Speaking
From attacker engineering and fraud to intelligence, AI, and the future of defense, I bring perspectives together that are too often considered separately. My goal isn’t simply to share what I know. It’s to change how the room thinks about what’s possible.
Spoken at and covered by
Recent talks
Attacker engineering
How adversaries build, test and scale operations, and how defense changes when they run AI agents.
Fraud intelligence and frameworks
Fraud intelligence built for agentic commerce, with FT3 as a taxonomy that works at machine speed.
Security from every seat
Offense, incident response, compliance and threat intelligence, from someone who has worked each one.
Full record
November 2026
When Both Sides Have Agents: Attacker Engineering at Machine SpeedEvent page (opens in a new tab)San Francisco, CA
The next attacker may not need to break in. In agentic systems, an action can be permitted—and still adversarial. This is not a talk about asking an LLM to just threat model.
Talk
September 2026
- Fraud Intelligence Beyond the TransactionRead the article (opens in a new tab)
Team Cymru’s fraud-intelligence page quotes Vincent Passaro on where fraud is built and where it is monetized, and highlights FT3 and FT3 2.0 as shared language for defenders. “Fraud is monetized in payments.
Press coverage
Simple and Complex Environments - A Service Provider's PerspectiveEvent page (opens in a new tab)North America Community Meeting · Vancouver, BC
In this talk, Stripe will share practical observations from the field describing “simple” environments where merchants rely largely on service providers for payments processing and contrast those with “complex” environments that directly contact or retain card data.
Talk
AI HackathonEvent page (opens in a new tab)
StrasbourgSponsored by Anthropic and Team Cymru. A hands-on hackathon that picked up where the Zero to Hero training ended: threat hunters and investigators applied it to track real-world threat and fraud actors.
HackathonTLP:REDClosed session. Not recorded or shared.
Zero to Hero: Threat intelligence with Claude Code & ScoutCourse detailsEvent page (opens in a new tab)
StrasbourgA hands-on workshop where defenders will leverage Claude Code + the Pure Signal Scout MCP to conduct a real threat intelligence investigations, using live Team Cymru data in a TLP:RED environment.
TrainingTLP:REDClosed session. Not recorded or shared.- Stop Fraud Earlier: Spotting Attack Patterns in Threat IntelligenceRead the article (opens in a new tab)
Team Cymru credits FT3, the fraud taxonomy created by Vincent Passaro at Stripe, and notes support as it evolves into FT3 2.0 — in a post on spotting attack patterns before the transaction.
Press coverage
June 2026
FT3 Evolution: From Static Classification to Living Agentic FrameworkEvent page (opens in a new tab)RISE-X NYC · New York
This session will provide a builder’s view of how fraud intelligence must evolve as adversaries use AI to accelerate their tactics. The next evolution is making that language operational, adaptive, and usable inside real investigative and intelligence workflows.
TalkTLP:REDClosed session. Not recorded or shared.
April 2026
FT3: The Industry's First Agentic ATT&CK-Style Matrix
CyberCon · Frisco, TXFT3 brings an ATT&CK-style model to fraud defense. This session breaks down how it actually gets operationalized, from classifying fraud behavior to building workflows teams can act on at scale.
Talk
A Charge to the Defender CommunityRISE Ireland · Dublin, Ireland
Opening keynote on the power of the defender community and the responsibility of being in the room. The talk welcomed attendees on behalf of Stripe Security and centered on a simple idea: everyone present had the opportunity to change an outcome for the better.
KeynoteTLP:REDClosed session. Not recorded or shared.
Zero to Hero: Threat intelligence with Claude Code & ScoutCourse detailsRISE Ireland · Dublin, Ireland
A hands-on workshop where defenders use Claude Code and the Pure Signal Scout MCP to run real threat intelligence investigations.
TrainingTLP:REDClosed session. Not recorded or shared.
Fraud Fighters United with MITRE F3Read the article (opens in a new tab)FT3, the fraud framework Vincent Passaro created at Stripe, is a cited source of MITRE F3, which this CTID post launches.
ArticleMITRE F3 Design Principles — Sources of InformationRead the article (opens in a new tab)FT3, the fraud framework Vincent Passaro created at Stripe, is listed among the frameworks MITRE F3 analyzed.
Press coverageMITRE F3 Design Principles and Methodology (PDF)Read the article (opens in a new tab)FT3, created by Vincent Passaro at Stripe, is listed in section 4.1.2.1 of the MITRE F3 methodology, saved here as a PDF.
Press coverageMITRE’s Center for Threat-Informed Defense Launches Framework to Combat Financial FraudRead the release (opens in a new tab)FT3, created by Vincent Passaro at Stripe, is a cited source of the Fight Fraud Framework (F3) that MITRE announces here.
Press releaseMcLean, VA
March 2026
Outside-In: Rethinking External Threat Detection When AI Changes Everything
San Francisco, CAA Piper Sandler Cybersecurity CEO Summit session with Vincent Passaro and Team Cymru CEO Joe Sander on how AI is reshaping external threat detection, fraud intelligence, and internet-scale visibility.
Fireside- From Developer to Product Owner: The Fundamental Shifts from Generative AIRead the article (opens in a new tab)
Team Cymru’s Jeremy Bender writes up Vince Passaro’s Future of Threat Intelligence conversation on generative AI shifting engineers from developers to product owners — and the productivity, risk, and workflow implications.
