FWD:CLOUDSEC2025 Conference Talks

What's Included

• Full Talk Summaries: 43 video summaries
• Technical Implementation Details: Concrete guidance, examples, services mentioned, and actionable steps from each talk
• Video Links: Direct access to original presentations on YouTube

Table of Contents

• AI/ML Security (7 talks)
• Identity & Access Management (15 talks)
• Threat Hunting & Detection (3 talks)
• Attack Techniques & Vulnerabilities (3 talks)
• Cloud Infrastructure & Architecture (13 talks)
• Intro and Conclusion (2 talks)

---

AI/ML Security

• Breaking AI Agents Exploiting Managed Prompt Templates to Take Over Amazon Bedrock Agents
• Bypassing AI Security Controls with Prompt Formatting
• Challenges around AI as a Service logging
• Double Agents Exposing Hidden Threats in AI Agent Platforms
• Farewell False Positives Building Trustworthy AI for IaC Analysis
• Inside Microsofts Battle Against Cloud Enabled Deepfake Threats
• Taming LLMs to Detect Anomalies in Cloud Audit Logs

Identity & Access Management

• ECS cape Hijacking IAM Privileges in Amazon ECS
• Happy Little Clouds Painting Pictures with Microsoft Cloud and Identity Data
• I SPy Rethinking Entra ID research for new paths to Global Admin
• IAM Roles Anywhere now for everyone with Lets Encrypt
• No IP No Problem Exfiltrating Data Behind IAP
• Not So Secret The Hidden Risks of GitHub Actions Secrets
• Putting Workload Identity to Work Taking SPIFFE past day 0
• Rebuilding ROADRecon for the Modern Entra Environment
• Securing Remote MCP Servers
• Staying Sneaky in the Office 365
• The Duplicitous Nature of AWS Identity and Access Management IAM
• The False Sense of Security Defense Becoming a Vulnerability
• Trust Issues What Do All these JSON files actually mean
• What would you ask a crystal ball for AWS IAM
• When Your Partner Betrays You Trusted Relationship Compromise In The Cloud

Threat Hunting & Detection

• Detecting the Undetectable Threat Hunting in Appliance Environments
• Patience brings prey lessons learned from a year of threat hunting in the cloud
• What Do You Mean Resource Not Found Demystifying GCP Error Codes for IR and Detections

Attack Techniques & Vulnerabilities

• Defenders hate it Compromise vulnerable SaaS applications with this one weird trick
• The Good the Bad and the Ugly Hacking 3 CSPs with 1 Vulnerability
• whoAMI Discovering and exploiting a large scale AMI name confusion attack

Cloud Infrastructure & Architecture

• Beyond the Big Three Mastering Oracle Cloud Security in a Multi Cloud World
• Challenges implementing egress controls in a large AWS environment
• Data Perimeter Implementation Strategies Lessons Learned Rolling Out SCPs RCPs
• I Didnt Register for This Whats Really in Googles Artifact Registry
• Introducing GRC Engineering A New Era of AWS Compliance
• Inviter Threat Managing Security in a new Cloud Deployment Model
• Keeping your cloud environments secure during a merger or acquisition
• Logs dont mean a thing Unraveling IaC Managed Identity Ownership
• Securing organizations ML and LLMops deployments A platform architects journey onboarding LLM
• Shared GPU Security Learnings from Fly.io
• The Good The Bad and The Vulnerable Breaking Down GCP Tenant Projects
• This Wasnt in the Job Description Building a production ready AWS environment from scratch
• You Are Not Netflix How to learn from conference talks

Other Resources

Want to dive deeper into cloud security topics covered in these talks? Check out our hands-on Cloud Security training at Cybr.