Cyber Security Leader, Advisor, and Practitioner

Aditya K Sood , Ph.D.

Aditya is a cybersecurity practitioner, researcher, and consultant with 18+ years of experience driving security across products and infrastructure. He specializes in aligning security with business value to enable growth and resilience. His interests include AI security, cloud security, malware automation and analysis, application security, and secure software design. He held positions such as Senior Director of Threat Research and Security Strategy, Head (Director) of Cloud Security, Chief Architect of Cloud Threat Labs, Lead Architect and Researcher, Senior Consultant, and others while working for companies such as F5 Networks, Symantec, Blue Coat, Elastica, IOActive, Coseinc, and KPMG.

At present, he is Vice President of Security Engineering and AI Strategy at Aryaka.

LinkedIn Google Scholar Photography @Flickr Twitter
Aditya K Sood (Ph.D)

Towards Security

Insights

EXPERT OPINION

Techtarget (ComputerWeekly) Articles

Read articles released for computerweekly.

RESEARCH SHOWCASE
PODCAST
PODCAST
RESOURCES
RESOURCES

Authored Books

Artificial Intelligence, Cloud Security, and Targeted Cyberattacks

Combating Cyberattacks Targeting the AI Ecosystem

Securing AI Ecosystem

This book explores the evolving AI threat landscape, including risks in LLMs, GenAI, and AI infrastructure.

Amazon →
DeGruyter →
Combating Cyberattacks Targeting the AI Ecosystem

Securing Cloud (Edition 2)

This cloud security book focuses on real-world attack scenarios, risk assessment, and proven methods to prevent data breaches.

Amazon → DeGruyter →
Combating Cyberattacks Targeting the AI Ecosystem

Securing Cloud (Edition 1)

Designed for cloud and security practitioners, this book delivers hands-on strategies to evaluate and secure cloud environments.

Amazon → DeGruyter →
Targeted Cyber Attacks

Understanding Cyberattacks

This book examines real-world examples of directed attacks and provides insight into what techniques and resources are used to stage these attacks.

Amazon → OReilly →

Contributor and Reviewer

Contributor

Contributed chapter on botnets in the book: Hackers and Hacking - A Reference Guide.

Book@Amazon

Contributor

Contributed chapter on debugging in Debugged:Software Tracing book.

Book@Amazon

Contributor

Contributed chapter in Debugged:Multithreading book.

Book@Amazon

Book Reviewer

Reviewed book: Critical Infrastructure Security: Cybersecurity Lessons Learned from Real-world Breaches

