Hey Adversary, I’ve Got a Human EDR Bypass for You

The talk opens with a warning about compliance dashboards. A low phishing click rate can convince leadership that staff are secure, but the speaker argues that repetitive, template-based training teaches people a fixed set of warning signs. An attacker who learns those signs can build lures that leave them out, treating the trained human reaction as a predictable control to work around.

The middle section covers reconnaissance and pretexting. In a grey-box engagement, a client can share its awareness vendor, campaign cadence and test difficulty, and public professional posts can hint at which product and version a company runs. People also carry habits from earlier jobs, so a pretext that mirrors a former employer's ticketing or HR messages may succeed during the onboarding window. The speaker describes isolating a target outside the office in a restricted area, where staff feel protected, using a cheap drone drop. A short bonus segment covers physically taking a laptop whose BitLocker setup lacks a pre-boot PIN, with a claim that bus sniffing could expose the key.

The closing argument is that awareness programs should act as behavioral sensors rather than multiple-choice exams. Practical measures include interrupt protocols that break an attacker's live pace and a no-fault reporting culture meant to shorten dwell time.