4 ms·
I used to be in security auditing. I don't know about market saturation – that would depend heavily on your location, as it often requires some face-to-face dis
by wvh 9y ago
I used to be in security auditing. I don't know about market saturation – that would depend heavily on your location, as it often requires some face-to-face discussion – but I think for security the saturation is less relevant than your credentials. Once a company decides to spend some money on outside security, they tend to go for a name-company with good credentials and certifications such as approval for PCI-DSS compliance checking. Once you provide the needed services, your name needs comes up as one of the go-to companies. Reputation and word-of-mouth are pretty important. For instance in the CC and banking sector companies are very aware whose services are being used by other companies. No company wants to give a good chunk of money away on something as sensitive and invasive as security checks without being sure they're receiving quality service and not some random script-kiddie with an automated security scanner.
If your company (or the company you want to work for) floats up as one of the top security firms in your region, you will probably get a lot of business. If you start from zero with no reputation, you're going to have fight hard to get your name on the map.
- quadcore 9y agoNaive question: what if you just hack your prospect, without causing unrecoverable damages and show them you've hacked them, do they hire you? EDIT: ok thats illegal but isnt it in the interest of the prospect to hire you more than seeing you in jail? Also, I was wondering if there were some loopholes or field practices one can use to hack for being hired? Something like: "I may have hacked you, do you wanna hire me?" Just curious, because it seems to me every company should welcome that. I might be wrong.
- deleted 9y ago[deleted]
- n33nj4 9y agoAlmost certainly no. If they have a bug bounty program they will pay out through that, but attacking a company of any sort that does not have an open program is a good way to get prosecuted.
- g-clef 9y agoNot only is hacking them illegal, but trying to sell them services after that could easily be seen as an attempt at blackmail. It's a profoundly bad idea.
- hdhzy 9y agoWhat if you beat up a person, lightly, to show them they are weak, and then offer your body building / fighting training, do they hire you? :)
- quadcore 9y agoWell in that case, unrecoverable damages are caused whereas in many ways you can hack - or penetrate - without causing any damage. I guess.
- hdhzy 9y agoWhat if you break into someone's home at night, unnoticed and ask if they want an advice on how to stay safe, do they hire you? No damages made!
- simonswords82 9y agoA more accurate analogy is that you contact the home owner and advise them that their home is at risk of being broken in to because of whatever security they're lacking. No need to actually break in to the home, just point out the vulnerabilities.
- hdhzy 9y agoOkay but you need to check if they are vulnerable. I think the owner wouldn't be happy with people fiddling with his locks to check if he is vulnerable. The correct solution is the same as for pentesting: ask for permission first.
- erichurkman 9y agoIf you want to try that route, there's an ethical way: look for companies with vulnerability disclosure programs on HackerOne or Bugcrowd. Being well-written in your interactions with companies on those platforms would go a long way in improving your credibility.
- martenmickos 9y agoSign up here: https://www.hackerone.com/resources/hack-learn-earn https://www.hackerone.com/resources/hack-learn-earn
- elyrly 9y agoSign Up here - https://bugcrowd.com/user/sign_up https://bugcrowd.com/user/sign_up
- wvh 9y agoI've done this long ago to one of the companies I had worked for before – as in pointing out major holes, not taking over anything – but I think it's not a good idea if you don't have any previous relationship at that company and don't know anybody there. It's a huge risk. It doesn't give people a good feeling to be criticised, or to notice others are sneaking around their livelihoods... Imagine someone sneaking around your car to check if any doors are open. Even if you just want to helpfully point something out, you have given people a bad vibe that is surely not going to help you to get hired.
- phaus 9y agoI'm a security analyst at an MSSP with hundreds of large companies as customers. The typical response would be to press charges and try to send you to prison.