navigateur et instructeur de voile, il suit l'évolution des outils de navigation open source ainsi que des protocoles maritimes (AIS, DSC, balises 406 MHz), là où la sécurité informatique croise la sécurité en mer.
- Threat modeling des protocoles radio maritimes (AIS, DSC, SAR 406 MHz)
I am a Principal Security Analyst (Offensive Security) at iA Financial Group where I conduct penetration tests, purple team engagements, etc.
I have about 10 years of experience in cyber security. I started my career as a software developer, pivoted to application security, and finally ended up in offensive security.
- I Can’t Believe This Works: Web Exploits that Still Let Me In
- Hackfest @ Night – Hacker Game Night & Karaoke
Hocine Mahtout is Offensive Security Manager at the Caisse des Dépôts et Consignations. He works on offensive security (OffSec) approaches, including penetration testing, Red Team exercises, bug bounty programs, and other active methods aimed at improving system security. These approaches are designed to mimic an attacker’s behavior in order to better adapt defenses.
He is also co host of the OffSec community forum at Clusif, where professionals share experiences, best practices.
- Reconnaissance Active Directory depuis Linux : LDAP n'est pas la seule porte
Ian is a specialist in the Russian intelligence services and Russian cybercriminal underworld. He has spoken extensively on these topics, and his work has been cited by the House of Commons and the Security Service of Ukraine (SBU).
- Cyber in Siberia Regionalism in the GRU Information Operations Command
- Three Paths of Hacktivism: Russia, Ukraine and Belarus
Jacques Sauvé est consultant en cybersécurité chez Trilogiam, fort de plus de 30 ans d’expérience en TI. Ancien dirigeant d’une firme spécialisée dans les solutions Novell, il aide aujourd’hui les PME à se protéger contre les cyberattaques. Basé en Estrie, il est reconnu pour sa capacité à vulgariser les enjeux de sécurité et à conseiller sur les meilleures pratiques.
- Les PME ne sont pas dans la mire. Elles remplissent le champ de vision.
Jeff is a respected Information Security pioneer, advocate, advisor, OG hacker, evangelist, podcast host, teacher, international keynoter, speaker, and mentor. He shares over 42 years of experience. A Certified NSA Cryptanalyst, he designed NSA’s first software-based cryptosystem, invented a cipher wheel (Whiz Wheel) used by US Special Forces for over a decade, and was the architect of NSA's first penetration testing "red team".
- Keynote - Reflections of a[n almost] Nefarious Hacker or I Was the First Edward Snowden »
Jocelyn cumule plus de 20 ans d'expérience en technologies de l'information, œuvrant actuellement en cybersécurité opérationnelle. Titulaire d'un baccalauréat par cumul en cybersécurité, il enseigne également au collégial, où il a notamment conçu un cours dédié à la gestion des vulnérabilités. Curieux des enjeux de cybersécurité, il trouve dans des événements comme le Hackfest l'espace idéal pour des échanges enrichissants.
- Vulnpocalypse : exorciser le boom des vulnérabilités
- Proofpoint Insider Threat Management (ITM) & Adaptive Email DLP: Detecting Malicious Users and Preventing Data Exfiltration
Johnny has been a dedicated contributor to the public forum, sharing his extensive research and knowledge to the public since 2002. Most notably recognized for his pivotal role in exposing the American TSA Master Key leaks (2014-2018), uncovering Venmo stalking vulnerabilities (2018), and being an overall nuisance. Currently, he is the Global Head of Offensive Security for A Fortune 100 food and beverage manufacturer.
- 5 Lies Enterprise Security Still Tells Itself
Jonathan est consultant indépendant en sécurité applicative et cumule plus de 20 ans d'expérience. Passionné par la culture du hacking, il s’implique dans l’organisation du Hackfest et de NorthSec depuis leurs débuts, ainsi qu'auprès de DEF CON et de l’OWASP à l’international.
- Village Rétro Hacking
Joël HIEN is a security expert at Orange Cyberdefense, specializing in Active Directory and the exploitation of native Windows interfaces overlooked by defenses. As an open-source tool contributor, he focuses on directory reconnaissance and manipulation techniques, and has conducted research on WSUS and ESC8 relaying. Having already spoken on international stages, he regularly publishes in MISC magazine, with a keen focus on both offensive and defensive facets.
- Reconnaissance Active Directory depuis Linux : LDAP n'est pas la seule porte
With 20+ years in cybersecurity, Julien Turcot empowers businesses to thrive amid digital threats. As GoSecure's SVP of Sales, he crafts innovative strategies, nurtures relationships, and ensures exceptional service. Julien's leadership, strategic vision, and community engagement make him a cybersecurity luminary.
