Uploaded August 2026 | Updated September 2026, 8 minutes ago
Andreanne Bergeron (Flare and Université de Montréal, CA)
Cybersecurity executives still treat “exposure” as a single number, then want to know their one risk score, even though attackers haven’t operated in a single dimension for over a decade. It is now very easy for threat actors to automate large scale, hyper targeted phishing campaigns using all information available on organizations and individuals.
In this talk, we introduce a new four branch Identity Exposure Metric that redefines how defenders measure vulnerability in a world where password leaks are only one piece of the attack surface. We identify which elements of a user’s digital life truly matter and how attackers transform everyday details into actionable blueprints for abuse. In short, we were able to empirically assign relative value to each personal information type.
Drawing from 216B+ compromised records and empirical modeling, we show how identity reconstruction, authentication leakage, financial sensitivity, and social engineering susceptibility each contribute to different pathways of harm.
Attendees will learn how the Identity Exposure Metric can prioritize real world risk and reinforce identity centric defense strategies.
---
Andréanne Bergeron, PhD, is a researcher at Flare, specializing in online attackers’ behaviors. Her expertise delves into the intersection of criminology and cybersecurity. In addition, Andréanne holds an esteemed position as an affiliated professor in the Department of Criminology of Montreal University, bridging academia and industry. Her commitment to provide a unique perspective on the human element behind digital threats reflects a holistic approach, enriched by theoretical depth and real-world applicability. Andréanne has showcased her research at prestigious conferences such as BlackHat USA, Defcon, CypherCon, and ShmooCon. Active in her community, Andréanne serves as Vice President in NorthSec organizing team.
Andreanne Bergeron (Flare and Université de Montréal, CA)
Cybersecurity executives still treat “exposure” as a single number, then want to know their one risk score, even though attackers haven’t operated in a single dimension for over a decade. It is now very easy for threat actors to automate large scale, hyper targeted phishing campaigns using all information available on organizations and individuals.
In this talk, we introduce a new four branch Identity Exposure Metric that redefines how defenders measure vulnerability in a world where password leaks are only one piece of the attack surface. We identify which elements of a user’s digital life truly matter and how attackers transform everyday details into actionable blueprints for abuse. In short, we were able to empirically assign relative value to each personal information type.
Drawing from 216B+ compromised records and empirical modeling, we show how identity reconstruction, authentication leakage, financial sensitivity, and social engineering susceptibility each contribute to different pathways of harm.
Attendees will learn how the Identity Exposure Metric can prioritize real world risk and reinforce identity centric defense strategies.
---
Andréanne Bergeron, PhD, is a researcher at Flare, specializing in online attackers’ behaviors. Her expertise delves into the intersection of criminology and cybersecurity. In addition, Andréanne holds an esteemed position as an affiliated professor in the Department of Criminology of Montreal University, bridging academia and industry. Her commitment to provide a unique perspective on the human element behind digital threats reflects a holistic approach, enriched by theoretical depth and real-world applicability. Andréanne has showcased her research at prestigious conferences such as BlackHat USA, Defcon, CypherCon, and ShmooCon. Active in her community, Andréanne serves as Vice President in NorthSec organizing team.
