Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Hiring Former Attackers
Transcript
- Lucas: If these conversations are useful for what you're building or running, stick around for a quick note at the end on how you can keep them coming. But first — a question that's been nagging me: who better to break into your system than someone who's spent years doing it for real? Luna: You're talking about hiring former attackers. I've seen this come up a lot lately. Companies like Synack, HackerOne, Bugcrowd — they all tap into that talent pool. But it's still controversial. Lucas: Right. And the poster child for this model is Synack. Founded in 2013 by former NSA analysts, Synack built a platform that vets and deploys a curated group of security researchers — many of whom have black-hat backgrounds. They call it 'crowdsourced security with a human touch.' Today they have about 1,500 vetted researchers on the platform, and their clients include the U.S. Department of Defense, the IRS, and major banks. Luna: What's the vetting process like? I imagine you can't just show up and say 'I used to hack banks, trust me.' Lucas: No, it's rigorous. Synack requires researchers to go through a background check, a skills assessment, and a personality interview. They also sign nondisclosure agreements and agree to strict rules of engagement. The idea is to filter out anyone with malicious intent while leveraging the skills of people who may have started on the wrong side. Luna: So it's not just about finding talent — it's about managing risk. You're letting people with a criminal past into your network, essentially. Lucas: Exactly. And that's why companies like Microsoft take a different approach. Microsoft runs a massive bug bounty program — they paid out over $13 million in bounties last year alone. But they don't necessarily hire the hackers full-time. They pay for findings on a per-vulnerability basis. It's lower commitment, but you don't get the deep, sustained testing that a Synack engagement provides. Luna: So Synack's model is more like a managed penetration test service, not just a bug bounty. They assign a team of researchers to a client for a set period, often several weeks, and they dig into the system thoroughly. Lucas: Right. And that's where the economics get interesting. A traditional penetration test from a firm like Mandiant or CrowdStrike can cost $200,000 to $500,000 for a large enterprise. Synack's model is typically a subscription — around $100,000 to $300,000 per year for continuous testing. You get more coverage for less money, and the researchers are incentivized to find critical vulnerabilities because they get paid per finding. Luna: But there's a catch. If you're paying per finding, researchers might be tempted to inflate the severity of a bug to get a bigger payout. How do you prevent that? Lucas: Synack has a tiered validation process. Every finding is triaged by internal analysts who verify the vulnerability and rate its severity. The researcher's payout is based on that validated severity. So if you claim a critical remote code execution but it turns out to be a low-impact information disclosure, you get paid less. It aligns incentives. Luna: I've also heard about the Department of Defense's 'Hack the Pentagon' program. That was a bug bounty, right? But they used HackerOne, not Synack. Lucas: Yes, in 2016 the DoD launched Hack the Pentagon, the first federal bug bounty program. They invited a curated group of researchers — again, some with checkered pasts — to find vulnerabilities in public-facing DoD systems. Over 1,400 researchers participated, and they found 138 valid vulnerabilities. The average payout was around $500. It was considered a massive success, and it paved the way for programs like the Air Force's 'Hack the Air Force' and the Army's 'Hack the Army.' Luna: So the government is on board. But I still wonder — what about the liability? If a former attacker finds a zero-day and decides to exploit it instead of reporting it, the company is exposed. Doesn't that keep some CISOs away? Lucas: It does. That's why Synack's vetting is so important, and why they have legal agreements that make exploitation a felony. But the truth is, the risk is lower than you'd think. Most black-hat hackers who turn white-hat do it because they want legitimacy and a steady income. The underground economy is dangerous and unpredictable. A legitimate career is more attractive. Luna: There's also the argument that if you don't hire them, your competitor might. And if they stay black-hat, they're coming after you anyway. So why not bring them inside? Lucas: That's exactly the logic. And it's not just about hacking skills — it's about mindset. Former attackers think differently. They don't follow the script. They try the weird stuff that a well-trained penetration tester might skip because it's not in the methodology. Luna: Yeah, I've heard that called 'offensive security culture.' It's the same reason companies hire former intelligence officers for threat intel roles. You want people who have lived in the adversary's head. Lucas: Right. And there's a growing ecosystem around this. Bugcrowd, another platform, has over 500,000 registered researchers. HackerOne has over a million. The total bug bounty market is expected to hit $2 billion by 2028. It's becoming a mainstream part of enterprise security. Luna: So what does this mean for the traditional penetration testing firms? Are they going to be disrupted? Lucas: Not entirely. Traditional pen tests have advantages: you get a dedicated team that builds deep knowledge of your environment over time. Crowdsourced testing is more transactional. Most enterprises use both. The big firms are adapting too — Mandiant now offers a crowdsourced component to their testing services. It's not either-or. Luna: But the talent pipeline is shifting. If I'm a young person interested in security, I could go to college for four years and get a degree, or I could