Aaron Cure is a SANS Principal Instructor and Director of Cyber Security at Cypress Data Defense, where he specializes in penetration testing, secure software development lifecycle (SDLC), static code analysis, and secure architecture. At SANS, he teaches SEC542: Web App Penetration Testing and Ethical Hacking and SEC588: Cloud Penetration Testing (co-authored), bringing deep, hands-on expertise into the classroom to help students understand how modern applications are attacked and secured in real-world environments.
Aaron’s career spans more than three decades across military, development, and cybersecurity domains. He began his professional journey in the U.S. Army, serving for 10 years as a Russian linguist and satellite repair technician, before transitioning into technical roles including database administration and programming on the Iridium project. He later worked as a telecommunications consultant and senior programmer, building a strong foundation in software development before entering the information security field in 2006. Since then, he has led and contributed to engagements involving secure code reviews, vulnerability assessments, penetration testing, and security research. His progression from developer to offensive security expert helps him connect with students and understand their trials, as he guides them through learning to think like attackers while building stronger defenses.
Aaron holds the Certified Information Systems Security Professional (CISSP) certification, along with GIAC Penetration Tester (GPEN), GIAC Cloud Penetration Tester (GCPN), GIAC Web Application Penetration Tester (GWAPT), GIAC Mobile Device Security Analyst (GMOB), and GIAC Secure Software Programmer .NET (GSSP-.NET) certifications. He is the author of NHibernate 2.x Beginner’s Guide, NHibernate 3 Beginner’s Guide, and Visual Studio 2019 Tricks and Techniques: A developer's guide to writing better code and maximizing productivity, contributing to the developer and security communities by helping practitioners build strong foundational skills. Aaron Cure is also a faculty member of the SANS Technology Institute, which has been designated an NSA Center of Academic Excellence in Cyber Defense and is a multi-year winner of the National Cyber League competition.
In the classroom, Aaron is known for his engaging, conversational teaching style and his ability to make complex attack techniques accessible and actionable. He emphasizes the duality of offensive and defensive security, helping students understand that testing and securing systems are two sides of the same coin. Students value his real-world perspective, especially when they experience “a-ha!” moments around how attacks like XSS and SQL injections truly work. Outside of teaching, Aaron contributes to the community through his roles on the various company and nonprofit boards, and enjoys hands-on hobbies ranging from blacksmithing to restoring antique tractors, bringing the same curiosity and craftsmanship to both his work and his life. He also laces up the skates to play ice hockey, and gets a kick out of taking his antique firetruck for a drive, channeling that same blend of energy and old-school appreciation into everything he does.
Qualifications Summary
Principal Security Consultant, Cypress Data Defense
BMBlog.com / Article / 202562% of Companies Admit to Shipping Insecure Code: Cypress Data Defense Unveils 2025 State of Application Security Report Warns
