The real real. Being a security expert is dangerous. If you work for a company as the chief of security you're almost assured to be either fired for failing t

The real real. Being a security expert is dangerous. If you work for a company as the chief of security you're almost assured to be either fired for failing to stop a hacker, or put in jail for failing to disclose that you failed to stop a hacker. Understanding the risks when developing code is good, but if you let on that you know how to do something as simple as phishing for the red team you run the risk of being fired. I was working for a company from start up (I was 4th dev hired). I worked for them for 8 years, and the founders and I had eaten lunch together almost every day. I had the keys to every door. The CTO asked me to do a fake attack. I did a totally external (using only linked-in learned stuff) tiny phishing, and collected a pile of passwords. I got in trouble from the CEO, and HR got involved. I mean I had write access to the DB, I could have changed every password. I had held the CEO's 1 week old kid. I loved the company and mission. Still there was an issue of trust. The CTO said sorry to me, but I wouldn't repeat the exercise. Being security is dangerous.