Cooking...
About the Practice
The Editor
Chief Hacking Officer at ASEC. Founder of DC416, Toronto's DEF CON chapter. Co-author of Black Hat GraphQL and Black Hat Bash. Author of the open-source ArduPilot simulator the industry trains on.
Nick has led the offensive-security practice at ASEC since founding the firm in 2015. He has spent more than a decade protecting Canada's largest financial institutions, with senior security roles at TD Bank and Wealthsimple, and currently serves as Head of Security Operations at Robinhood while continuing to lead ASEC's work in Toronto.
His public body of work is the body of work the practice carries. Two No Starch Press titles, Black Hat GraphQL (2023) and Black Hat Bash (2024), co-authored with Dolev Farhi. Thirty-seven open-source projects on GitHub including the 402-star Damn Vulnerable Drone, the 361-star GraphQL Threat Matrix, and the 346-star CrackQL. A talk catalogue that includes the MapleSEC 2022 keynote, GraphQL Summit 2022, CanSecWest 2024 DOJO training, BSides Toronto, SecTor multi-year, and a 2025 US drone-security talk.
He founded DC416 in 2016 with Dolev Farhi. The chapter celebrates its tenth anniversary in 2026 with 2,880 active members, ~150 attendees at monthly meetups, and a track record that includes the DC416 Missing CTF in partnership with Trace Labs, billed as the world's first OSINT CTF for missing persons.
Nick holds a US patent application (16/936229) for a continuous security verification and response platform. He sits on advisory boards at the University of Guelph's Master of Cybersecurity and Threat Intelligence program, George Brown College's Postgraduate Cyber Security program, and HackStudent (Toronto). He has been on record consulting for the House of Commons of Canada since 2016.
"It's not OK to hoard intelligence. Only when we come together can we fight threat actors." · Nick Aleks, MapleSEC 2022 keynote
Research Staff
ASEC's research staff currently lists one editor of record and a rotating circle of named contributors who file under the ASEC byline for individual investigations. We do not publish a fixed staff page. Research-staff bios will be added to this issue as contributors clear publication. For now, meet us at the next DC416 monthly meetup, the SecTor floor, or a CanSecWest DOJO.
{/* TODO: ASEC team to supply final list of named contributors, headshots, and bios as they clear publication. */}
Publications Archive
A primer on adversarial testing for ArduPilot-based vehicles, from the MAVLink wire format up through the parameter store. Written for security teams who have to red team a platform they did not build.
A field methodology for adversarial testing of the operator workstation, the GCS application, and the operator network that ties them together. The autopilot is not where the operator lives. The GCS is.
A guided tour of the RF link between commercial unmanned aircraft and their operators, what the link actually protects, and what the realistic adversary can do with a USB SDR and a working knowledge of the relevant ISM bands.
A 2025 US conference talk on operational drone-pentest methodology, drawing on Damn Vulnerable Drone and field engagement learnings.
Creative scripting for hackers and pentesters. Bash for offensive Linux work, custom tooling, and living-off-the-land attacks. No Starch Press.
An intentionally vulnerable ArduPilot/MAVLink simulator. The open-source environment the industry uses to learn drone hacking. 402 stars on GitHub.
Why most teams ship GraphQL without an offensive testing budget, and what the realistic blast radius looks like when the bill comes due.
The first move against any GraphQL endpoint: introspection, schema retrieval, and the maps every offensive researcher draws before they look for bugs.
Attacking Next Generation APIs. The first hands-on book on offensive GraphQL security. No Starch Press, 320 pages.
The MapleSEC 2022 keynote. A pragmatic operator-grade view of how to think about programs in a "when not if" world.
A GraphQL password brute-force and fuzzing utility. Built to surface authentication weaknesses in real-world GraphQL APIs. 346 stars.
An open framework for tracking the offensive surface of GraphQL server engines. The adopted reference structure across the community. 361 stars.
Community of Record
DC416 is the officially recognised DEF CON Group chapter for Toronto. ASEC's editor founded the chapter with Dolev Farhi in June 2016. The chapter celebrates its tenth anniversary in 2026 with 2,880 active Meetup members, monthly in-person meetups at 100 Queens Quay East, and an institutional pedigree of speakers from EY, Wealthsimple, Coinbase, Robinhood, Flare, Trace Labs, and multiple No Starch Press authors.
DC416 is also the home of the Trace Labs DC416 Missing CTF, billed as the world's first OSINT capture-the-flag for missing persons. For ASEC, the chapter is the year-round connective tissue between BSides Toronto, SecTor, and NorthSec. It is the surface against which the practice tests its assumptions about the hacker community we publish into.
"Where hackers meet hackers." · DC416, primary tagline
Office of record