Enterprise security keeps failing in familiar ways. The Verizon 2026 Data Breach Investigations Report found that vulnerability exploitation overtook credential abuse as the top way attackers get in, while third parties were involved in nearly half of all breaches. Many of those doors were known, documented, and left open for years.
Enterprise security is the set of people, processes, and technology a large organization uses to protect its systems, data, and operations. We asked Johnny Xmas, Global Head of Offensive Security for a Fortune 200 manufacturing and agriculture corporation, why the same problems keep coming back, how to tell a tool problem from a process problem, and what the industry still has to get right.
One year after his first DefCamp, Johnny returns to Bucharest with “5 Lies Enterprise Security Still Tells Itself”.
From penetration testing to building an offensive security program
Nearly ten years ago, Johnny quit full-time penetration testing out of sheer boredom. Company after company, he found the same weak passwords, the same unpatched servers, and the same attack paths. Today he leads offensive security for a global critical infrastructure organization, covering penetration testing, red teaming, and adversary simulation. So what brought him back to the offensive side?
A red team simulates a real adversary over weeks or months to test how well an organization detects and responds to an attack, while the blue team is the group defending against it.
I didn't come back to pen testing. I came back to the Red Team to build out an entire Offensive Security Program for a global critical infrastructure organization. I'm not back in a chair at 3 am using the same old exploits and attack chains at company after company; I'm at a place where that garbage work is long behind them, they've built up mature defenses, and they're ready for deep, intelligent, long-term engagements that more closely mimic adversarial campaigns. Being internal also allows me to work long-term with the Blue Team to develop robust, effective defenses against advanced adversarial behaviors instead of tossing a report over the fence and hoping they know what to do with it.
Why a finding is not a fix
As an outside tester, Johnny could hand over a report and move on to the next client. Now he sits inside the organization that has to act on those reports, with its budgets, legacy systems, and change approvals. That view changes how a vulnerability looks. Johnny has learned that the answer to “why is this still broken?” is rarely what testers assume.
"Why is this still broken?" is almost never laziness. It's a budget cycle, an app developer who left in 2011, a change window three teams have to agree on.... The bigger shift is that a finding is not a fix, so I now spend more time on how it gets packaged into governance than on the finding itself. Being excited over a finding is like a toddler being excited over a shiny rock. The real satisfaction comes from not only having the vulnerability remediated, but in working to develop a policy and controls that ensure the vulnerability can never happen again.
The 80% of enterprise security tools nobody budgets for
Large companies spend heavily on security platforms, and many still get breached through systems those platforms were supposed to watch. Johnny’s DefCamp talk argues that the tool is rarely the real problem. What fails is everything that has to happen after the purchase order is signed. So how can a team tell whether it needs a better tool or a better way of using the one it has?
Buying the tool is 20% of the cost, and skipping the other 80% (ownership and detection engineering and runbooks and exercises and... literally any workflow) is why the breach happens. The best part is that you can determine that other 80% before you ever buy the product. If you know you can't accomplish that development, then you know buying the product will be a waste of time and money.
What the TSA master keys taught him about security research
In 2014, a newspaper photo showed the full set of master keys the US Transportation Security Administration uses to open “TSA-approved” luggage locks. Johnny was part of the research into those leaks, which he later presented at the HOPE hacker conference, and by 2015 3D-printable copies were circulating online, putting hundreds of millions of travel locks at risk. The story traveled far beyond the security community. Yet the lesson Johnny wanted people to take away barely made it into the headlines.
Public key infrastructure (PKI) is the system of certificates and trusted authorities that secures much of the internet, and it only works if the central authority stays secure.
The reversing of the key design was the easy part. I said at the time it was a great metaphor for how PKI doesn't work when the central authority is insecure, and that I feared the metaphor wouldn't reach the public, and it didn't. So now I decide the message before I publish, write it so a non-technical person can repeat it in a sentence, and assume the press will run with the shiniest fifteen seconds.
One change security leaders can make tomorrow
Risk acceptance is the formal decision to live with a known vulnerability, usually because fixing it costs more than the damage it could cause. Done well, it is a healthy part of any security program. Done badly, it becomes a filing cabinet of forgotten problems that nobody owns. Johnny’s fix costs almost nothing, apart from a few awkward meetings.
Query every accepted risk with no expiration date or older than twenty-four months, then reassign or close all of them. I still see risks accepted in 2014 sitting there as accepted in 2026, signed by "IT" or "Security", neither of which is an owner. Costs nothing but a week of uncomfortable meetings, and creates a KPI that actually forces meaningful change by way of someone having to acknowledge that they, personally, agree to accept this risk and stamp their name on it, or actually finally add the remediation as a project.
What enterprise security still has to get right
After more than two decades in IT, Johnny has watched entire generations of security products come and go. Some problems, though, never seem to leave. The very first control in the CIS Critical Security Controls is simply knowing which devices are connected to your network, and many organizations still cannot answer that question. For Johnny, the industry’s biggest gaps are maintenance and the people it overlooks.
Maintenance. We are excellent at buying and terrible at keeping, and we still cannot do asset inventory, which is control number one in every framework ever written. Second, we ignore entry-level people with no certifications and degrees, then act surprised when the good supply chain find comes from a hobbyist with no formal background.
Johnny knows that last point well. At DefCamp 2025, his talk “Poisoning Pidgins in the Park” showed how he uncovered a supply-chain attack and why the wider community, students and hobbyists included, plays a crucial role in catching them. It is also why events open to newcomers matter as much as any certification.
Why Johnny is coming back to DefCamp
Johnny is a familiar face in Chicago’s security scene, where he sits on the board of the BurbSec community and co-organizes the BSides312 conference. He spoke at DefCamp for the first time in 2025, and the conversations he had in Bucharest stayed with him long after the flight home. Students, researchers, and government officials all shared what cybersecurity means for a country on Europe’s edge. For Johnny, the reason to return comes down to the people he met.
The Romanians. I have spent the past year regularly retelling the stories I heard from the attendees, both students and government officials, over the very real and life-altering work Romania, as a country and culture, is desperately trying to accomplish from a cybersecurity perspective. Romania's unique physical positioning between Europe and the Middle East presents challenges that nearly no other country on Earth has to deal with, and meeting people who put so much passion behind cybersecurity because it literally means the defense of their own home was so incredibly humbling to be able to sit and listen to.
Meet Johnny Xmas at DefCamp 2026
Want to know which comfortable stories your security program might be telling itself? Catch “5 Lies Enterprise Security Still Tells Itself”, Johnny Xmas’s talk at DefCamp 2026.
You can learn from new research, meet attendees from more than 50 countries, and compare notes with the specialists who defend organizations every day.
