About

I’m Stefan Nelson, a security engineer focused on offensive security.

I built a company’s first formal application security program. Before that, I was a Principal Tech Lead at NetSPI, where I led penetration testing and consulting for one of the three largest cloud providers.

A growing share of my work is on agentic AI and MCP security: how AI agents and the tools they connect to can be attacked.

You can find me on GitHub and LinkedIn, or email stefan@stefannelson.com.