Book@Amazon

Publications

Research Publications, Articles and Whitepapers

Media Coverage

Commentary on cybersecurity Challenges

Conferences

Security Talks Presented at Events

  • AI Under Siege: Dissecting the ReAct Framework Attack Surface, Anti Phishing Working Group (APWG), San Diego 2025
  • Unveiling Threats Targeting AI: Equalizing Attacks and Intelligence, Mountain View, 2024
  • Combating AI Attacks Targeting the AI Ecosystem, APWG eCrime Conference, Boston, 2024
  • Striking C&C Infrastructure for Generating Applied Threat Intelligence, BSides Security Conference, Goa, 2024
  • Attack Like an Attacker: Targeting C&C Infrastructure, Pacific Hackers Conference, Mountain View, 2023
  • MELEE: A Tool to Detect Ransomware Infections in MongoDB, BlackHat Arsenal, Las Vegas, 2023
  • Using ML/AI to Design Cybersecurity Solutions, SF Tech Summit, San Francisco, 2023
  • Compromising the Keys to the Kingdom - Exfiltrating Data to Own and Operate the Exploited Systems, FIRST Incident Response Conference, Montreal, 2023
  • Cloudifying Ransom Wars, Anti Phishing Working Group (APWG) eCrime Conference, Internet, 2022
  • Data is the New E-Currency: Dissecting the Paradigm of Present-day Cyberattacks , Pacific Hackers Conference, Mountain View, 2022
  • Combating Ransom-Wars: Evolving Landscape of Ransomware Infections in Cloud Databases, Hackers on Planet Earth (HOPE) Conference, New York, 2022.
  • World of Modern Apps: Dissecting Ransomware and Botnet Threats in Cloud Databases, Secure 360 Conference, Prior Lake Minnesota, 2022.
  • Dethroning Ransomware Infections in the Cloud Databases used for Modern Applications, Texas Cyber Security Summit, San Antonio, 2021.
  • {Internet of Things or Threats}: Anatomizing the Structure of IoT Botnets, Hack in Paris (HiP) Conference, San Antonio, 2021.
  • Internet of {Things or Threats}, BSides, Berlin, 2021.
  • Enfilade: A Tool to Detect Potential Ransomware Infections in MongoDB Instances, BlackHat Arsenal USA, 2021.
  • Uncovering Botnets in IoT Hemisphere, Secure 360 Conference, St. Paul Minnesota, 2020.
  • Strafer: A Tool to Detect Potential Infections in Elasticsearch Instances, BlackHat Arsenal Europe, 2020.
  • Compromising IoT C&C panels for Unearthing Infections, Virus Bulletin Local Host, 2020.
  • Jamming into the World of IoT Botnets: The Hacker’s Way, UTSA, San Antonio, Texas, 2020.
  • Connected World of Devices - Exploiting the Embedded Web Security Pacific Hackers Conference , Santa Clara, CA, 2019.
  • Embedding Security and Privacy in DevOps - Real World Case Studies SANS DevOps Summit, Denver, Colorado, 2019.
  • The State of Embedded Web Security in IoT Devices, Texas Cyber Security Summit, San Antonio, 2019.
  • IoT Botnet Chaos, ToorCon Security Conference, San Diego, California, 2018.
  • The State of IoT Botnets - The Bad and The Ugly, Hackers on Planet Earth (HOPE) Security Conference, New York, NY, USA, 2018.
  • Crimeware Chaos: Empirical Analysis of HTTP-based Botnet C&C Panels, BSides SF , San Francisco, USA, 2018.
  • The State of IoT Botnets: An Overview, IoT Security Symposium, Burlingame, CA, USA, 2018.
  • Cloud Storage Abuse and Exploitation, EDGE Security Conference, Knoxville, Tennesse, USA, 2017.
  • The Budding World of Cloud Storage Abuse and Exploitation : A Technical Deep Dive, FIRST Security Conference, Puerto Rico, USA, 2017.
  • The TAO of Automated Iframe Injectors - Building Drive-by Platforms For Fun and Profit, Virus Bulletin, Denver, USA, 2016.
  • Understanding the Crux - Abuse of Cloud Storage Apps, CSA Secure Cloud , Dublin, Ireland, 2016.
  • Delivering Security in Cloud Generation World, RSA, San Francisco, USA, 2016.
  • Sanctioned to Hack - Hunting Vulnerabilities in SCADA HMIs, Ground Zero, New Delhi, India, 2015
  • Design Flaws in Network Switches - Your Network Devices Belong to Us!, ToorCon, San Diego, CA, USA, 2015
  • Dynamics of Cloud Storage Abuse and Exploitation - One More for the Road!, ToorCon, San Diego, CA, USA, 2015
  • Applying Data Science to Cloud Services Auditing, Compliance, Monitoring and Security, PSR (Privacy Security Risk), Las Vegas, USA
  • The State of Web Security in SCADA HMIs, OWASP, San Francisco, CA, USA, 2015
  • Hunting Vulnerabilities in SCADA HMIs, DEFCON, Las Vegas, Nevada, USA, 2015
  • Exploiting Fundamental Weaknesses in Botnet C&C Panels, BlackHat, Las Vegas, Nevada, USA, 2014
  • C-SCAD - Assessing Security Flaws in ClearSCADA WebX Client,BlackHat Arsenal, Las Vegas, Nevada, USA, 2014
  • How I Hacked Your Botnet C&C Panels, ToorCon, San Diego, 2014
  • Sparty : A Tool to Audit FrontPage and SharePoint, BlackHat Arsenal,Las Vegas, Nevada, USA, 2013
  • Emerging Trends in Online Social Network Malware, Secure 360 , St. Paul, Minnesota, 2013
  • Dissecting Socioware - A Study of Online Social Network Malware, InfoSec Security Southwest (ISSW),Austin, Texas, 2013
  • Malandroid - Android Malware Mayhem, ToorCon, San Diego, 2012
  • Bust a Cap in the Mobile App, SANS AppSec, Las Vegas, 2012
  • The Realm of Third Generation Botnet Attacks, GrrCon, Grand Rapids,2012
  • Bonded with Botnets, US-CERT GFIRST, Atlanta, 2012
  • Botnets Die Hard - Owned and Operated, DEFCON, Las Vegas,2012
  • Advancements in Botnet Attacks and Malware Distribution, Hackers on Planet Earth(HOPE), New York,2012
  • Insidious Infections - Mangling with Botnets, Layer One, Anaheim, California, 2012
  • Dissecting the State of Present-day Malware, HackCon, Oslo, Norway, 2012
  • Hunting Web Malware, Hacker Halted, Miami, Florida, 2011
  • Browser Exploit Packs - Death by Bundled Exploits, Virus Bulletin, Barcelona, Spain, 2011
  • Botnets and Browsers - Brothers in the Ghost Shell, BruCon, Brussels, Belgium, 2011
  • The Good Hacker - Dismantling Web Malware, OWASP AppSec, Minnesota, Minneapolis, USA, 2011
  • Browser Exploit Packs - Exploitation Tactics, ToorCon, Seattle, Washington, 2011
  • Art of Info Jacking - Detecting Hidden Devices, Source, Seattle, Washington, 2011
  • Spying on SpyEye Botnet - What Lies Beneath, Hack-in-the-Box (HitB), Amsterdam, Netherlands, 2011
  • Eye for and Eye - SpyEye Banking Trojan, ToorCon, San Diego, California, 2010
  • Web Maniac - Hacking Trust, Hacker Halted, Miami, Florida, 2010
  • The Art of Information Extraction, OWASP AppSec, Brazil, 2010
  • Bug Alcoholic - Untamed World of Web Vulnerabilities, OWASP AppSec, Irvine, California,USA, 2010
  • Scaling Web 2.0 Malware Infections, TRISC - Texas Regional Infrastructure Security , Grapevine, Texas, 2010
  • Untamed XSS Wars - Filters vs Payloads, RSA, San Francisco, California, 2010
  • Browser Design Flaws, Troopers, Munich, Germany, 2009
  • Web Psyschic 2.0, Excalibur , Wuxi, China, 2009
  • Rumbling Infections - Web 2.0 Malware Anatomy, SecurityByte - OWASP AppSec, New Delhi, India, 2009
  • Webnoxious 2.0 - Attacking Open End Web, FOSS (Free and Open Source Software), Bangalore, India, 2009
  • Vulnerability Vectors in PDF - Synthesizing PDF Attacks, EUSecWest, London, UK, 2008
  • Rolling Balls - Can You Hack Clients?, XFOCUS XCON, Beijing, China, 2008
  • KungFoo Jacking Browsers, XFOCUS XCON / XKungFoo, Beijing, China, 2008

