Sergej Epp
Sources: [[unprompted-conference-march-2026|[un]prompted Conference March 2026]] (speaker), Mythos-ready paper (cited as Zero Day Clock creator), zerodayclock.com.
Who
CISO, Sysdig. Surfaced on the wiki via two distinct contributions during the March 2026 [un]prompted conference:
- The Zero Day Clock — empirical instrument visualizing the collapse of mean Time-to-Exploit from 2.3 years (2018) to 9 hours (2026) across 3,533 CVE-exploit pairs (CISA KEV + VulnCheck KEV + XDB). The wiki’s load-bearing quantitative anchor for the “window-of-exposure collapse” argument across multiple theses.
- The 8 Minutes to Admin. We Caught it in the Wild talk — real AWS-admin-compromise case study reached in 8 minutes via stolen credentials, plus disclosure of EtherRAT, a fileless Node.js implant using Ethereum smart contracts for C2. The talk is documented on [[unprompted-conference-march-2026|the [un]prompted conference page]] with behavioral attribution methodology.
Relevance to This Wiki
Across the Zero Day Clock curve and the 8-minute admin concrete incident, Epp supplies both the empirical trend and the observed instance of Mythos-era TTE collapse. The two together are referenced in the Mythos-ready strategic briefing’s timeline and Risk Register.
Adjacent / Open
- Biographical detail beyond “CISO, Sysdig” and the two cited contributions pending primary-source confirmation. Treat as seed page.