CISO at @sardineai. Chapter leader @OWASP Phoenix. (he/him) qatta' mIghtaHghach.
Phoenix, AZ
Joined July 2009
- Tweets8.5K
- Following115
- Followers760
- Likes16.3K
Bil Corry retweeted
We are super close to having a platform to release @_HighSchool911 on! Working on having it set up in the 1st quarter of 2026.🤞🏻 You will be one of the first to receive the link. We hope you are still with us by then—
“84 years” later. 😊 Happy Holidays, Bil, & thanks again! 🚑
Bil Corry retweeted
🤔 Are merchants mistaking AI agents for malicious bots?
We tried to buy a $4 tube of toothpaste online (for pickup) with ChatGPT Agent mode.
The checkout never made it past the fraud system. It wasn’t a payment issue. It wasn’t out-of-stock. The only “problem” was that the buyer was an AI agent.
Old world: Spot the bot, stop the fraud.
New reality: The bot is the customer.
This is an issue most merchants are racing to figure out. The ones that update their fraud toolkit for this new world will own the next era of commerce.
But that will mean figuring out how to:
- Authenticate agents as legitimate buyers
- Bind user consent to agent actions
- Detect compromised or malicious agents
- Redesign step‑ups for non‑humans
- Adapt risk scoring to mixed human/agent journeys
We’ve laid out ways to adapt in our new whitepaper on agentic commerce.
Bil Corry retweeted
With the rise of AI, some people estimates 1 in 4 job candidates will be fake by 2028. In a recent internal hackathon, we built a system to catch fake applicants using Sardine's technology. Here is how it works - sardine.ai/engineering-blogs…
Bil Corry retweeted
HARK, INFOSEC FRIENDS! CactusCon 13 talks are now LIVE!
youtube.com/playlist?list=PL…
We had so many great technical talks this year, and our keynotes @AletheDenis and @ShelbyGrossman did a great job offering unique insight on this wild AI-infused world we now live in.
Bil Corry retweeted
What's the robots.txt for Agentic Payments?
As most of you know, A robots.txt file tells search engine crawlers which URLs the crawler can access on your site. This is used mainly to avoid overloading your site with requests.
We need a system via which AI agents that are making payments on behalf of a user, don't get flagged by Anti fraud systems like Sardine
Our platform detects automated threats other systems miss, from OpenAI's Operator to Selenium, Puppeteer, BrowserBase and Playwright.
For e.g. the GIF below shows us detecting one of the Agentic browser automation frameworks which was instrumented to detect the various form fields to fill out and click.
But instead of the Agentic payment companies playing a game of hide and seek with anti fraud players, it would be much better if we could work collaboratively and figure out ways via which they can mark themselves as good!
If you are building in Agentic payments, please reach out. We would love a conversation!
Bil Corry retweeted
CactusCon happens thanks to our volunteers, speakers, community, and sponsors.
We are grateful to @OWASP for returning this year as an In Kind Sponsor. They are a pillar of the cybersecurity community providing free resources and education for keeping our systems secure.
Bil Corry retweeted
🚀 Exciting news alert! Secure your SUPER Early Bird Tickets for the 2025 #OWASP Global #AppSec EU in Barcelona. Don't wait - grab your spot at a discounted rate for this thrilling May conference. Limited availability, act fast! Register now to lock in your place: owasp.glueup.com/event/owasp…
#devsecops
Bil Corry retweeted
In 1974, the NSA launched Cryptolog, a periodical intended as a vehicle for the exchange of technical ideas in its operations. All 136 issues were declassified in 2012, with further info added over time. There are now thousands of items in the archive. buff.ly/3CXGXlW
Bil Corry retweeted
The candidates for the 2024 OWASP Global Board of Directors' Election are:
Harold Blankenship
Elastos Chimwanda
Ricardo Griffith
Adeel Javaid
Ashwini Siddhi
Diego Silva Martins
Review their candidate page:
owasp.org/www-board-candidat…
Voting opens October 15th for all paid individual members
Bil Corry retweeted
OWASP Global AppSec San Francisco happens THIS MONTH!
