Larry Pesce
Senior InstructorExecutive Director of Research at Secure Idea
Specialities
Offensive Operations

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsOffensive Operations

Larry Pesce is a SANS Senior Instructor, and Executive Director of Research at Secure Ideas. He is a co-author of SEC617: Wireless Penetration Testing and Ethical Hacking and SEC556: IoT Penetration Testing. His teaching is grounded in more than 25 years of security and disaster recovery work, where wireless systems, embedded devices, and connected products require practical testing methods, careful analysis, and defensible findings. That perspective helps students connect offensive research, hardware security, and real-world security assessments.
Larry’s security career began in healthcare, where he spent more than a decade at Care New England and served as Manager of IS Security. He later moved into consulting roles, where his work included penetration testing, wireless assessments, vulnerability analysis, and research. That mix of enterprise responsibility and hands-on offensive testing shows directly in the labs. Students work through realistic wireless, Bluetooth, RFID, SDR, firmware, and IoT scenarios, using methods that reflect how devices, networks, and product teams actually fail under assessment.
Larry has earned a GIAC Gold Research Paper credential and holds several GIAC certifications, including GIAC Assessing and Auditing Wireless Networks (GAWN), GIAC Penetration Tester (GPEN), and Global Industrial Cyber Security Professional (GICSP). He is also a co-author of Linksys WRT54G Ultimate Hacking and a contributor to Using Wireshark and Ethereal and How to Cheat at Configuring Open Source Security Tools. He has also contributed practical community tools including loc-nogps-ng, BLEPTD, lte-cell-tracker, wifi-dos and the Internet of Things Attack methodology (IoTA). Larry Pesce is also a faculty member of the SANS Technology Institute, which has been designated an NSA Center of Academic Excellence in Cyber Defense and is a multi-year winner of the National Cyber League competition.
Students describe Larry as engaging, knowledgeable, energetic, and skilled at connecting technical material to real-world examples. Outside the classroom, he co-hosts Paul's Security Weekly and contributes hardware and practical challenges to the Mid-Atlantic Collegiate Cyber Defense Challenge. An Extra Class Amateur Radio operator (KB1TNF), Larry also enjoys tinkering with electronics, wireless systems, and hardware, sometimes at the expense of warranties and multitools. Outside of cybersecurity, Larry describes himself as a serial hobbyist, with activities ranging from woodworking, jewelry making, forging edged weapons, and retromodding antiques, guided by his belief that a wide range of practical skills might come in handy during the zombie apocalypse.
Larry is great at engaging the class and making sure student needs are met.
SEC617 was great and I am still impressed with the consistency from Day 1-6 of Pesce keeping a high level of energy and knowledge throughout.
I enjoyed [Larry's] teaching style, especially when he gave real world examples.
Here are upcoming opportunities to train with this expert instructor.
Explore content featuring this instructor’s insights and expertise.
See how SEC556 and SEC617 have evolved with AI-assisted workflows, updated labs, revised hardware kits, and broader platform support—and learn which course fits your IoT or wireless testing goals.

This talk is the story of how I went from skeptic to believer by building Plan R, an IoT-focused MCP server that gives AI agents direct access to real pentesting tools.

AirSnitch introduces new attacks against client isolation and multi-SSID access points. SEC617 authors explain AirSnitch, its impact on Wi-Fi isolation controls, and what security teams should do next.

This presentation delves into the intricate process of generating a Software Bill of Materials (SBOM) for the Bob the Minions WiFi router by Davolink—a device whose firmware isn't publicly available. This session aims to provide attendees with practical insights into overcoming SBOM generation challenges in the IoT domain through hands-on hardware hacking, and leveraging the firmware and SBOMs for vulnerability discovery, as well as security improvement.

Discover the covert world of wireless network exploitation in our webcast on the "Nearest Neighbor Attack," as recently detailed by Volexity.

Review relevant educational resources made with contribution from this instructor.