- How to Make $25K in 60 Seconds in 2026: ShinyHunters, BEC & the Industrialization of Cybercrime
Ayant une trajectoire atypique, Jérémy Viau-Trudel a fait de recherche fondamentale en physique quantique à l'Université Laval et à l'Université Paris-Sud (2010-2016).
Depuis 10 ans, il intervient comme consultant TI sur des mandats DevSecOps. Son approche pragmatique l'a amené à travailler aussi bien sur des infrastructures on-premise qu'en infonuagique et en edge computing.
Depuis 2021, il développe Groupe Innovation Numanity inc., le premier studio DeepTech de la Ville de Québec.
- Relever sa posture de sécurité face au risque quantique
J'ai fondé Talenty avec une conviction simple : le recrutement en technologie et en cybersécurité mérite une approche plus humaine, plus rigoureuse et plus transparente. Comme chasseuse de tête spécialisée, j'analyse chaque année des centaines de CV, de profils LinkedIn et d'entrevues. En conférence, je partage une vision concrète du recrutement et des conseils pratiques pour aider les professionnels à mieux faire valoir leur expertise.
- Hack ta carrière : Les erreurs qui coûtent des opportunités aux professionnels en cybersécurité
Kirils Solovjovs is Latvia's leading white-hat hacker and privacy activist. He began programming at age 7, and by grade 9 was already writing machine code directly in a hex editor during lunch breaks. His hobby is asking "what are you gonna do with that piece of information about me?" everywhere every time.
Renowned for uncovering and responsibly disclosing critical vulnerabilities in national and international systems, today Kirils serves as lead researcher at Possible Security.
- Embedded Firmware Reverse Engineering: Making Mistakes for the Greater Good
- The Four Horsemen of the Privacy Apocalypse (Global Edition)
- Security Impress Karaoke
La French Connection — Le podcast international sur la cybersécurité et le hacking. À chaque 2 semaines, et ce depuis 2016, des nouvelles, analyses et opinions depuis le Québec. Animé par la communauté Hackfest.
- La French Connection – Retour explosif sur 2026
Active member of the cybersecurity community, particularly in Montreal through local events and the PolyCyber association.
- Qubes OS: From Zero to a Live Bootkit Attack
Marc-André Beaulieu est pentester chez Santé Québec. Avec plus de 5 ans d'expérience en sécurité offensive, il s'intéresse particulièrement à la sécurité web, à la sécurité des LLMs et à leur utilisation en sécurité offensive. Adepte d'énigmes, il a conçu des défis de CTFs au Hackfest, iHack, CSGames, UnitedCTF et au ULCTF qu'il a fondé en 2023. Ancien président du Club de sécurité informatique de l'Université Laval, il aime échanger et discuter autant devant une classe qu'autour d'une bière.
- Moins de "prompt" et plus d'"engineering": 10 mois à "farmer" les CVEs automatiquement avec l'IA
- Your unwritten data security control is fear, hesitation, and laziness. AI has none.
Matheus Bezerra is a Software Engineer at Apura Cyber Intelligence, working on cybersecurity, OSINT, large-scale data processing, and threat intelligence platforms. His work focuses on building systems that collect, structure, enrich, and analyze large volumes of online intelligence. He holds a B.Sc. in Computer Science and is pursuing graduate studies in Data Science.
- From Isolated Events to Connected Evidence: Structuring Fragmented Cybercrime Data
Mina Movahedi Shakib is a strategic cybersecurity expert with 14+ years of experience in Incident Response and SOC operations. Currently a Senior Cyber Threat Investigator at Bell, she is a leader in Cognitive Security and "Cyber Emotions." A multi-award-winning professional, Mina was named a 2026 Top 10 Under 40 by Canadian Cybersecurity Magazine and a 2025 Women in Tech Global Awards Gold Medalist. She advocates for mental health within the cybersecurity community.
- Patching the Human Kernel: Protecting Mental Health and Defeating Burnout in the AI Era
Hello! I'm a second year university student pursuing computer engineering at the University of Guelph. I am part of the Guelph Cybersecurity Society as a technical helper as well. I began my journey through cybersecurity in Fall 2024 and have remained obsessed with malware analysis, DFIR, and lately, CTI. I specialize more towards Rust reverse engineering given its developing state. In my spare time, I write up many of my analysis and thoughts on my blog.
- Rust Reversing for All: Extracting Metadata From Rust Binaries
Avec plus de 25 ans d’expérience en informatique et plus de 15 ans en sécurité de l’information et opérationnelle, elle est Responsable des enquêtes numériques & Renseignement en sources ouvertes dans une compagnie dans le domaine des services financiers/assurances. De plus, elle prépare la relève dans son domaine soit comme responsable de deux programmes d'étude au Cégep Garneau (Cyber-enquête et Cybersécurité) ou soit comme conférencière... souvent au Hackfest!.
