Brenno de Winter (1971) is a renowned expert on information security, privacy and ICT. His passion lies in connecting technology with business practice, standards frameworks and legislation. At the age of five, Brenno wrote his first computer programme, and soon discovered weaknesses in technology, getting involved in the hacker scene.
Brenno is the spiritual father of OpenKAT, an open source project that grew out of the need for forensically secured insight into information security during the corona crisis. He also developed the Methodology for Information Security Examination with Audit Value (MIAUW), a standardised approach to pen testing that supports organisations in complying with legislation such as NIS2, DORA and CRA.
His journalistic career peaked in 2011 when, after hacking the public transport chip card and revealing hundreds of data breaches (known as ‘Leak October’), he was named Journalist of the Year. In 2016, he decided to focus entirely on general research and consultancy in the field of privacy and information security.
As an experienced consultant and trainer, Brenno supports various organisations, including the Ministry of Health, Welfare and Sport (VWS), the National Police and several municipalities. He holds roles as Data Protection Officer and member of ethics and objection committees, where he contributes to transparency and ethical decision-making around technology use.
Brenno has written numerous books, including ‘The Validation Crisis’, ‘Digital Storm Flood’, ‘The Red Hack’, and ‘Protecting Against Cybercrime’. He has mastered several programming languages, including Python and Flutter, and possesses in-depth knowledge of standards such as ISO27001, NEN7510 and the Government Information Security Baseline.
His extensive experience also includes advising top executives, including the UWV Board of Directors. During the COVID-19 pandemic, he played a central role in developing and implementing privacy-by-design and security-by-design measures for the Dutch corona apps.
Brenno is known for his ability to make complex technical and legal issues accessible, with an eye for the human side of information security and privacy.