Leon Johnson · Privacy Red Team Lead at TikTok · 20+ years in offensive security
Security talks that are equal parts edge-of-your-seat and actionable. No death by PowerPoint. Real stories, live demos, and takeaways your team can use Monday morning.
Two recent panels on supply chain and AI security, alongside speakers from Red Hat, Thoughtworks, and the OWASP Global Board.
Each talk is tailored to your audience. These are starting points, not scripts. I also build custom CTFs and training programs from scratch.
AI is changing the speed and scale of attacks. I walk through real examples of AI-powered phishing, reconnaissance, and vulnerability discovery, drawing on my background in AI security research and the tools I build and use daily.
How AI tools change the pen testing workflow. From automated recon to AI-assisted exploit development. Live demos of tools I've built and use in real engagements, informed by hundreds of pen tests across every assessment type.
How attackers compromise the software you trust before it ever reaches your environment. I cover real supply chain attacks, the growing role of AI in both attacking and defending the pipeline, and what your team should be watching for.
The elevator that locked me between floors. The badge clone that worked a little too well. 20 years of breaking into companies means 20 years of things not going to plan. Your audience will laugh, cringe, and leave thinking differently about their own security.
Phishing, pretexting, physical infiltration. I've cloned badges, talked my way past front desks, and built phishing campaigns that bypassed every technical control. I show your audience exactly how it works and what makes people fall for it.
What happens when you test privacy controls at massive scale. Offensive privacy testing methodologies, the gaps most companies don't know they have, and what it takes to find them before regulators do.
Your CEO and your engineers should both walk away knowing exactly what happened and what to do about it. Here is a real AI security finding of mine, told both ways.
Next-Action header and an org id, even "bogus"Picture a gate with a serious guard: IDs checked, badges verified, the works. I spent an afternoon trying to get past that guard and couldn't. But the machine that cuts keys to the vault inside, where the customer data lives, was sitting outside the gate, and it didn't check anyone. I never went through the gate at all. I walked up to the key machine, got a key, and opened the vault. The fix took them one day: put the key machine behind the guard, so it checks who you are before it cuts anything.
What your audience takes home: the lock everyone reviews is rarely the one that fails. Attackers go where nobody looked. Read the full write-up →
The talk your attendees will be quoting in the hallway afterward. Real demos, real attack scenarios, real stakes.
Laptops open, code running. Your team leaves with working tools and a new way of thinking about security problems.
Behind closed doors with your leadership team. Your threat landscape, your blind spots, your action plan. NDA available.
Everything you need for the agenda and the promo, ready to copy.
Leon Johnson is the Privacy Red Team Lead at TikTok (USDS), where he leads offensive privacy testing and vulnerability research. He has spent more than 20 years breaking into companies, including 12 years as a principal security consultant at Rapid7, and has spoken at RSA Conference, Forrester Forums, and Security BSides.
Leon Johnson is the Privacy Red Team Lead at TikTok (USDS), where he leads offensive privacy testing and vulnerability research for TikTok's US Data Security initiative and co-discovered CVE-2026-28279 and CVE-2026-28280. Before TikTok he researched AI security threats at RunSybil, and spent 12 years as a principal security consultant at Rapid7 running penetration tests, red team engagements, and social engineering assessments. He created the Mr. Robot CTF, one of VulnHub's most popular challenges with more than 90 community writeups, and builds open source security tools and privacy-first software. Leon has spoken at RSA Conference, Forrester Forums, Rapid7 UNITED, and Security BSides.
Every talk is tailored to your audience, your industry, and your objectives. Tell me who's in the room and what keeps them up at night. I'll handle the rest.
Or write to
