Meet Sanaan Wani, an accomplished student, now a cybersecurity professional at Amazon

For recent USF graduate Sanaan Wani, cybersecurity has never been just a career path; it has been a challenge worth pursuing.

After years of competing, researching, building tools, and securing systems, Wani is now taking the next step in his professional journey. This summer, he will relocate to Dallas, Texas, to begin a full-time role as a security engineer with Amazon. Before graduation, however, he added another impressive accomplishment to an already distinguished résumé: the discovery and responsible disclosure of a software vulnerability that earned an official Common Vulnerabilities and Exposures (CVE) designation.

His journey reflects the hands-on learning, mentorship, and real-world experience that define Cyber Florida’s Security Operations Center Analyst Program (SOCAP).

Finding his place in cybersecurity

Wani graduated from USF in May with a degree in computer science, but his interest in cybersecurity began outside the classroom.

Toward the end of his freshman year, he started attending meetings hosted by USF’s cybersecurity student organizations and quickly discovered that protecting systems was more compelling to him than simply building software.

“I realized I found securing systems much more interesting than just building software,” Wani said.

That curiosity led him to become involved with CyberHerd, USF’s nationally recognized cybersecurity competition team, where he eventually served as blue team captain. Through competitions, training opportunities, and mentorship from coaches and faculty advisors, Wani developed both technical skills and a passion for solving difficult security challenges.

His path to joining the SOCAP began through Cyber Florida’s NIST-funded Industrial Control Systems (ICS) training program, where he learned from Cyber Florida faculty and staff and completed a SANS certification funded through the program. After successfully earning the certification, he applied to SOCAP and officially joined the team in August 2025.

Building skills through real-world security operations

As a SOCAP analyst, Wani worked alongside other students to help monitor and secure networks, investigate security incidents, and support clients across Florida.

His responsibilities ranged from incident response and threat analysis to developing operational improvements for the security operations center itself. One project involved collaborating with fellow SOCAP students to develop a SOC console designed to streamline ticket processing and accelerate response times.

“We do a bit of everything,” Wani said. “From weekly incident responses to writing threat advisories.”

The experience gave him exposure to the realities of cybersecurity operations while also allowing him to pursue emerging areas of research that interested him.

Discovering a vulnerability through AI-assisted research

Outside of his operational work, Wani has spent significant time exploring the intersection of artificial intelligence and cybersecurity. Inspired and encouraged by his CyberHerd teammate, Yeran Gamage, he began building his own autonomous tools to identify security weaknesses in open-source software projects.

“Seeing his success with finding vulnerabilities really inspired me,” Wani said. “He encouraged me to start looking into securing open-source software, which is what originally got me started in vulnerability research.”

Because open-source software powers much of today’s technology ecosystem, Wani saw vulnerability research as an opportunity to strengthen tools used by organizations around the world.

His AI-powered systems scan software repositories for potential security flaws. Once a possible issue is identified, he manually investigates the findings, validates the results, and determines whether the vulnerability could have broader security implications.

That process recently led to the discovery of CVE-2026-45675, a vulnerability in Open WebUI.

The flaw involved a race condition in the platform’s authentication process. During an initial deployment, the first user to log in is intended to become the system administrator. Because of the vulnerability, however, multiple users logging in simultaneously could potentially receive full administrator privileges.

In practical terms, that could allow an unauthorized individual to gain complete administrative control over the platform and its data.

Responsible disclosure in action

After identifying and validating the vulnerability, Wani followed the industry’s responsible disclosure process.

Because Open WebUI accepts vulnerability reports through GitHub, he submitted his findings directly to the project’s maintainers. The development team reviewed the report, verified the issue, implemented a fix, and ultimately assigned an official CVE identifier.

For Wani, the milestone was meaningful not simply because of the CVE designation itself, but because it validated the effectiveness of the research methodology he had been developing.

“I’ve been using my AI tooling to find and submit vulnerabilities for a while now,” he said. “Having this one fully verified, patched, and assigned a CVE was a nice nod that the methodology works.”

The accomplishment may be his first officially assigned CVE, but it is unlikely to be his last. He currently has additional vulnerability reports under review and remediation.

The power of mentorship

Wani credits much of his success to the mentors and teammates who encouraged him to pursue ambitious goals.

