Vebjørn Risa

Helping clients secure their internet-facing attack surface through offensive security consulting and responsible disclosure reporting.

Hello, and welcome to my page. You might’ve come here via a link in my bio, or perhaps through my security research contact information. I am a cybersecurity consultant by day and security researcher by night, helping organizations secure their external attack surface from digital attack or abuse. Please let me know if you have any questions by emailing me or reaching out on LinkedIn.

Oslo, Norway Currently researching the attack surface of the .no TLD.

Offensive Security lead Penetration tester Attack surface management specialist

View projects Read the blog

About me

Offensive Security lead @ KPMG Norway
Independent security research focused on internet-facing systems
Contacting and helping organizations through bug bounty and responsible disclosure

Companies I've helped through responsible disclosure

Dunam

Coming soon!

Dunam

Coming soon!

Selected projects

No projects yet. Add some under content/projects.

View all projects

Latest articles

Threat in a Bucket: Inside a Live Hacking Operation

10 Nov 2025 • 4 min read

Research

A public AWS bucket held a live credential-harvesting operation. Here is what was in it, who it resembles, and what to do when a cloud key leaks.

AWS Cloud security Threat research

View all posts