Confessions of a reformed pentester
summary
Pen testing finds real bugs — cracked a Caesar-style cookie, exploited a negative-million transfer to simulate stealing $1,000,000, and once triggered a production outage on a T2 site — but it’s time-boxed and noisy: a five-day testing window with limited creds often means “no findings” doesn’t equal secure. Better returns come from static analysis and peer code reviews, formal threat modeling, security requirements/abuse cases, CI automated checks and monitoring, and only adding bug bounties after those basics exist.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:45What is pentesting
- 1:41Pentesting = fun
- 3:28Pentesting = useful
- 4:39Pentesting #proven security
- 5:55Pentesting - friction
- 6:53Pentesting has its risks
- 7:39What else can we do in the SDLC
- 10:02Security at the speed of developme...
related talks
50mA CISO's Best Friend: The Pentester
44mApplication Security: Everything we know is wrong
39mAre Pentests Relevant with Bug Bounties
19mPenetration Testing
32mPicking the Low-Hanging Fruit – Easy Pentest Wins
34mBeating the pentester
20mCalcifying Crisis Readiness
33mWorking with penetration testers as a developer