Catch IOActive Security Consultant Megan Holliday at this year’s CornCon, October 1–3 in Davenport, IA, where she’ll be presenting on AWS penetration testing. Full abstract and event details below.
ABSTRACT:
This talk provides a practical introduction to penetration testing AWS environments, aimed at security professionals who are new to the cloud. We address questions such as where to start, what to look for, and how to approach AWS from an attacker’s perspective.
We break down the difference between an AWS penetration test and a configuration review, explore common engagement styles, and dive into core IAM concepts — examining how misconfigurations in IAM, S3, and EC2 can be identified and exploited in real-world scenarios.
These concepts are reinforced with attack demonstrations, alongside a real-world case study from a CTF event where chaining together several misconfigurations ultimately exposed an organization’s AWS credentials. We close with a curated list of learning resources and offensive tooling to help attendees continue building their skills after the session.
The goal is not to cover every AWS service, but to give penetration testers a clear and confident starting point for approaching AWS environments.
ABOUT THE SPEAKER:
Megan Holliday is a Security Consultant at IOActive with five years of experience in offensive cybersecurity. She specializes in cloud security, focusing on AWS and Azure environments, as well as penetration testing of web applications and network infrastructure. Megan’s work centers on identifying real-world vulnerabilities and helping organizations understand how attackers can exploit them. She developed her cloud security expertise through hands-on platforms such as AWS Skill Builder and Pwned Labs, and has applied it performing security assessments for enterprise-level clients.
CornCon returns to Davenport, IA, October 1–3, 2026. The event kicks off with the CISO Executive Summit on October 1, bringing together 60+ security leaders to exchange ideas and learn from experts on topics ranging from ransomware to boardroom strategy, in partnership with the ISSA Cyber Executive Forum. The main conference runs October 2–3, featuring 70+ speakers and trainers, hands-on workshops, contests, and an expanded vendor expo with a Saturday happy hour.