iCONIC 2026 | From Assets to Adversaries: Building a Pen Testing Program
Multi-factor authentication (MFA) is a vital line of defence against account and identity compromise, but not all types of MFA protect against phishing. During this hands-on and controlled demo, penetration tester / ethical hacker Kurt Pomeroy will reveal how hackers utilize adversary-in-the-middle phishing to hijack a Microsoft 365 logon, steal the MFA-verified session, and gain access to the account (without knowing the password). Audience members will get to experience the attack from both the target’s and hacker’s viewpoints, learn about the warning signs, and walk away with practical tips on how to safeguard their organization using phishing-resistant authentication. No technical background is necessary.
"Kurt is a seasoned IT professional with 25+ years of experience in the industry. During that time, he has worked in various roles ranging from End User/Desktop/Network support to Systems Administration and IT/Data Management. Before joining iON, he worked in the Oil & Gas sector for seven years. His most recent role in that sector was with ExxonMobil, where he managed services and coordinated IT initiatives for hundreds of offshore platform personnel and thousands more users around the world.
After a prolific career as an IT generalist, Kurt successfully transitioned into the role of Cybersecurity Specialist, performing Penetration Tests and Security Assessments as a key member of iON’s Assessment Services team since late 2018. He was promoted to Team Lead – Security Advisory Services in 2023 and Principal Consultant, Offensive Security in 2024.
Kurt has a wealth of experience in penetration testing in IT and OT environments (both physically and virtually) and has performed numerous assessments for some of the largest oil and gas organizations in the world. His careful, methodological, and detail-oriented work, focusing on identifying not only security risks but their business impacts, in some of the most sensitive IT and OT networks has earned him a stellar reputation as Western Canada’s top-performing cyber-security employee."