Back to Talks 2025
Keynote

KEYNOTE: Attack Surface in Motion: Why Today’s Threats Don’t Knock First

Recon Village @ DEF CON 338th, 9th and 10th August 2025

Abstract

Over the past decade and a half, the tactics of threat actors have quietly but fundamentally transformed. What began as slow, targeted intelligence gathering has evolved into automated, scalable exploitation of exposed assets-often before defenders even notice. In this keynote, we’ll trace the journey of threat actor innovation, highlighting shifts in recon methods, asset targeting, and speed of attack. We’ll dissect common attack surface mistakes that open the door for breaches, especially in the last couple of years, and challenge assumptions around visibility and control. The attack surface is always in motion-are you keeping up?

Speaker

Muslim Koser
Muslim Koser

Vice President , Engineering EASM @ Fortinet

Muslim has over 25 years of Information Security Experience with a core focus on Cyber Threat Intelligence, Cyber Risk Management, and Cybersecurity consulting. Before Volon & Fortinet, he worked at FireEye Inc. where he headed one of their Cyber Threat Intelligence Research team. Muslim set up the Cyber Threat Research team for iSIGHT Partners in India, which was one of the first teams to work in this domain. Muslim has also been a member of the Honeynet Project as well as the Indian Honeynet Chapter and involved in Detux Sandbox, which was one of the first online Linux sandbox services. As part of the Honeynet project, Muslim was also involved in the design of the open-source spam Honeypot SHIVA. Previously, Muslim was based in Malaysia, where he led the information security consulting practice for Network Security Solutions. Muslim is also credited with involvement in establishing national-level CERTs and consulting for various corporate CSIRTs.

View full speaker profile →