Overview
Markus Vervier is chief executive officer of persistent-security and is based in Aachen. He has been a director of Persistent Security since August 2022, and served as its chairman from August 2022 to March 2025. Since December 2016 he has also been managing director of X41 D-Sec GmbH, and from January 2019 to November 2023 he was managing director of mstorm.io.
Earlier in his career he was a senior security consultant and software developer at LSE Leading Security Experts GmbH from October 2011 to December 2015. He worked as a professional services engineer at Atronos Solutions GmbH from May 2008 to September 2011, and was a diploma student at CanControls between June 2010 and February 2011. From March 2005 to August 2007 he handled IT coordination and software development at Kulturserver gGmbH, and from October 2004 to May 2007 he worked in IT security as a penetration tester at RedTeam Pentesting GmbH.
He holds a Diplom in Informatik from RWTH Aachen University. His stated areas of expertise are cybersecurity, penetration testing, red teaming, reverse engineering and source code auditing.
Career history
In the news
- Supermarkets are hit by attacks that shut down their fridges. How did it happen? Via a deadly combination of these devices being exposed on the Internet with credentials admin/admin! A prime example of why Mythos is not a today problem for companies, they are fighting basic security problems at scale. On the upside we got resolutions for such issues: continuous testing of infrastructure and defenses! Any company not doing it is signing themselves up for disaster..
- Looks like I managed to look like the evil offensive team guy, had a real good time at NYC with Teleport !
- We loved bringing the NYC security community together for our recent speakeasy panel! Our co-founder Markus Vervier caught up with Ben A. and Rob Picard for an honest chat about AI, red vs. blue teaming, and how defense is changing. Partnering with the Teleport team was amazing, they’re such great professionals to work with and even more fun to hang out with. 🫣 Because when you look at how things are evolving, it really comes down to one question: does your AI beat their AI? YouTube Link: https://lnkd.in/eDYSYmeA #NYC
- If c0c0n 2026 reminded us of anything, it’s that the best stuff always happens in the hallway track. It was great catching up with old friends, making new ones, and getting completely carried away talking about bugs and vulnerabilities. Plus, getting such a warm welcome from the Kerala Police was cherry on top. A big highlight for our team was seeing our co-founder, Markus Vervier, run his training session. Watching the room go from confusion to “oh wow, that’s how he did it” was fun to see. From talking tech during the day to
- If run local AI / LLMs chances are high it runs on vLLM, thanks to the X41 D-Sec GmbH team for keeping sovereign AI safe!
- First day of the offensive AI training in Kochi went really well, glad to have such nice and motivated trainees!
- Thank you Off-By-One Conference for having me speak about my research about what AI means to the security space. We will go from applying AI to attacking AI itself and the implications this has on the security auditing, pentesting and last but not least novel types of security automation platforms. Plus we will get a glimpse of my upcoming Phrack paper featuring how AI models themselves can be infected by a novel kind of malware and create their own class of security issues. (More info in the comments below)
- Markus Vervier is taking the stage at Off-By-One Conference in Singapore to break down the sheer chaos of AI security in 2026! Between indirect prompt injection and models executing untrusted code, context has officially become the new attack surface. If you’re at the event and want to catch up with the Nemesis team, feel free to drop us a line! Talk Details: https://lnkd.in/dxZeHKHN #OB12026 #OffByOne2026 #offensivesecurity #AIForSecurity
This page shows public professional information only, each fact cited. Is this you? send a correction, or ask for removal within 24 hours, no questions asked.