Andrzej Dyjak

Andrzej Dyjak has spent more than 20 years in cybersecurity on both sides of the fence: first breaking software as a vulnerability researcher and penetration tester, then designing how large organizations build it securely. That double perspective is the point: he knows how an attacker finds the gap, and he knows which process, pipeline check or architecture decision closes it.

He started as an independent researcher, reporting vulnerabilities through the Zero Day Initiative, vulnerability contributor programs and direct vendor coordination. Over the years he has been credited with dozens of CVEs in products from Apple, Google, Oracle, Adobe, Mozilla and RealNetworks, among them memory corruption bugs in QuickTime, Shockwave Player, RealPlayer and Chrome’s Blink engine. In 2019 alone, Oracle credited him with 15 CVEs in its July and October Critical Patch Updates. Professionally he worked as a summer research intern at MWR InfoSecurity in the UK, as a Security Specialist at Secunia in Copenhagen and as a Security Researcher at the Greek vulnerability research company CENSUS. Fuzzing, reverse engineering and exploit development were his daily work: at CONFidence 2015 he showed how to use DTrace for dynamic analysis on OS X, and at WarCon 2017 he presented “Interpreters Under Pressure” on fuzzing language runtimes with honggfuzz and radamsa. His tools and results from that time are still on GitHub (dtrace-tools, osx-syscalls-list, interpreter-bugs).

From offense he moved into building security in. He was Senior Security Consultant at IMMUSEC, Security Architect at Centralny Ośrodek Informatyki, the Polish government’s central IT centre, and from 2019 to 2022 Software Security Architect at ERGO Technology & Services, the IT arm of the ERGO insurance group. Since 2018 he has also been Principal Security Consultant at REDTEAM.PL. In 2020 he founded Bezpieczny Kod (“secure code”), a Warsaw consultancy focused on one thing: security of the software delivery process. There he designs Secure SDLC programs for enterprises in finance and insurance, and with his team builds threat modeling, DevSecOps and Security Champions practices, for example at BNP Paribas Bank Polska and the fintech XTB, and audits SDLC maturity against DORA, NIS2 and the CRA. His working toolbox is built on recognized standards rather than a house method: OWASP SAMM, ASVS and WSTG, NIST SSDF, STRIDE, and SAST, DAST and SCA wired straight into CI/CD.

Teaching runs through all of it. He created the online programs “Ofensywne Testowanie Web Aplikacji” (offensive web application testing with Kali Linux, ZAP, nmap and the OWASP Top 10, ASVS and WSTG) and “ABC DevSecOps” (security automation in CI/CD pipelines), and more than 1,500 engineers from companies such as Orange, BNP Paribas, XTB and Grupa Pracuj have completed Bezpieczny Kod trainings. He has been a trainer at Bottega IT Minds since 2019, a guest lecturer at Coventry University Wrocław and at the Polish Naval Academy in Gdynia, and hosts the Bezpieczny Kod podcast and YouTube channel on security for software teams. Since 2021 he has been Track Director for “Security in Software Development & DevSecOps” at The Hack Summit, and he sits on the IT Security track committee of Warsaw IT Days. He holds the OSCP, OSWP and eCRE (eLearnSecurity Certified Reverse Engineer) certifications.

At letsboot he teaches Agentic Attack & Defense, Agentic Red Teaming, Agentic Blue Teaming and Defense in the Age of Agentic Attacks: how AI agents change the way systems get attacked, and how engineering teams build the threat models, pipeline controls and detection that keep up with them.