In a dramatic change of pace, this week, host Zac takes the hot seat and tells all about his journey into infosec, his favorite techniques, and a story you won't want to miss.
Episode Summary
In Episode 11 of War Stories, the tables turn and host Zac Davis takes the guest seat. He talks about the path that led him to co-found SEVN-X, the hybrid cloud technique that keeps paying off on engagements, and a physical penetration test where he kept getting closer to the target while expecting to be shown the door.
Zac grew up in Minneapolis, studied at St. Cloud State, and came up through offensive security consulting before going independent during COVID. What started as him and a laptop, hiring friends as subcontractors, eventually grew into SEVN-X. His favorite technique targets organizations running hybrid Azure Active Directory: when on-premises Active Directory is synced to the cloud without careful planning, accounts and permissions meant to stay internal can end up exposed in ways many teams do not realize.
His war story is an early-morning physical test against an office high in a downtown tower. With a fake badge and an authorization letter in his pocket, Zac got escorted upstairs by the company's in-house security, who would not let him in but printed him a paper visitor badge. He stepped out for breakfast, came back after the lobby guard changed shifts with two pieces of evidence that he worked there, got buzzed up, and piggybacked with employees onto another floor. At that point, he was just trying to get kicked out.
In This Episode
- Zac Davis's path from Minneapolis and St. Cloud State to co-founding SEVN-X
- Going independent as a penetration tester and building a team
- Hybrid Azure Active Directory risks when on-premises AD is synced to the cloud
- Fake badges, visitor badges, and guard shift changes during physical testing
- Piggybacking through elevator and floor access controls in a multi-tenant building
Is Your Building Security as Strong as Your Network?
SEVN-X runs physical security assessments, cloud security assessments for hybrid Azure environments, and penetration tests that show where your defenses really stand. Talk with our team about scoping a test for your organization.
