# Michele Cerreta

Michele Cerreta shares work on cybersecurity research, including automated penetration testing, vulnerability disclosure, AI and cyber threats, and blockchain-based criminal investigations.

- Profile: https://b2binfluencer.marketing/creators/michele-cerreta/
- LinkedIn: https://www.linkedin.com/in/mcerreta
- LinkedIn followers: 2,157
- Topics: artificial-intelligence, cybersecurity, ai-security
- Based on 11 dated posts, latest 2026-10-09

## Summary

Michele Cerreta is most useful for technical cybersecurity research, speaking, and coordinated vulnerability disclosure work.

- Best for: A cybersecurity lab or security vendor seeking a technical speaker, workshop contributor, or research collaborator.
- Not for: A consumer brand or general-audience product launch seeking broad reach and high-volume sponsored content.
- Check first: Ask for recent LinkedIn analytics, audience survey, and attendance for comparable talks or workshops.

### Takeaways

- Presented Automating Penetration Testing with MeTeOr at OSVS Workshop at Euro S&P 2024.
- Reported an exposed API vulnerability to TIM Group, which confirmed the flaw and shipped a fix.
- Presented on AI prejudices and blockchain-based criminal investigations at ITASEC24.

## Main ideas

- **Vulnerability disclosure works best as a cooperative, timed process**: Cerreta treats responsible disclosure as a procedure, not a gesture: a researcher finds a potential flaw, reports it privately to the affected company through its dedicated channel, and allows time for a fix before publication. The reasoning is practical: the process shortens the window of exposure, brings security researchers and company teams together, and helps prevent attacks exploiting the same weakness. Cerreta argues that companies with disclosure or bug bounty policies demonstrate security maturity by accepting that no system is invulnerable and that transparency and cooperation are the better ways to improve it.
- **Security research should be presented publicly and revised on expert feedback**: For Cerreta, publishing and presenting are part of the research, not an afterthought. They describe presenting to expert audiences, gathering feedback and incorporating new perspectives, and frame conferences as places to exchange ideas, not just announce them. The same emphasis on collaboration and knowledge-sharing runs through the write-ups of academic workshops, industry sessions and the summer school.
- **AI bias is itself an attack surface**: In the ITASEC24 write-up, Cerreta argues that prejudices or biases in AI systems can be exploited in ways their designers did not anticipate, a concern in the context of advanced persistent threats. The argument connects two subjects often discussed separately — how AI models behave and how attackers operate — and treats the former as a route into the latter.
- **Formal methods can be pointed at concrete investigative problems**: The ITASEC24 material also shows how abstract techniques such as temporal logic can address operational needs. Here, the challenge is criminal investigation: reasoning about events and their order on a blockchain, where transactions are public but the actors behind them are not. Cerreta names the colleagues who collaborated on the work.
- **Security is a cross-sector discipline, from cryptography to governance**: The summer school write-up shows the breadth of training Cerreta values: technical topics such as post-quantum cryptography, OT security and malware detection, as well as geopolitics and the legal and governance dimensions of cybersecurity. The week brought together universities, an agency headquarters, a police organisation, a NATO body and a consultancy project, reflecting a view of security as a field practised across sectors and borders.

## Work to read

- [Presenting “Automating Penetration Testing with MeTeOr” at Euro S&P 2024](https://www.linkedin.com/posts/mcerreta_cybersecurity-privacy-research-activity-7218984818825433088-gZT5)
- [Reporting an exposed API vulnerability through responsible disclosure](https://www.linkedin.com/posts/mcerreta_responsible-disclosure-activity-7382424038205222912-TnY9)
- [Presenting on AI prejudices and blockchain-based criminal investigations at ITASEC24](https://www.linkedin.com/posts/mcerreta_itasec24-itasec24-ai-activity-7183875524169990144-NbJS)
- [Selected for the International Cyber Security Summer School in The Hague](https://www.linkedin.com/posts/mcerreta_cybersecurity-icsss-thehague-activity-7239582533875564544-VQoU)

## Brand relationships

- **Gruppo TIM** (mention)
- **Accenture** (mention)
- **Booz Allen Hamilton** (mention)
- **Europol** (mention)
- **NATO Communications and Information Agency (NCI Agency)** (mention)
- **Leiden University** (mention)
- **Security Delta (HSD)** (mention)
- **IMT School for Advanced Studies Lucca** (mention)

