Willi Ballenthin is a Consultant with Mandiant who can usually be found responding to breaches. Although he has experience in a variety of forensic settings, Willi enjoys reconstructing intrusions from initial exploit to long-term persistence. At Mandiant, Willi identifies vectors used by threats to compromise networks and exfiltrate sensitive information. He also applies the techniques used by modern attackers in penetration tests against clients’ external and internal environments. Willi operates out of Mandiant’s New York City office.