About

Karl
Fosaaen

Security Leader & Operator
Team Building & Leadership
Service Line Development
Cloud & Azure Security
Security Consulting
CISSP · GXPN · Security+
Portland, OR

I've been a leader at NetSPI for the last 14 years, helping the company grow from 20 employees to over 500. During that time, I've gained experience across every department, starting as an individual contributor executing penetration tests, through to assessing acquisition targets and leading research and development efforts.

For the last decade, I've focused my research on cloud security, specifically Azure. I've written dozens of blog posts, co-authored a book, and built open-source tools. In my current role, I help oversee R&D at NetSPI, working with our teams to develop new service lines and product capabilities.

20 → 500+ Employees

Been part of NetSPI's growth from a small firm to a 500+ person industry leader over 14 years.

Published Author

Co-authored Penetration Testing Azure for Ethical Hackers (2021) and authored 70+ blog posts on security topics.

Industry Recognition

Named to Microsoft's Most Valuable Researcher list and Wiz's Top 16 Cloud Security Experts (2023).

40+ Conference and Security Group Talks

Presented at DEF CON, DerbyCon, fwd:cloudsec, BSides, and more, including 5 times at the DEF CON Cloud Village.

Leadership

I've worn a lot of hats at NetSPI over the years. Here are some of the things I'm most proud of.

01

Founded the Portland Office

I founded NetSPI's Portland, OR office, opening our physical space in 2019. By 2021, the team had grown enough that we doubled the office footprint. The office has been recognized in The Oregonian's "Oregon Top Workplace" list in both 2024 and 2025.

02

Built the Cloud Penetration Testing Practice

I created and managed NetSPI's Cloud Penetration Testing service line from scratch, including training curriculum, processes, and deliverable templates. Within four years it became one of the highest revenue-producing services at the company.

03

Driving R&D & Service Innovation

As VP of Research, I lead a distributed team developing new service lines and product innovations, including launching the AI Penetration Testing service line and creating the Azure Breach & Attack Simulation service with 100+ MITRE ATT&CK-mapped scenarios.

04

Growing the NetSPI Blog

As executive editor for NetSPI's technical blog, I've helped grow it into one of the more widely-read resources in the offensive security space.

05

Consultant Development & Career Programs

As a Managing Consultant, I helped develop NetSPI's career roadmap program and revamped the quarterly bonus program to incentivize growth. I've mentored numerous consultants who have since become leaders at the company.

06

14+ Years of Progressive Leadership

I've gone from Security Consultant to VP at the same company over 14 years, managing teams at every level along the way, including remote, distributed, and international resources.

Experience
NetSPI
Vice President, Research
Nov 2022 – Present
  • Leading R&D efforts, coordinating with Services and Development teams to create innovative solutions
  • Executive editor for NetSPI's technical blog
  • Created the Azure Breach & Attack Simulation service line with 100+ MITRE ATT&CK-mapped scenarios
  • Partnered with the AI Penetration Testing team to launch the service line
  • Managing vulnerability disclosures, QA, and mentorship for the research team
NetSPI
Senior Director
Apr 2022 – Nov 2022
NetSPI
Practice Director
Apr 2018 – Apr 2022
  • Created and managed the Cloud Penetration Testing service line, growing it to one of the highest revenue-producing services within 4 years
  • Managed cloud testing training curriculum, service line processes, and deliverable templates
  • Directly managed service line leaders for Social Engineering and External Penetration Testing
NetSPI
Managing Consultant
Mar 2015 – Apr 2018
  • Managed multiple direct reports including remote and in-office resources
  • Developed and implemented NetSPI's career roadmap program for consultant development
  • Revamped the quarterly bonus program to incentivize growth and development goals
NetSPI
Senior Security Consultant
Jul 2013 – Mar 2015
NetSPI
Security Consultant
Oct 2011 – Jul 2013
Assurity River Group
Information Security Consultant
Jun 2009 – Sep 2011
LarsonAllen
Information Security Services Intern
Apr 2008 – Feb 2009
Speaking

I've done over 40 speaking engagements at security conferences and local security groups. A selection of recorded talks is featured below.