## Partnerships

Michele Cerreta's posts do not offer sponsorships or paid partnerships. They show a working profile built on technical research, conference presentations, and one completed vulnerability disclosure—relevant context for a lab or security vendor considering a speaking slot, joint research project, or disclosure collaboration rather than an advertising buy. The ITASEC24 post describes presenting a study on AI prejudices and their exploitations at the AI-APT workshop on behalf of a professor, plus co-authored work on blockchain criminal investigations. The Euro S&P 2024 post describes presenting the paper "Automating Penetration Testing with MeTeOr" at the OSVS workshop. Both are academic and industry conference contexts; any commercial arrangement would need to be negotiated directly and scheduled around research commitments. The Responsible Disclosure post describes finding an exposed API vulnerability in a TIM Group service, reporting it through the company's dedicated channel with a proof of concept, and having the company confirm and fix it. The posts publish no sponsorship formats, rate structures, media kit, or audience-deliverable specifications. Buyers should ask about terms, availability, and any employer or institutional constraints.

## Alternatives

- Ivan Canovese: Choose Canovese when the session is commercial rather than technical: a vendor or lab wants the buyer-side view of cost, procurement and supply-chain resilience, or the audience is CFOs, procurement directors and operations managers rather than security engineers. Their material suits that room. One post marks their promotion to Senior Partner at ERA Group EMEA after passing project and revenue thresholds, and makes the case for a method: listen before proposing, ask why something has always been done a certain way, build tailored cost paths, and treat a returning client as the real result rather than the title. The other applies the same lens to a live risk — the Bab el-Mandeb strait, roughly 12% of seaborne oil and over 20% of international containers, and the effect of a full blockage on European cost structures — and argues for selective, better-informed spending rather than paralysis, with energy sourcing as the decision point. If the goal is to help an audience make sharper supply and cost decisions under uncertainty, they approach the task through a different discipline.
- Giorgio Gnoli: Choose Gnoli for a build-and-show-numbers session aimed at go-to-market or revenue-operations teams, covering CRM architecture, data quality at scale and replicable demand generation. The CRM post is unusually concrete: a Salesforce-based customer 360 for an automotive dealer; 105,169 records reconciled to 98,146 unique customers using matching rules (same tax code, same VAT number, or email or phone combined with name); lead-to-account conversion rules; a 60-day deal cut-off with a “sale beyond cut-off” tag; lifetime value and whole-vehicle spend; 953 body-type models and 1,877 parts families classified; and 682 mapped fields with configurable placement. The second post applies the same instinct to pipeline: when an agency has no fallback in a negotiation, it takes any client, so build pipeline through cold outreach and a sharp offer. The worked example uses roughly €15 of setup, one domain, a small sending script, an A/B tracker and a CRM, and gets 13 positive replies in a week. If the vendor wants a practitioner who shows the machine and the numbers behind it, Gnoli is the stronger booking.
- Antonio Ieranò: Choose Ieranò for governance and compliance rather than testing: an AI vendor assessment, a GDPR-aligned deployment of AI tooling, or the legal limits of monitoring employees' AI use. The first post argues that the AI Act has become the practical filter for evaluating every AI-embedded product — copilots, agents, LLMs, DLP and data-protection tools, cloud and SaaS — and replaces “does it use AI?” with procurement questions: what AI, with which data, processed where, how autonomous, what outputs, which subprocessors, and who is accountable. It flags that AI-enabled solutions may run outside the EU, process personal data, logs, metadata or embeddings, be embedded in critical systems, or act operationally. It points to GDPR, Schrems II, SCCs, transfer impact assessments, DPAs and supplementary measures, with a vendor-assessment checklist and a named set of internal functions to involve, from CISO and DPO through to procurement and senior leadership. The second post addresses shadow AI directly: DLP, CASB or browser controls on unauthorised AI apps run into Article 4 of the Italian workers' statute without a union agreement or labour-inspector authorisation, require a DPIA under GDPR Article 35, and produce logs that are unusable in disciplinary or judicial proceedings without proper notice. It then sets out a five-step compliance roadmap. For a lab or vendor selling governance advisory to CISOs, DPOs and legal teams, this is directly usable material.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/