Appearances

Recorded Talks and Interviews

Released Tools

Strafer: Ransomware Detection in Elasticsearch

Elasticsearch infections are rising exponentially. The adversaries are exploiting open and exposed Elasticsearch interfaces to trigger infections in the cloud and non-cloud deployments. During this talk, we will release a tool named "STRAFER" to detect potential infections in the Elasticsearch instances. The tool allows security researchers, penetration testers, and threat intelligence experts to detect compromised and infected Elasticsearch instances running malicious code.

Strafer@GitHub

Enfilade: Ransomware Detection in MongoDB

The cybercriminals are targeting exposed MongoDB instances and trigger infections at scale to exfiltrate data, destruct data,and extort money via ransom. We released a tool named "ENFILADE" to detect potential infections in the MongoDB instances. The tool allows security researchers, penetration testers, and threat intelligence experts to detect compromised and infected MongoDB instances running malicious code. .

Enfilade@GitHub

Melee: Ransomware Detection in MySQL

The cybercriminals are targeting exposed MySQL instances and triggering infections at scale to exfiltrate data, destruct data, and extort money via ransom. We authored a tool named "MELEE" to detect potential infections in MySQL instances. The tool allows security researchers, and threat intelligence experts to detect compromised and infected MySQL instances running malicious code.

Melee@GitHub

Sparty: Assessing Security of Sharepoint

Sparty is an open source tool written in python to audit web applications using sharepoint and frontpage architecture. The motivation behind this tool is to provide an easy and robust way to scrutinize the security configurations of sharepoint and frontpage based web applications.

Sparty@GitHub

Responsible Disclosure

Released Vulnerabilities: ICS CERT and Others

Intelligent Quotes

Albert Einstein

Education is what remains after one has forgotten what one has learned in school.

Stephen Hawking

I think computer viruses should count as life. I think it says something about human nature that the only form of life we have created so far is purely destructive. We’ve created life in our own image..

Season 8, Episode 22 - Baltimore.

Gibbs' Rule #35: Always watch the watchers.

Lou Holtz

Ability is what you're capable of doing. Motivation determines what you do. Attitude determines how well you do it.