Sessions calibrated to the audience. From a fifteen minute board update to a full day practitioner workshop, every engagement is written for the room and grounded in primary source material.
Each topic is available as a keynote, an executive briefing, or a workshop, and each is refreshed continuously as the underlying standards evolve.
A tour of where SBOM started, where it is today, and where the standards are taking it next. Covers CycloneDX, Cryptography Bill of Materials (CBOM), Artificial Intelligence Bill of Materials (AIBOM), Operations Bill of Materials (OBOM), attestations, and the Transparency Exchange API.
The EU Cyber Resilience Act (CRA) at the center, the U.S. federal baseline that survived the 2025 EO 14144 rollback, U.S. Food and Drug Administration (FDA) premarket cybersecurity guidance, and sector specific mandates. What they require, what they actually mean for engineering, and how to stay ahead of the deadlines.
A working session on what Annex I actually requires, broken into the secure by design pillar (Part I) and the Software Bill of Materials and vulnerability handling pillar (Part II). How to evidence each obligation using OWASP SCVS, CycloneDX (ECMA-424), Vulnerability Exploitability eXchange (VEX), and Dependency-Track. Calibrated to the September 2026 vulnerability reporting deadline and the December 2027 conformity assessment deadline.
Most SBOMs are produced, few are useful. A practical framework for evaluating generation, completeness, accuracy, context, and freshness, and for fixing the ones that fall short.
Lessons from a decade of production component analysis. What vulnerability management has actually learned, and what is still unsolved.
A briefing for non-technical leaders. What software supply chain risk is, why it is now a board concern, and the five questions directors should be asking their executive teams.
I present regularly at global industry conferences, OWASP events, government workshops, academic programs, and private customer gatherings. Recent examples include:
Tell me about the audience, the format, and the outcome you want attendees to leave with. I will respond with a tailored proposal, and I do read every request personally.