September 20258 min
How a Lobby QR Code Gave Me 1,600 Employee Names… and more
A Verkada guest check-in QR code, an unauthenticated staff directory, and a bug bounty.
Read more
PORTFOLIO / 2026
Charlie Kelly
You'll usually find me drinking coffee or building something, occasionally both at the same time. I do fun things like Have I Been Squatted, PhishDeck, and BSides Cheltenham.
Available for consulting and speaking
Cheltenham, UK
CURRENTLY
Principal Security Analyst
Stripe OLT
Co-Founder
Have I Been Squatted
FOCUS AREAS
Incident ResponseHuman RiskThreat HuntingDigital ForensicsThreat IntelligenceSocial Engineering
Recent Experience
2021 - 2026
2025
Principal Security Analyst
Stripe OLT
Technical leadership and escalation for a team of analysts, detection engineering, and front-line incident response.
DefenderSentinelKQL
2023
Senior Security Analyst
CrowdStrike
Delivered 24/7 Managed Detection & Response as part of the Falcon Complete team.
FalconNG-SIEMLogScale
2021
Cyber Security Analyst
Microsoft
Responded to internal incidents and external abuse across the Microsoft Azure platform.
DefenderSentinelKQL
Projects
Have I Been Squatted
The intelligence and response layer for adversary infrastructure. Detect typosquatting and attack infrastructure as it appears, investigate with evidence, and take it down.
Adversary InfrastructureCo-Founder
PhishDeck
Human risk and social engineering consultancy. Realistic campaigns across email, chat, voice, and SMS, plus programme strategy that shows what failed and what to fix next.
Human AwarenessConsulting
BSides Cheltenham
Cheltenham's community-run information security conference. 2026 was the biggest year yet - talks, workshops, and people who actually do the work.
Community ConferenceIn Person
Speaking & Hosting
2026
I host community events and moderate panels on incident response, human risk, and what attackers are actually doing. If you want me on a stage, a podcast, or as an event host, get in touch.
2026
Headline Host
CyberFest
Hosted the day, including a panel on mission-driven and not-for-profit security work.
2026
Committee Director
BSides Cheltenham
Helped put on the biggest BSides Cheltenham yet - practitioner talks, workshops, and a packed town hall.
2026
Panel Moderator
Glos Tech Week
Moderated Global Tensions, Local Consequences on the Resilience & Sovereignty day.
Writing
January 202612 min
ChatGPT Stealer Explained: The Risk of Malicious Browser Extensions
How Chrome extensions harvested AI chat transcripts and browsing URLs from inside trusted workflows.
Read more
May 20266 min
CYBERUK 2026 - Key Takeaways
Identity, AI-accelerated attacks, and supply-chain resilience - what UK organisations should actually prioritise.
Read more
June 20257 min
The Rise of Clickfixing
Fake human-verification prompts that trick people into running the attacker's commands themselves.
Read more
Let's Connect
Consulting, speaking, hosting, or a conversation about security and human risk. I read everything that lands in this inbox.