Identity Theft Is Not a Joke, Azure!
HIPConf24 · 2024
Identity Theft Is Not a Joke, Azure!
What the Function: A Deep Dive into Azure Function App Security
BSides PDX · 2024
What the Function: A Deep Dive into Azure Function App Security
With Thomas Elling
Extracting All the Azure Passwords
DEF CON 29 · Cloud Village · 2021
Extracting All the Azure Passwords
Adventures in Azure Privilege Escalation
DerbyCon 9 · 2019
Adventures in Azure Privilege Escalation
Escalating Privileges with Azure Function Apps
NetSPI Webinar · 2023
Escalating Privileges with Azure Function Apps
Speaking to a City of Amazon Echoes
BSides PDX · 2017
Speaking to a City of Amazon Echoes

Additional conference recordings and engagements available on request.

Research & Publications
Book
Penetration Testing Azure for Ethical Hackers
Co-authored with David Okeyode · Packt Publishing · 2021
A practical guide to Azure penetration testing co-written with David Okeyode. The book walks through the Azure platform architecture, common attack paths, and hands-on techniques for identifying and exploiting misconfigurations. It includes working scripts and source code, and is aimed at penetration testers looking to build Azure skills as well as defenders who want to understand how attackers approach cloud environments.
Toolkit
MicroBurst — Azure Security Toolkit
Creator & Maintainer · 2,300+ GitHub stars · 335 forks · 15 contributors · GitHub / NetSPI
MicroBurst is an open-source PowerShell toolkit I built for testing and assessing Microsoft Azure environments. It's picked up over 2,300 stars on GitHub and is used regularly by penetration testers and red teams. The toolkit covers Azure services discovery and enumeration, configuration auditing, credential dumping, privilege escalation and lateral movement, and post-exploitation persistence. Modules are organized across the Az, AzureAD, AzureRM, MSOL, and REST interfaces.
CVE
CVE-2021-42306 — Azure Active Directory Information Disclosure ("CredManifest")
Azure AD · Disclosed 2021
I discovered that unprotected private key data, uploaded as an authentication certificate keyCredential for Azure Automation Account "Run As" Service Principals, could be read by any user in the tenant. In most tenants, this would allow any domain user to have full write access on all Azure resources in the tenant.
CVE
CVE-2019-0962 — Azure Automation Elevation of Privilege Vulnerability
Azure Automation Accounts · Disclosed 2019
I identified an elevation of privilege vulnerability in Azure Automation runbooks that allowed contributors to potentially access Key Vault secrets through a runbook, even when those members had no direct access to the Key Vault.
Blog
NetSPI Blog — Azure & Cloud Security Research
70+ articles on Azure and cloud security · netspi.com · 2011 – Present
Training
Dark Side Ops: Azure — Training Course
Creator · Delivered to hundreds of students through public and private offerings
I created this hands-on offensive Azure security training course, delivering it to students covering advanced attack techniques against Microsoft Azure environments.
Research
Microsoft Azure Threat Research Matrix (ATRM)
Contributor · Microsoft · aka.ms/atrm
I contributed to Microsoft's Azure Threat Research Matrix, a framework for cataloguing attack techniques targeting Azure environments.
MSRC
Microsoft Security Response Center — Vulnerability Reports
20+ vulnerability reports submitted · Azure platform · 2019 – Present
I've submitted 20+ vulnerability reports on potential Azure security issues via MSRC since 2019, covering a range of services and attack surfaces across the platform.
Recognition
2024
Microsoft Most Valuable Researcher
Named to Microsoft's Most Valuable Researcher list in 2024 for Azure security research and vulnerability disclosure work.
2023
Wiz Top 16 Cloud Security Experts
Listed in Wiz's "Top 16 cloud security experts you should follow in 2023" for my work in Azure offensive security and research.
2024 & 2025
Oregon Top Workplace — The Oregonian
NetSPI's Portland office was recognized in The Oregonian's "Oregon Top Workplace" list in both 2024 and 2025.
2013
GXPN · CISSP · Security+
I hold the GIAC Exploit Researcher and Advanced Penetration Tester (GXPN), Certified Information Systems Security Professional (CISSP), and CompTIA Security+ certifications.
Contact

Let's connect.

Feel free to reach out about security, research, or anything else.

LinkedIn linkedin.com/in/karl-fosaaen GitHub github.com/kfosaaen X @kfosaaen Bluesky @kfosaaen.bsky.social