Media & speaking.
Keynotes, conference sessions, podcast appearances, and writing — across attacker engineering, fraud intelligence, and FT3. Newest first.
When Both Sides Have Agents: Attacker Engineering at Machine Speed
The next attacker may not need to break in. In agentic systems, an action can be permitted—and still adversarial. This is not a talk about asking an LLM to just threat model.
Fraud Intelligence Beyond the Transaction
Team Cymru’s fraud-intelligence page quotes Vincent Passaro on where fraud is built versus where it is monetized — “Fraud is monetized in payments. It is built everywhere else.” — and highlights FT3 / FT3 2.0 as shared language for defenders.
Simple and Complex Environments - A Service Provider's Perspective
In this talk, Stripe will share practical observations from the field describing “simple” environments where merchants rely largely on service providers for payments processing and contrast those with “complex” environments that directly contact or retain card data.
AI Hackathon
Sponsored by Anthropic and Team Cymru. A hands-on hackathon that picked up where the Zero to Hero training ended: threat hunters and investigators applied it to track real-world threat and fraud actors.
Zero to Hero: Threat intelligence with Claude Code & Scout
A hands-on workshop where defenders will leverage Claude Code + the Pure Signal Scout MCP to conduct a real threat intelligence investigations, using live Team Cymru data in a TLP:RED environment.
Stop Fraud Earlier: Spotting Attack Patterns in Threat Intelligence
Team Cymru credits FT3, the fraud taxonomy created by Vincent Passaro at Stripe, and notes support as it evolves into FT3 2.0 — in a post on spotting attack patterns before the transaction.
FT3 Evolution: From Static Classification to Living Agentic Framework
This session will provide a builder’s view of how fraud intelligence must evolve as adversaries use AI to accelerate their tactics. The next evolution is making that language operational, adaptive, and usable inside real investigative and intelligence workflows.
FT3: The Industry's First Agentic ATT&CK-Style Matrix
FT3 brings an ATT&CK-style model to fraud defense. This session breaks down how it actually gets operationalized, from classifying fraud behavior to building workflows teams can act on at scale.
A Charge to the Defender Community
Opening keynote on the power of the defender community and the responsibility of being in the room. The talk welcomed attendees on behalf of Stripe Security and centered on a simple idea: everyone present had the opportunity to change an outcome for the better.
Zero to Hero: Threat intelligence with Claude Code & Scout
A hands-on workshop where defenders use Claude Code and the Pure Signal Scout MCP to run real threat intelligence investigations.
Fraud Fighters United with MITRE F3
CTID’s launch post for MITRE F3 explains the seven-tactic model and links the Design Principles and Methodology — the same document that cites Stripe FT3 among F3’s Sources of Information.
MITRE F3 Design Principles — Sources of Information
MITRE CTID’s F3 methodology lists Stripe Fraud Tools Tactics and Techniques (FT3) among the prior frameworks it analyzed and fused under Sources of Information, with a link to the FT3 GitHub repo.
MITRE F3 Design Principles and Methodology (PDF)
Standalone PDF of MITRE F3 Design Principles and Methodology. Section 4.1.2.1 Sources of Information lists Stripe Fraud Tools Tactics and Techniques (FT3) among prior frameworks F3 analyzed and fused. Kept for historical capture if the web page or PDF URL changes.
MITRE’s Center for Threat-Informed Defense Launches Framework to Combat Financial Fraud
MITRE announces the Fight Fraud Framework (F3), a first-of-its-kind behavior-based model of cyber-enabled financial fraud tactics and techniques, released through CTID with member collaboration.
Outside-In: Rethinking External Threat Detection When AI Changes Everything
A Piper Sandler Cybersecurity CEO Summit session with Vincent Passaro and Team Cymru CEO Joe Sander on how AI is reshaping external threat detection, fraud intelligence, and internet-scale visibility.
From Developer to Product Owner: The Fundamental Shifts from Generative AI
Team Cymru’s Jeremy Bender writes up Vince Passaro’s Future of Threat Intelligence conversation on generative AI shifting engineers from developers to product owners — and the productivity, risk, and workflow implications.
Two Minds, One Reframe: A Shift That Won't Wait
Past the hype: security practitioners are becoming owners of outcomes, not just builders of tools. Explore how analyst judgment, agentic workflows, and product thinking can help small teams move problems that once felt too complex, too slow, or too expensive to solve.
Fraud Intelligence at Stripe: Inside the Financial Fraud Kill Chain
Learn how Stripe’s Vincent Passaro applies fraud intelligence to the financial fraud kill chain, breaking down account takeover and how to proactively defend.
The Butterfly Effect
Using the butterfly effect as a metaphor, this keynote explored how trust, permission, and presence can shift complex systems in unpredictable ways, and how community gives legitimacy a path to travel.
Fighting Fraud with FT3
FT3 gives fraud defenders a common language to classify attacker behavior, connect patterns across cases, and turn isolated investigations into reusable operational intelligence.
Arrival of FT3 (Fraud Tools Tactics and Techniques)
FT3 reaches one of the field’s most trusted global defender communities: Underground Economy. The talk presented Fraud Tools, Tactics, and Techniques as a shared framework for defending the financial ecosystem.
Fighting Fraud with FT3
FT3 gives fraud defenders a common language to classify attacker behavior, connect patterns across cases, and turn isolated investigations into reusable operational intelligence.
Evolution of FT3 (Fraud Tools Tactics and Techniques)
FT3 becomes a bridge across fraud, threat intelligence, and security operations. Session explores how shared language reduces translation loss and turns pattern recognition into operational leverage.
FT3 (Fraud Tools Tactics and Techniques)
FT3 evolves from concept into structure. The talk explored how fraud tactics, techniques, and workflows could be mapped with enough precision to support shared reasoning and defensive action.
Introducing FT3: Common Language for Fraud
FT3 began as an early field signal: fraud needed a common language. The talk introduced the case for a framework that could help defenders classify behavior, compare patterns, and move beyond isolated casework.
Security Hardening with Ansible
Linux Journal covered Aqueduct as open-source hardening infrastructure for RHEL6 systems, showing how its STIG scripts could be deployed with Ansible across a high-performance compute cluster.