Within SOCAP, he found a culture that supported innovation and exploration. He points to Duy Dao, assistant security operations center manager, as a major influence on his interest in AI-driven security research.

“Duy encouraged us to consider new research and tools in the AI space,” Wani said. “He didn’t just talk about concepts; he built things and showed them to us.”

He also credits SOCAP Program Manager Ryan Irving for creating an environment where student accomplishments are recognized and celebrated.

“There was a point where I worried I wasn’t completing enough tickets because I was spending so much time focused on AI vulnerability research,” Wani said. “Ryan and Duy were incredibly supportive. They encouraged me to keep going and fully supported my work.”

That encouragement helped him continue pursuing research that ultimately resulted in a verified vulnerability disclosure and CVE assignment.

Looking ahead

With graduation complete, Wani is preparing for his next chapter as a security engineer at Amazon. Having previously interned with the company’s red team, he is eager to return and continue building his career in cybersecurity.

Beyond his professional goals, he hopes to make cybersecurity and artificial intelligence more accessible to broader audiences. One of his long-term aspirations is to create educational content that helps people better understand complex technical concepts.

“Breaking down complex technical concepts into ideas that are accessible and engaging for everyone is a fun challenge,” he said. “I think bridging that knowledge gap is incredibly important.”

Outside of cybersecurity, Wani channels his competitive nature into soccer and competitive gaming, particularly Counter-Strike 2 and Valorant.

Whether on the field, in competition, or researching the next vulnerability, he is constantly looking for opportunities to learn, improve, and push himself further. As he begins his professional career, his accomplishments already demonstrate what can happen when technical talent, curiosity, mentorship, and hands-on experience come together.

Successful Multi-Sector Cyber Exercise Strengthens Tampa Bay Preparedness

From May 18–20, 2026, Cyber Florida, in partnership with the Army Cyber Institute and a broad coalition of federal, state, local, military, academic, and private-sector partners, successfully completed the Jack Voltaic® Tampa Cyber Incident Exercise at the University of South Florida Marshall Student Center.

The three-day, immersive exercise simulated a coordinated cyberattack targeting Tampa Bay’s critical water infrastructure, creating cascading impacts across essential services and adjacent military operations. The event brought together decision makers and technical responders to test coordination, improve readiness, and strengthen cyber resilience across the region.

About Jack Voltaic®

Jack Voltaic® is an initiative led by the Army Cyber Institute designed to evaluate and enhance the resilience of communities surrounding U.S. military installations.

Because modern infrastructure systems are deeply interconnected, disruptions in cyber-physical systems, such as water, energy, transportation, and communications, can quickly ripple across both civilian and defense environments.

Since its launch in 2016, the Jack Voltaic® series has focused on:

• Strengthening civil-military cyber coordination
• Testing multi-sector incident response capabilities
• Identifying infrastructure interdependencies and vulnerabilities
• Improving regional resilience through realistic scenario-based training

The 2026 Tampa exercise built on this foundation with an expanded focus on operational execution and cross-sector integration.

Exercise Scenario: Coordinated Cyberattack on Water Infrastructure

Participants worked through a realistic, escalating cyber incident affecting water treatment and distribution systems in the Tampa Bay region. The scenario was designed to reflect the complexity of modern cyberattacks against operational technology (OT) and critical infrastructure environments.

Scenario progression included:

• Corruption of vendor-managed PLC systems
• Altered chemical setpoints impacting water treatment processes
• Theft of sensitive utility operational data
• Loss of SCADA control and degraded system visibility

These events created cascading operational challenges for utilities, emergency managers, and defense-supporting infrastructure, requiring coordinated response across multiple jurisdictions.

Exercise Objectives and Outcomes

The exercise successfully met its core objectives:

1. Strengthening Regional Response Capabilities

Participants tested and refined the ability of the Tampa Bay region to respond to a sophisticated, multi-sector cyberattack under realistic operational pressure.

2. Evaluating Emergency Management Under Stress

State and local agencies examined response coordination in an environment reflecting concurrent emergency demands and infrastructure disruption.

3. Demonstrating Regional Leadership

The Tampa Bay region further established itself as a national leader in cyber incident preparedness and cross-sector collaboration.

