An Attack Vector is just a Vector, too
My Day-to-Day Work as a Former UNITS Student
Context
As part of the event 15 Years of UNITS - Corporate and IT Security in Theory & Practice on April 16, 2026, I, as a former student at Offenburg University of Applied Sciences, had the opportunity to provide insight into my current work as an IT security consultant at cirosec. The presentation was aimed at students, faculty, and professionals in the field and highlighted how offensive and defensive approaches to IT security have evolved in recent years.
The presentation was not recorded.
Abstract
Modern IT security is no longer just about individual vulnerabilities or spectacular exploits. Instead, attack vectors involve a complex interplay of technology, organization, and human behavior. In this presentation, I shared a personal retrospective on my journey from an Corporate and IT Security student to a consultant at cirosec and highlighted the issues that truly occupy us in our day-to-day work.
Using the Unified Cyber Kill Chain as a starting point, I discussed current challenges in reconnaissance, social engineering, and exploitation. The focus was particularly on two developments:
- Browser Extensions as an Attack Vector: Despite the release of Manifest v3, browser extensions remain realistic and completely underestimated attack tools. Restrictions such as limited background scripting, sandboxing, or supposedly removed network APIs can be circumvented using the Alarms API, Scripting API, or the still-trivial access to browser cookies. The attack evolves from classic phishing through cookie theft to the targeted installation of manipulated extensions.
- Supply Chain Attacks: With the rapid adoption of DevOps and cloud environments, supply chain vulnerabilities are more relevant than ever. While specialized tools can help, traditional measures such as least privilege, microsegmentation, monitoring, and sound risk management ultimately remain the most effective safeguards.
In the concluding section, I addressed the marketing hype machine: AI security is often not truly AI, zero-trust solutions are often just fancy firewalls, and secrets scanners simply rely on Regex on a large scale. In the end, the key takeaway is this: An attack vector is just a vector, too - and can be managed with the right combination of technology, processes, and people.