Skip to content
← all posts
Hot Takes

Root is the product

For those of us on offense, root (full control of the target) is the product. If we're just doing pure offense, that's kind of job done at that point. We've succeeded in shipping our product.

Meanwhile, on the receiving end, they're like: "I sell toasters." This is incidental to what they're trying to do. If it escalates and they get taken down, sure, that becomes core, but that's not real yet. All they've seen is a demonstration of impact.

This is actually a translation problem that we've got. Helping both sides of that conversation have better empathy for where the other one's coming from is the single most powerful thing across the board in terms of consistent impact. It's not a thing that technologists necessarily think about a whole lot, because we're so busy getting shell... which, by the way, is a ton of fun too.

From my conversation with Fede Kirschbaum on XBOW's Offense Taken.

Casey Ellis
Casey Ellis
Hacker, founder, advisor, and pioneer of crowdsourced security. Founder of Bugcrowd, co-founder of disclose.io, principal of Tall Poppy Group. Board member at SRLDF.
bio →

Comments ·

members only