- Persona Non Grata : Investigation OSINT d'une opération d'influence IA. De la fausse journaliste au wallet de crypto !
Patricia Gagnon-Renaud est analyste en cybersécurité au sein de l'équipe de piratage éthique chez GoSecure. Elle est titulaire d'un baccalauréat en génie des TI, est membre de l'ordre des ingénieurs du Québec et est certifiée CISSP et OSCP+. Ses intérêts incluent l'ingénierie sociale, la sécurité physique, le crochetage de serrures et le transport en commun.
- OSINT rechargée: Applications concrètes de l'OSINT en pentest
- Hackfest After Dark – Social Engineering Contest: Night Edition
Peppin is a live-code hyperpop producer & performer. From solo acts to being 50% of SWEETGUM, Peppin meshes high-energy maximalist production synthesized with colorful glitchy energy to create tracks that break the code. Cultivating in the queer Boston DIY scene, Peppin has gone from crafty DIY shows under bridges to filling up night clubs.
- PEPIN - Music Show
Passionné de sécurité logique et physique, travaillant dans le secteur TI municipal, depuis plus de 22 ans et plus précisément près de 19 ans d’expérience en sécurité de l’information. Toujours disponible pour jaser de cybersécurité avec mes pairs, je prône intensivement une approche unifiée et centralisé de la sécurité.
- Un pentest, à quoi ça sert ?
I am a security researcher specializing in low-level security, reverse engineering, vulnerability research including embedded devices and IoT. I have spoken at cybersecurity conferences including BSides Prague, KazHackStan, Positive Hack Talks, Cyberkent.
- Hacking IoT Firmwares with LLMs
Robert Wagner is an Advisory CISO and highly respected security
practitioner, advisor and strategist with over 20 years of experience.
His security experience ranges from defending everything from Fortune
500 companies to government agencies, major universities, and
financial institutions. He is a co-founder of the not-for-profit
organization Hak4Kidz, serves on the board of the Chicago ISSA
chapter, and regularly volunteers for various hacker cons including
Bsides312, BlueTeamCon, and others.
- Certified Vibe Hacker
Samdup is an information security researcher and digital security trainer based in Dharamsala, India. Originally from Tibet, he holds an M.Sc. in Computer Science from Bangalore, India and, a Master’s in Cybersecurity from Georgia Tech. His work focuses on malware analysis, memory forensics, incident response, threat hunting, and practical defensive security.
- From Disclosure to Re-Weaponized Delivery: Recovering a Go/Sliver-Style Implant from Memory
- Présentation - Vooban - Partenaire principal
Spécialiste en sécurité applicative, cloud et IA, Samuel Dussault gravite autour de la tech depuis près de 15 ans. Ancien développeur, pentester et leader AppSec, il a travaillé autant sur le terrain que sur la mise en place de programmes de sécurité. Il aime rendre les sujets complexes accessibles, concrets et utiles pour les équipes techniques.
- Curl | sh et autres mauvaises idées : anatomie d’une supply chain compromise
- [Ghost Talk]Jedi contre les pirates : l'Eden de l'enfer
Simon Nolet est un professionnel de la cybersécurité avec plus de 10 ans d'expérience en sécurité offensive. Après avoir effectué plus de 250 tests d'intrusion et développé une expertise approfondie en évaluations de sécurité d'entreprise, il se concentre maintenant sur une nouvelle mission : enseigner aux professionnels de la sécurité comment intégrer l'IA dans les opérations de cybersécurité sans perdre la pensée critique qui les rend efficaces
- Leçons Apprises: Automatiser les Opérations Cyber avec l'IA
- Hackfest 101
wra wra wra wra wra wra wra wra wra wra
- Village Rétro Hacking
- Présentation du ministère de la Cybersécurité et du Numérique (MCN) - Souveraineté numérique et cyberdéfense : où en est le Québec?
As a Senior Penetration Tester at Software Secured, Julian hunts for vulnerabilities across a range of clients and products. Off hours, he spends his time performing vulnerability research against IoT devices and FOSS, amassing over 50 CVEs in the past several years.
- Breaking Botslab
Drew Kirkpatrick has 25 years of experience building complex systems across application security, ML, and aerospace. He is now a red teamer at Blackthorne Consulting, Previously: security researcher and principal consultant at TrustedSec, NopSec and SecDec, and senior computer scientist for the U.S. Navy. He holds an MS in Computer Science and an MS in Computer Information Systems from Florida Tech, plus OSCP, CRTO, GWAPT, and GMOB certs. Author of JS-Tap and OWASP Attack Surface Detector.
- Post-Exploitation of the Desktop with JS-Tap