Article
Two Minds, One Reframe: A Shift That Won't WaitFuture of Threat IntelligenceListen onEpisode page (opens in a new tab)Past the hype: security practitioners are becoming owners of outcomes, not just builders of tools. Explore how analyst judgment, agentic workflows, and product thinking can help small teams move problems that once felt too complex, too slow, or too expensive to solve.
Podcast
February 2026
- Fraud Intelligence at Stripe: Inside the Financial Fraud Kill ChainRead the article (opens in a new tab)
Learn how Stripe’s Vincent Passaro applies fraud intelligence to the financial fraud kill chain, breaking down account takeover and how to proactively defend.
Article
The Butterfly EffectRISE USA · San Francisco, U.S.
Using the butterfly effect as a metaphor, this keynote explored how trust, permission, and presence can shift complex systems in unpredictable ways, and how community gives legitimacy a path to travel.
KeynoteTLP:REDClosed session. Not recorded or shared.
Fraud Taxonomies & Generating Red Team Testing RoadmapsFuture of Threat IntelligenceListen onEpisode page (opens in a new tab)FT3 gives fraud teams shared language for classification and a foundation for action, powering analyst workflows, machine-speed decisions, red team testing, and intelligence packages built for the real world.
Podcast
Fighting Fraud with FT3Event page (opens in a new tab)
Unconference · San Diego, CAFT3 gives fraud defenders a common language to classify attacker behavior, connect patterns across cases, and turn isolated investigations into reusable operational intelligence.
Keynote
September 2025
Arrival of FT3 (Fraud Tools Tactics and Techniques)
Strasbourg, FranceFT3 reaches one of the field’s most trusted global defender communities: Underground Economy. The talk presented Fraud Tools, Tactics, and Techniques as a shared framework for defending the financial ecosystem.
TalkTLP:REDClosed session. Not recorded or shared.
June 2025
Fighting Fraud with FT3Event page (opens in a new tab)
Unconference · Denver, COFT3 gives fraud defenders a common language to classify attacker behavior, connect patterns across cases, and turn isolated investigations into reusable operational intelligence.
Keynote
April 2025
Evolution of FT3 (Fraud Tools Tactics and Techniques)RISE USA · San Francisco, U.S.
FT3 becomes a bridge across fraud, threat intelligence, and security operations. Session explores how shared language reduces translation loss and turns pattern recognition into operational leverage.
KeynoteTLP:REDClosed session. Not recorded or shared.
February 2025
FT3 (Fraud Tools Tactics and Techniques)RISE Finland · Undisclosed Location (Baltic Sea)
FT3 evolves from concept into structure. The talk explored how fraud tactics, techniques, and workflows could be mapped with enough precision to support shared reasoning and defensive action.
TalkTLP:REDClosed session. Not recorded or shared.
Introducing FT3: Common Language for FraudRISE-X London · London, England
FT3 began as an early field signal: fraud needed a common language. The talk introduced the case for a framework that could help defenders classify behavior, compare patterns, and move beyond isolated casework.
TalkTLP:REDClosed session. Not recorded or shared.
- 2015Docker SecurityTalkSDLUGSan Diego, CA
- Security Hardening with AnsibleArticle
Read the article (opens in a new tab)
- 2013Computer Network AttackTalk
Charleston, SC - 2013Open Source Security Tools 101Talk
Charleston, SC - 2012Aqueduct: Open Source Compliance Remediation ContentTalk
Boston, MA
- 2012Real World Perspectives Customer Panel: Red Hat Enterprise LinuxPanel
Boston, MA
- Spies, Hackers, Triangular Mergers: Japan's Secrets Are in DangerCoverage
Read the article (opens in a new tab)
- 2003Person of the Year: The American SoldierCoverageTimeRead the article (opens in a new tab)
Booking a talk?
Send the event, the date and who will be in the room. Available for in-person keynotes and talks, including travel, and for remote sessions.
Speaker kit

Short bio
Vincent Passaro is Head of Attacker Engineering & Intelligence Partnerships at Stripe and the creator of FT3, an open framework of fraud tactics and techniques that MITRE’s Fight Fraud Framework cites among its sources. He speaks on attacker engineering, fraud intelligence and security from every seat, drawing on 25 years in security that began in the 82nd Airborne.
Full bio
Vincent Passaro is Head of Attacker Engineering & Intelligence Partnerships at Stripe, where his work spans threat intelligence, offensive operations, fraud and attacker engineering. He created FT3 (Fraud Tools, Tactics, and Techniques), an open framework that gives fraud and security teams a shared language for adversary behavior. MITRE’s Fight Fraud Framework (F3) cites FT3 among its sources.
His 25 years in security began in the 82nd Airborne, with deployments to Afghanistan and Iraq. He went on to red team operations, penetration testing and security assessments for NASA and the Department of Defense, created Aqueduct, an open-source compliance-as-code project, and worked in incident response and cyber intelligence at AWS.
He speaks at conferences, closed-door industry sessions and company events, and teaches hands-on trainings on attacker engineering and fraud intelligence. He is based in San Diego.
- Based
- San Diego, CA
- Focus
- Fraud intelligence · attacker engineering
- Experience
- 25 years in security
- Currently
- Stripe
- Framework
- FT3 · creator
