In the high-stakes world of cybersecurity, offensive security experts play a pivotal role in identifying and mitigating potential threats. These professionals, sometimes referred to as “ethical hackers”, use their skills to probe networks and systems in search of vulnerabilities, ultimately helping organizations fortify their digital defenses.

In this exclusive Q&A, we spoke with a seasoned offensive security professional. Benjamin Netter is a cybersecurity expert and the founder and CEO of Riot, a cybersecurity platform created for employee protection. His goal is to protect over one million employees from cyberattacks.

Benjamin shares valuable insights on his career path and the skills required to thrive in the field.

First, what does offensive security mean to you?

To me, offensive security is putting yourself into the shoes of a hacker, taking an outside look at your company and thinking about ways you would hack your company. That’s how I ended up working on Riot and preparing employees for cyberattacks. Most of the time, they are the undervalued vulnerability in companies.

Please tell us where you went to school and what you went to school for.

I went to EPITECH, a software engineering school in Paris. It’s a school that teaches really hardcore programmer skills. EPITECH teaches based on practical cases rather than theoretical cases. There’s no teacher, you have a project to complete before a deadline and you are completely free to manage your time the way you want until that deadline. For the first three years, I was coding probably twelve hours a day in low-level languages.

I also spent my fourth year at Concordia University in Montreal, mostly focusing on AI — before it was cool — back in 2010.

Did you obtain any specific certifications?

I received my master’s degree from the EPITECH but no cybersecurity certifications.

What was your first role in IT?

I was a PHP developer for a startup in Paris, creating a Wikipedia for fashion.

What pushed you to pursue security instead?

I later founded a fintech company called October, which grew pretty rapidly to 110 employees. We were developing a platform lending over €100 million every year to European companies, and part of my role as CTO was to make sure we were safe from hackers. I was investing a ton on protecting the platform (on bug bounties, pen testing and so on). Then, one day, an employee received a phishing email and ended up clicking and entering his password. That’s how we got hacked, and that’s how I realized we didn’t invest enough on protecting the employees.

I decided to work on a side project to better prepare my team for cyberattacks. And that’s how Riot was born. It started as a platform to launch phishing attacks on my employees at October, and the tool was working so well that other CTOs reached out to use it on their team as well. It was at this point that I decided it wasn’t just a side project but instead a real company.

What is the most valuable skill you learned in your role?

Probably to start small. Every big project can start as a side project, something that you can ship in less than two weeks of work. It’s an essential mindset to ship big projects. Otherwise, the amount of work to get to the goal can easily discourage anyone.

What soft skills do you think make a person successful in cybersecurity?

Creativity. Part of our job as cybersecurity experts is to think about how hackers will hack our companies. Hackers are very creative and are always thinking of new ways to attack you or your company. That’s why, if you want to be well prepared, you have to be creative too and think of all the different ways they can potentially hack you.

More from Security Services

Is Your Critical SaaS Data Secure?

4 min read - Increasingly sophisticated adversaries create a significant challenge as organizations increasingly use Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) to deliver applications and services. This mesh of cloud-based applications and services creates new complexities for security teams. But attackers need only one success, while defenders need to succeed 100% of the time. Organizations are contending with an exponential rise in advanced threats that are not only increasing in volume but also sophistication. The IBM Cost of Data Breach Report 2022 found…

4 min read

Rationalizing Your Hybrid Cloud Security Tools

3 min read - As cyber incidents rise and threat landscapes widen, more security tools have emerged to protect the hybrid cloud ecosystem. As a result, security leaders must rapidly assess their hybrid security tools to move toward a centralized toolset and optimize cost without compromising their security posture. Unfortunately, those same leaders face a variety of challenges. One of these challenges is that many security solutions create confusion and provide a false sense of security. Another is that multiple tools provide duplication coverage…

3 min read

Expert Insights on the X-Force Threat Intelligence Index

5 min read - Top insights are in from this year’s IBM Security X-Force Threat Intelligence Index, but what do they mean? Three IBM Security X-Force experts share their thoughts on the implications of the most pressing cybersecurity threats, and offer guidance for what organizations can do to better protect themselves. Moving Left of Boom: Early Backdoor Detection Andy Piazza, Global Head of Threat Intelligence at IBM Security X-Force, sat down with Security Intelligence to chat with us about the rise in the deployment…

5 min read

How I Got Started: SOC Analyst

3 min read - The role of a Security Operations Center (SOC) analyst is crucial in maintaining an organization’s security posture. A SOC analyst wears many hats but typically acts as a watchdog looking out for attacks in progress while also finding ways to boost defenses and prevent or mitigate future attacks. In this exclusive Q&A, we spoke with Ben Philip, a level 3 SOC analyst with Acora, about his background and experience. Did you go to college? What did you study? I went…

3 min read