Most breaches start with a login. I work on the login.

What I work on

Identity for humans and machines: OAuth and OIDC, FAPI 2.0, token exchange, DPoP, workload identity federation, and what “authorized” should mean when the caller is an agent.

At Descope I built the security and compliance program from zero: SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, CSA STAR Level 2, and FedRAMP High in under six months. Led the nOAuth disclosure, an Entra ID misconfiguration that allowed account takeover across thousands of SaaS apps. Hold a US patent on CAN bus intrusion detection.

Open source

• verity
  Signed, SBOM-attested, Wolfi-based container images with FIPS flavors, plus Squawk for continuous CVE monitoring
• opencode-plugin-langfuse
  Tracing for OpenCode agents
• vscode-acp
  Agent Client Protocol in VS Code
• dbot
  1,100+ XSOAR integrations as MCP tools, no XSOAR required
• paseo-plugins+paseo.cafe
  Plugins and a community directory for the Paseo agent orchestrator
• BurpJDSer-ng
  Java deserialization for Burp
• Honeycomb
  Extensible honeypot framework, DEF CON 26
• The other hundred and twenty repos are at github.com/omercnet and github.com/tektum.

Elsewhere

1. 2026Security Boulevard · ArticleAgentic AI doesn’t eliminate humans. It moves them to the only place that matters.
2. 2026InformationWeek · PodcastHandling vendor-triggered compliance issues
3. 2025SC Media · ArticleStop treating core security features like SSO as premium luxuries
4. 2024Help Net Security · InterviewReducing credential complexity with identity federation
5. 2023Dark Reading · Article4 pillars for building a responsible cybersecurity disclosure program

Talks and community

DEF CON, Black Hat Asia, DefCamp, Agent Conference NYC, and whatever BSidesTLV needs that year. Former volunteer EMT with Magen David Adom.

Off the clock

Off the clock I fly. Private pilot, current, and a cockpit is the one place nobody can page you. Before that it was 996 skydives with a camera on my helmet, and a few years on sport bikes. Married, two kids, one cat.

Advisory

I take on a handful of advisory and incident response engagements a year. If you have something worth a conversation, email me.