4. Assessing Defense Operational Impacts

The exercise highlighted potential implications for nearby defense installations, including MacDill Air Force Base, as well as U.S. Central Command and U.S. Special Operations Command.

A Dual-Track Training Environment: Tabletop and Live-Fire Integration

A defining feature of the 2026 exercise was the integration of two complementary training environments: a facilitated tabletop exercise (TTX) and a live-fire cyber range exercise (LFX).

Tabletop Exercise (TTX): Strategic Decision-Making in Action

Led in partnership with Norwich University Applied Research Institutes, the tabletop exercise brought together leadership from across sectors to:

• Evaluate response plans and procedures
• Coordinate crisis communications strategies
• Identify gaps in interagency coordination
• Discuss policy, governance, and resource alignment

Facilitated discussions enabled participants to test assumptions and refine decision-making frameworks under evolving scenario conditions.

Live-Fire Exercise (LFX): Operational Execution at Scale

The live-fire exercise, powered by SimSpace, provided participants with a realistic cyber range environment where technical teams:

• Analyzed live telemetry, logs, and simulated alerts
• Identified indicators of compromise across IT and OT systems
• Implemented containment and mitigation strategies
• Coordinated across SOC, engineering, and leadership roles
• Delivered operational briefings to executive stakeholders

The LFX environment enabled participants to directly translate tabletop decisions into technical execution, reinforcing real-world readiness.

Broad Cross-Sector Participation

The exercise brought together an extensive coalition of partners, including:

Federal and Military Partners

• U.S. Cyber Command, U.S. Central Command, U.S. Special Operations Command, U.S. Coast Guard, Florida Army National Guard, the FBI, and the Cybersecurity and Infrastructure Security Agency.

State and Local Government

• City of Lakeland, City of North Port, City of Tampa, Hillsborough County, Pasco County, Pinellas County, along with multiple state agencies.

Critical Infrastructure and Industry

Key infrastructure partners included:

• TECO Energy
• Tampa Bay Water
• Tampa General Hospital
• BayCare Health System
• AdventHealth
• US Water Services Corporation
• Academic and Research Partners

Idaho National Laboratory and the University of South Florida played key roles in supporting scenario design, technical integration, and research-informed facilitation.

Key Outcomes and Takeaways

Across all three days, participants identified several critical outcomes:

Stronger Cross-Sector Coordination

The exercise reinforced the importance of pre-established relationships between government, industry, and military stakeholders in responding to cyber incidents affecting shared infrastructure.

Improved Operational Awareness

Participants demonstrated improved ability to maintain shared situational awareness across IT and OT environments during rapidly evolving incidents.

Identification of Infrastructure Interdependencies

The scenario highlighted how disruptions in water systems can cascade into healthcare, energy, and defense operations.

Enhanced Crisis Communication Practices

Leadership teams refined strategies for communicating risk, coordinating messaging, and maintaining public trust during cyber disruptions.

After-Action Review and Next Steps

Following the exercise, participants contributed to a comprehensive after-action review capturing:

• Key strengths in coordination and response
• Gaps in technical and organizational capabilities
• Opportunities to improve communication and decision-making workflows
• Recommendations for future regional cyber preparedness efforts

These findings will inform ongoing efforts to strengthen cyber resilience across Florida’s critical infrastructure ecosystem.

Advancing Cyber Resilience for the Future

The successful completion of the Jack Voltaic® Tampa Cyber Incident Exercise underscored the value of sustained, cross-sector collaboration in addressing today’s evolving cyber threats.

By bringing together civilian leadership, military commands, infrastructure operators, and cybersecurity practitioners in a shared training environment, the exercise strengthened both relationships and operational readiness across the Tampa Bay region.

Cyber Florida and its partners remain committed to advancing this collaborative model, ensuring Florida continues to lead in building resilient, secure, and well-coordinated cyber defense capabilities.

Cyber Florida’s services and resources are available at no charge. To arrange for access to the ARCS Range, visit https://cyberflorida.org/arcs-range/. To explore no-cost cybersecurity training and educational opportunities for all levels of public sector employees, including certification preparation, visit our FirstLine page at https://cyberflorida.org/firstline/. Critical infrastructure organizations interested in completing the Florida Cyber Risk Assessment to access free resources and expert help should visit https://cyberflorida.org/cip/.