Balazs Kiss

Software security specialist | Trainer at High Tech Institute | Product Development Lead, Cydrill Software Security

Balázs Kiss is a Hungarian software security specialist with more than fifteen years of experience in application security, security testing, secure coding and machine learning security. He is Product Development Lead and lead trainer at Cydrill Software Security in Budapest and trainer at High Tech Institute in Eindhoven, where he delivers the institute’s software security curriculum. He holds an MSc in Technical Informatics from Budapest University of Technology and Economics, with a specialization in the security of information systems.

Kiss began his career in 2003 as a developer and database administrator at the Hungarian Mining Bureau before moving into applied security research at SEARCH-Lab in 2008, a Budapest-based software security research and consultancy firm. There he worked as a senior R&D engineer, project manager and application security expert for more than a decade, contributing to international EU research including the FP7 Aniketos project on trust and security in service-based systems. He co-authored two peer-reviewed conference papers: “Combining Static and Dynamic Analyses for Vulnerability Detection” (Haifa Verification Conference 2015, with co-authors from CEA and Dassault) and “MEFORMA Security Evaluation Methodology” (PECCS 2014). He joined SCADEMY Secure Coding Academy in 2011 as a senior trainer and development lead and moved to Cydrill in 2019 when the company was founded.

Selected publications

Kiss, B.; Kosmatov, N.; Pariente, D.; Puccetti, A. “Combining Static and Dynamic Analyses for Vulnerability Detection: Illustration on Heartbleed.” Haifa Verification Conference (HVC) 2015, pp. 39–50. DOI: 10.1007/978-3-319-26287-1_3.

Jeges, E.; Berkes, B.; Kiss, B.; Eberhardt, G. “MEFORMA Security Evaluation Methodology – A Case Study.” PECCS 2014, pp. 267–274. DOI: 10.5220/0004919902670274.

The central argument in Kiss’s training is that software security fails not because developers are careless but because they are never taught to think about it. Most developers learn to write code that works; nobody teaches them to write code that cannot be broken. The consequences arrive later and at much greater cost: a vulnerability that takes minutes to exploit and seconds to discover in a security review can cost months of remediation work if it reaches production. Writing secure code is a skill that can be learned and, with the right training, can become as automatic as any other coding habit. The goal of his courses is to build that habit before the vulnerability is written, not after it is found.

His teaching approach is built around what he calls the attacker mindset: understanding not just what the correct code looks like but why the incorrect version is exploitable and exactly how an attacker would use it. Every vulnerability pattern in his courses is paired with a working exploit demonstration, so participants experience the attack before they learn the defense. Participants who have attended his courses describe leaving with the ability to recognize vulnerability classes they had never noticed in their own code.

At the We Are Developers World Congress in Berlin he presented a live demonstration of adversarial attacks on machine learning systems under the title “A hundred ways to wreck your AI,” showing how a self-driving car can be made to ignore a stop sign, how a security camera can be blinded to an intruder and how a medical AI can be induced to prescribe a lethal dose. The same taxonomy of attacks — evasion, poisoning, model inversion and model stealing — forms the backbone of his Machine Learning Security course. More recently he has developed a family of courses on the responsible use of generative AI in software development, covering the new vulnerability classes introduced by LLM-generated code and the OWASP LLM Top 10.

At High Tech Institute, Balázs Kiss teaches across a large part of the software security curriculum, covering secure coding in Python, C/C++, Java and C#, machine learning security and the responsible use of generative AI in software development.

What distinguishes his teaching is the combination of more than fifteen years of applied security research and testing at SEARCH-Lab and Cydrill, a curriculum updated continuously to reflect current attack techniques and the latest OWASP guidance, and a live-demonstration approach that makes the consequences of insecure code immediately visible rather than hypothetical.

Balázs Kiss is Product Development Lead and lead trainer at Cydrill Software Security in Budapest, Hungary, and a trainer at High Tech Institute. He holds an MSc in Technical Informatics from Budapest University of Technology and Economics with a specialization in the security of information systems. He has contributed to EU FP7 security research and is the author of peer-reviewed conference papers on static and dynamic vulnerability analysis.