Hear from some of the most influential voices in cybersecurity including our four keynote speakers @SecurityTed @Jhaddix
@reenysondhi and @nchlgpt
Register to hear insights from these keynotes and explore, learn, and connect with the best in the industry. Secure your spot now!
sf.globalappsec.org/
#OWASP #SanFran #AppSec #Developers #CyberSec
Bil Corry retweeted
🚀 Don't miss the chance to be part of #OWASP #Appsec Days Singapore on October 1-2! Dive into top notch training, enlightening talks, expo, and networking opportunities with other #cybersecurity professionals. Secure your spot now singapore.appsecdays.org/?ut…
#devsecops #AI
Bil Corry retweeted
Exciting update alert! 🚀 Don't miss #OWASP in Singapore on October 1-2 for #AppSec Days! Get set for premium training, enlightening talks, expo, and networking. Be part of this remarkable OWASP event - register now to secure your spot: singapore.appsecdays.org/?ut…
#devsecops #AI
Bil Corry retweeted
Will you be at #OWASP Global #AppSec San Francisco this September? Imagine meeting someone face to face, sharing your knowledge, and making a real impact. Join us as a mentor at our Meet the Mentor Event! Sign up here: owasp.wufoo.com/forms/z1x359…
#cybersecurity #devsecops #infosec
Bil Corry retweeted
The crypto targeted squarespace breach is real. Multiple sites are compromised and more may be coming.
We detected and thwarted this attack at @coinlist on Tuesday, July 9.
Here's what to do & I'll share why I'm concerned the root issue may be a @Squarespace breach
Bil Corry retweeted
Brave lets users turn it off. Unlike others, we also block uploading WebRTC logs to Google. Previously, users without the extension could not use Google Hangouts on Brave. We're seeing if we can disable the extension now: github.com/brave/brave-brows…
Bil Corry retweeted
So, Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel.
This API is not exposed to other sites - only to *.google.com.
Bil Corry retweeted
OWASP Global AppSec San Francisco Sept 23-27
Introducing Developer Day on 9/26 where you can share and learn about the pain of others while looking for solutions!
Register now!
sf.globalappsec.org/?utm_sou…
#SanFran #AppSec #CyberSec #Developer
Bil Corry retweeted
Since we published our newsletter, Google announced that they will distrust Entrust.
Cryptography & Security Newsletter: an update on the Entrust story. If you missed the newsletter yesterday, we wrote about the events that preceded Google's decision to distrust. feistyduck.com/newsletter/is…
Bil Corry retweeted
🚨BREAKING: Historic privacy settlement in which Google agrees to delete browsing data collected in Incognito Mode and more. Quotes:
➡️"Google with this Settlement agrees to rewrite its disclosures to inform users that “Google” collects private browsing data, including by explicitly disclosing that fact in its Privacy Policy and on the Incognito Splash Screen that automatically appears at the beginning of every Incognito session."
-
➡️"While disclosure changes ensure transparency going forward, Plaintiffs also demanded and secured accountability and relief for Google’s past conduct. Upon approval of this Settlement, Google must delete and/or remediate billions of data records that reflect class members’ private browsing activities. This includes data Google collected during the class period from private browsing sessions."
-
➡️"For the next five years, Google must also maintain a change to Incognito mode that enables Incognito users to block third-party cookies by default. This change is important given Google has used third-party cookies to track users in Incognito mode on non-Google websites. This requirement ensures additional privacy for Incognito users going forward, while limiting the amount of data Google collects from them."
-
➡️"Google must delete the private browsing detection bits that Plaintiffs uncovered, which Google was (twice) sanctioned for concealing. As a result, Google will no longer track people’s choice to browse privately."
➡️For more tech & AI policy information, subscribe to my newsletter.
