May 11, 2023 By Mark Stone 3 min read

In the high-stakes world of cybersecurity, offensive security experts play a pivotal role in identifying and mitigating potential threats. These professionals, sometimes referred to as “ethical hackers”, use their skills to probe networks and systems in search of vulnerabilities, ultimately helping organizations fortify their digital defenses.

In this exclusive Q&A, we spoke with a seasoned offensive security professional. Benjamin Netter is a cybersecurity expert and the founder and CEO of Riot, a cybersecurity platform created for employee protection. His goal is to protect over one million employees from cyberattacks.

Benjamin shares valuable insights on his career path and the skills required to thrive in the field.

First, what does offensive security mean to you?

To me, offensive security is putting yourself into the shoes of a hacker, taking an outside look at your company and thinking about ways you would hack your company. That’s how I ended up working on Riot and preparing employees for cyberattacks. Most of the time, they are the undervalued vulnerability in companies.

Please tell us where you went to school and what you went to school for.

I went to EPITECH, a software engineering school in Paris. It’s a school that teaches really hardcore programmer skills. EPITECH teaches based on practical cases rather than theoretical cases. There’s no teacher, you have a project to complete before a deadline and you are completely free to manage your time the way you want until that deadline. For the first three years, I was coding probably twelve hours a day in low-level languages.

I also spent my fourth year at Concordia University in Montreal, mostly focusing on AI — before it was cool — back in 2010.

Did you obtain any specific certifications?

I received my master’s degree from the EPITECH but no cybersecurity certifications.

What was your first role in IT?

I was a PHP developer for a startup in Paris, creating a Wikipedia for fashion.

What pushed you to pursue security instead?

I later founded a fintech company called October, which grew pretty rapidly to 110 employees. We were developing a platform lending over €100 million every year to European companies, and part of my role as CTO was to make sure we were safe from hackers. I was investing a ton on protecting the platform (on bug bounties, pen testing and so on). Then, one day, an employee received a phishing email and ended up clicking and entering his password. That’s how we got hacked, and that’s how I realized we didn’t invest enough on protecting the employees.

I decided to work on a side project to better prepare my team for cyberattacks. And that’s how Riot was born. It started as a platform to launch phishing attacks on my employees at October, and the tool was working so well that other CTOs reached out to use it on their team as well. It was at this point that I decided it wasn’t just a side project but instead a real company.

What is the most valuable skill you learned in your role?

Probably to start small. Every big project can start as a side project, something that you can ship in less than two weeks of work. It’s an essential mindset to ship big projects. Otherwise, the amount of work to get to the goal can easily discourage anyone.

What soft skills do you think make a person successful in cybersecurity?

Creativity. Part of our job as cybersecurity experts is to think about how hackers will hack our companies. Hackers are very creative and are always thinking of new ways to attack you or your company. That’s why, if you want to be well prepared, you have to be creative too and think of all the different ways they can potentially hack you.

More from Security Services

How a new wave of deepfake-driven cybercrime targets businesses

5 min read - As deepfake attacks on businesses dominate news headlines, detection experts are gathering valuable insights into how these attacks came into being and the vulnerabilities they exploit.Between 2023 and 2024, frequent phishing and social engineering campaigns led to account hijacking and theft of assets and data, identity theft, and reputational damage to businesses across industries.Call centers of major banks and financial institutions are now overwhelmed by an onslaught of deepfake calls using voice cloning technology in efforts to break into customer…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today