learn on my own, build a reputation on HackerOne, and get hired by Synack without a degree. Which path is more common? Lucas: Both exist, but the non-traditional path is becoming more accepted. Many Synack researchers are self-taught. Some have criminal records. Some are teenagers. The industry is recognizing that skill matters more than credentials. That's a huge change from even five years ago. Luna: It's also a solution to the cybersecurity talent shortage. There are an estimated 4 million unfilled cybersecurity jobs globally. If you can tap into the pool of people who were previously excluded — including former attackers — you can start to close that gap. Lucas: Absolutely. And that's the optimistic view. The pessimistic view is that you're legitimizing criminal behavior. Some argue that by paying former hackers, you're incentivizing people to break the law to build a resume. But the counterargument is that the vast majority of these researchers never committed crimes in the first place — they were curiosity-driven teenagers testing boundaries. Luna: There's a famous case from the 1990s: Kevin Mitnick. He was the most wanted hacker in the world, served five years in prison. After his release, he became a highly sought-after security consultant. Companies paid him to break into their systems. That was one of the earliest examples of this model. Lucas: Exactly. Mitnick's consulting firm, Mitnick Security, still operates today. And his story is often cited as proof that rehabilitation works. But it's not just about rehabilitation — it's about capability. The skills don't disappear when someone goes straight. You can either let those skills be used against you or for you. Luna: So where do you see this going? In five years, will every Fortune 500 company have a Synack-style engagement? Lucas: I think so. The cost is coming down, the quality is going up, and the regulatory pressure is increasing. For example, the SEC's new cybersecurity disclosure rules, which took effect in 2024, require companies to report material breaches. That's making boards pay attention to testing. Crowdsourced testing gives them a defensible, continuous process. Luna: And it's not just about finding bugs. It's about building a culture of security. When you have researchers constantly probing your systems, you're forced to fix things quickly. It creates a feedback loop. Lucas: Exactly. And that's the real value. It's not the individual vulnerabilities — it's the fact that you're constantly improving your posture. That's why Synack and others are growing so fast. They're not selling a product; they're selling a process. Luna: You know, speaking of things that create a feedback loop — a couple of dollars a month from listeners is what keeps this podcast sustainable. If you've gotten something out of these episodes, buy me a coffee dot com slash fexingo is the easiest way to chip in. It genuinely makes a difference in keeping this ad-free. Lucas: Yeah, it's a small thing that adds up. We don't have a big marketing budget — it's just us and our listeners. So if you find value in these conversations, that's where you can support them. Buy me a coffee dot com slash fexingo. Luna: Alright, back to the topic. One last angle I want to touch on: the legal and ethical gray areas. What happens if a researcher finds a vulnerability in a system that isn't covered by their agreement? Do they report it anyway? Lucas: That's the tricky part. Most platforms have a clear scope. If you find something outside scope, you're supposed to stop and inform the platform. But researchers sometimes find critical flaws in third-party components that affect many clients. There's a debate about whether they should be allowed to disclose those broadly. Some argue for full disclosure to pressure vendors to fix things. Others say it's irresponsible and could lead to exploitation. Luna: There's also the issue of 'bug bounty fatigue.' Some companies get overwhelmed by low-quality reports and stop paying attention. That undermines the whole model. Lucas: Yes, and that's why the triage process is so important. Platforms like Synack and Bugcrowd invest heavily in triage to filter out noise. A good triage team can turn a flood of reports into a manageable stream of actionable intelligence. That's a skill in itself. Luna: So the future of security testing is less about hiring a single firm to do a point-in-time assessment, and more about building a community of freelance researchers who are constantly poking at your defenses. That's a pretty radical shift. Lucas: It is. And it mirrors what's happening in other industries — the gig economy, crowdsourcing, platform-based work. Cybersecurity is just catching up. The difference is that here, the stakes are much higher. One missed vulnerability can cost millions. So the platforms need to be reliable, the researchers need to be trustworthy, and the clients need to be committed to fixing what's found. When all three align, it works beautifully. Luna: And when it doesn't, you get a breach and a lot of finger-pointing. But the trend is clear: more companies are opening their doors to outsiders. The question is whether they can manage the risk. Lucas: I think they can. The track record so far is good. Hack the Pentagon was a watershed moment. Since then, we've seen the DoD expand its programs, and the private sector has followed. It's not a fad — it's a fundamental change in how we think about security testing. Luna: Alright, I'm convinced. So for anyone listening who's responsible for security at their company: if you haven't tried a crowdsourced pen test, maybe it's time. Lucas: And if you have a background in hacking — even if it's not on a resume — there are legitimate, well-paying opportunities to use those skills for good. The industry is ready for you. Luna: That's a hopeful note to end on. Thanks, Lucas. Lucas: Thanks, Luna. And thanks to our listeners for sticking with us for 50 episodes. We'll be back soon.