WE'RE IN!

In this episode of the We're In Podcast, host Ryan Rutan Synack's Sr Director of Community sits down with independent security researcher and Synack Red Team member Malcolm Stagg.

Malcolm breaks down his origin story-from software engineering at Microsoft and DARPA hardware challenges to discovering NATJack, a novel class of network address translation (NAT) manipulation attacks.

Learn how attackers can hijack DNS and TCP sessions, bypass container isolation, and exploit Linux Netfilter flaws-plus practical mitigations you can implement today.

Learn more about NATJack mitigations & research: https://natjack.io

Join the Synack Red Team: https://www.synack.com/red-team/

Chapters:

00:00 - Introduction: Welcome to the We're In Podcast

02:27 - Breaking Hardware: The DARPA SSITH Challenge

06:02 - AI in Cybersecurity: Promise, Limits, and Triage Fatigue

08:44 - Introducing NATJack: Exploit Assumptions in NAT Tables

17:20 - Why NAT is Everywhere: Hypervisors, Containers, & Cloud

22:29 - Extending Attacks to TCP Connections & Session Hijacking

27:25 - DoS & Port-Scanning Vectors via Router Assignment Habits

30:39 - The Limits of Modern Infrastructure

34:34 - How to Mitigate NATJack: Strong Encryption, RPF, & Sockets

37:48 - Where to Learn More & Closing Remarks

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

In this episode of WE'RE IN, Josh Mason sits down with SRT member Austin, a rising star on the Synack Red Team. Austin shares his hacker origin story and pulls back the curtain on what it takes to break into elite researcher programs. He also deep-dives into his recent "heavy hitter" win: using a JSON Web Token inspection to completely demolish the authorization schema of a U.S. financial services platform, gaining full administrative control.

 

TIMESTAMPS:

00:00 - Introduction

00:39 - A Day in the Life of an SRT Hacker

02:08 - Fast Track to Synack Red Team Level 5

03:12 - Hacker Origin Story

04:40 - Mentorship in Synack Red Team

05:46 - HackerOne vs. Synack: Why Synack is Better for Researchers

07:02 - How Patch Verifications Actually Work

09:16 - Compromising a Financial Platform via JWT

11:10 - Advice to Join the Synack Red Team: Get your OSCP

12:32 - Advice to Cyber Newbies: Always Keep Learning

14:14 - Hunting Authorization and Injection Issues for Synack

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

On this episode of WE'RE IN, Josh Mason sits down with Ty Bross, Offensive Security Lead for Sidekick Security and Researcher for the Synack Red Team. Ty discusses his teenage hacking origins, how he broke into the cybersecurity profession, his favorite hacks, and advice to aspiring penetration testers.

 

Chapters:

00:00 Introduction

01:50 Understanding Business Logic Vulnerabilities

03:44 Hacker Origin Story

08:18 Joining the Synack Red Team

09:32 Staying Sharp by Hunting for Bugs

11:00 Supplemental Income with The Synack Red Team

11:43 Collaboration with the Synack Red Team

16:37 Chaining Small Exploits Together

17:50 Advice to Aspiring Synack Red Team Researchers

20:54 What Customers Don't Know About Pentesters

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

In this episode, host Josh Mason chats with Synack Red Team Legend Ozgur Alp, who shares his offensive security journey from university to big four consulting to full-time Synack Red Team researcher. Ozgur gives his unique take on where AI excels (and falls short), which roles AI will replace, and whether the cost of AI is sustainable in the long-term.

 

Chapters:

00:00 Introduction: Meet Ozgur

03:28 Joining the Synack Red Team

07:13 Critical Authorization and Authentication Bugs

08:03 Why Ozgur Still Uses Burp 1.7.37

08:32 Pentesting with AI and Automation

09:12 Will AI Replace Human Pentesters?

11:53 Why AI Struggles with Business Logic

13:45 Why Google Can't "Solve" XSS (Even with AI)

14:47 How Mythos is Changing Offensive Security

16:15 The Benefits of Hacking with AI

17:09 How AI is Changing Pentesting

19:42 Vibe Coding is Creating More Security Vulnerabilities

23:11 Is the Cost of AI Sustainable Long-Term?

23:51 Closing Remarks

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Josh Mason sits down with Tim Nordvedt, Synack's Senior Manager of North American Solutions Architects, to discuss his unique cybersecurity origin story, the power of networking, automating attack surface discovery, and why "falling in love with learning" is the only way to survive an AI-driven security landscape.

Chapter Timestamps

00:00 Introduction: Meet Tim Nordvedt

01:05 Security Origin Story

02:36 The Commodore 64: A Forgotten Connection to Tech

03:35 The Classroom Moment: Discovering Offensive Security

04:54 Collecting Certs and Networking Like Crazy

09:37 Reframing Imposter Syndrome: Skills are Never Wasted

10:34 Lessons as a Bike Mechanic: Translating Technical Value

14:31 Trying Out for the Synack Red Team (SRT)

15:29 Transitioning to Solutions Architecture (SA)

18:40 Building Tools: Automating Attack Surface Discovery (ASD)

21:48 Proactive Defense: Providing Value to Customers

25:14 Career Advice: Fall in Love with Learning

25:39 Upskill for the Future: AI and Agentic Red Teaming

26:43 Closing Thoughts

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.