Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Anand Prakash on cloud security startups and next-gen hacking
Guest:
Anand Prakash
Published:
Updated:
Duration:
29 min
Episode summary
Anand Prakash, founder of startup PingSafe, shares his insights on building a successful cybersecurity business and his experience as a top bug bounty hunter. He emphasizes the importance of fast execution, accountability and learning from mistakes when growing the company acquired by SentinelOne, where he’s now a senior director of product management.
In the latest episode of WE’RE IN!, Anand touches on India’s prominence in global tech – particularly in security research and bug bounty programs – and he shares his personal journey into cybersecurity, which began with a curiosity about hacking at a young age in cyber cafes.
Listen to hear more about:
How bug bounty programs have evolved, with companies now more open to ethical hacking due to increased awareness of data breaches
The viability of government efforts to reduce entire classes of vulnerabilities like SQLi
If AI is effective in improving red teaming and bug bounty hunting
Listen to the episode
S3 E13 · Anand Prakash on cloud security startups and next-gen hackingWE'RE IN! Podcast · 29 min
Key takeaways
Speed and accountability built PingSafe Anand says fast execution let PingSafe build a broad cloud security offering and grow from zero to 100 customers in two years, while holding everyone, including founders, accountable for mistakes.
Demand proof of exploitability When evaluating a cloud security platform, ask whether it is a single platform rather than stitched-together products, and whether it filters noise by sending harmless exploits to confirm findings.
Beta features hide critical bugs Anand's bug bounty success at Facebook came from studying the platform and its APIs so closely that he spotted new or hidden beta features first, where critical issues were common.
Legacy code keeps SQL injection alive He sees SQL injection mostly in large enterprises running legacy systems and languages, and says code review, developer training, and feedback in the IDE would largely address it.
Public storage is still the top misconfiguration Publicly exposed storage buckets and unauthenticated Elasticsearch or MongoDB instances remain common, especially for organizations early in their cloud migration.
Topics covered
Bug Bounty
Cloud Security
Notable quotes
It's like okay to commit a mistake, but then learning from them and moving fast is what I feel like is one of the most important trait why you build a company.
Companies are more like, No one is going to guess the bucket name, right? But you know it's very easy to figure out the name.
…the AI platforms which are built right now, they themselves have traditional vulnerabilities.
If we know, like, how attacker is going to attack first, we would, of course, win.
Questions this episode answers
What should security leaders ask when buying a cloud native application protection platform?
Anand says to check whether it is truly one platform on the back end, because combined point products lose context and miss critical findings. Also ask whether it provides proof of exploitability by sending harmless exploits and surfacing only the top issues to fix. Read this section
How do you become a top bug bounty hunter on a large program?
Through dedication and consistency: keep studying the platform and its APIs even when you find nothing, until you know it better than other hackers and spot new features or endpoints first. Read this section
Why is SQL injection still so common?
Anand attributes it mainly to large enterprises still running legacy systems and older languages. He says proper code review, developer training, and feedback in the IDE could largely mitigate it. Read this section
What are the most common cloud misconfigurations?
Public storage buckets, often left open on the assumption nobody will guess the name, and open ports such as Elasticsearch or MongoDB exposed without authentication. More mature cloud users face issues like subdomain takeover and SSRF. Read this section
Why does India have so many ethical hackers?
Bug bounties pay well compared with many entry-level jobs in India, and many computer science students are drawn to hacking, which leads to ethical hacking and bug bounty work. Read this section
About the guest
Anand Prakash is an ethical hacker and cybersecurity entrepreneur who founded and led cloud native application protection platform company PingSafe, which was acquired by SentinelOne in 2024. At the time of recording, he was senior director of product management at SentinelOne, focused on cloud security, and was based in Singapore. He started bug bounty hunting in 2013 and ranked among the top researchers in Facebook's bug bounty program for several years.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and I'm excited to have Anand Prakash join me on the show today. Anand is an ethical hacker and cybersecurity entrepreneur who now focuses on cloud security at SentinelOne as senior director of product management. He was formerly CEO and founder of cloud native application protection platform company PingSafe, which was acquired by SentinelOne earlier this year. I I look forward to hearing Anand's thoughts on leading this successful startup and how he found major vulnerabilities in some of the world's top tech companies. But first, let's hear a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
Now you you led a team building the PingSafe cloud security platform that was recently acquired by SentinelOne. What lessons can you share for other startup founders and CEOs looking to grow their companies and find success in in what's become a fairly challenging and crowded cybersecurity market?
Yeah. I think a few of the pointers are, like, first... The first and foremost thing that matters a lot while you build a company is, like, fast execution. So if you look at the end of two years, we ended up building very comprehensive offerings in cloud security, CSTMC Synack, Kubernetes security, IaC secret scanning, something called offensive security engine, all in two years of time. And similarly, the DTM side, we grew from zero to 100 customers within two years. What matters is faster execution. Of course, there are other important things like accountability, holding people, folks accountable, even founders if we missed on something. It's like okay to commit a mistake, but then learning from them and moving fast is what I feel like is one of the most important trait why you build a company.
Looking back, when you started versus now, have there been any significant shifts in the market that you've noticed or that, you know, would that... Or does that guidance kinda hold true no matter what the conditions are?
So I still feel like... So when we started, there were cloud security companies who were doing CSPM, KSPM, all this standalone. So we thought of adding context by building a platform and also powering this using my bug bounty intelligence, which I gained over the period of past ten, twelve years. And we ended up building something called offensive danger. So using that, we were able to find exploitable issues in companies' cloud environment, helping companies prioritize at a faster speed so that they really focus on things which really matter rather than noise coming out from traditional CNAPP companies out there. So I still feel like that's still a gap because we are the only cloud security player who does that as of today. And I feel like more and more other players would start building it.
And CNAPP referring to cloud native app protection platform, the kind of the approach that that PingSafe has taken. And, you know, say you're a security leader who's searching for that type of platform. What are some of the important questions to be asking?
Some of the important areas when they are considering buying CNAPP is, first of all, there is so much noise. There are so many point solutions in cloud security. So the first and foremost thing that matters is if they are buying something, is that really a platform? Or is it a product which is built by maybe combining six, seven different products, are really not a single platform on the back end? That's important because if you don't have that, then companies end up missing context. And if they miss context, they end up missing so many critical findings. So this is a unified platform thing, right? Second is the proof of exploitability piece. Does the platform provide proof of exploitability for findings that appear in the platform?
Does it have a mechanism to filter out noise by actually sending exploits like an attacker, like harmless exploit? And then sharing these are the top findings that the customer needs to fix right away.
Right. Right. That makes sense. Now, the differentiation there is really important. And, you know, before founding PingSafe, you mentioned that you did kinda rise through the ranks of some bug bounty programs. As I understand it, you were in the top five or, you know, top three in many cases for Facebook's global bug bounty program for several years. Can you give listeners a sense of what that entails and the kind of work that you need to go into to to to reach that kind of rank globally on a huge program like this?
I think, like, dedication, I started doing bug bounties in 2013. I saw a tweet from that he found security bug on Facebook, and I started doing bounties because of that. But it mattered over the period of time. So things like Facebook was written in PHP at that point in time, and I used to write code in PHP. Right? So I got familiar with Facebook's platform by using Facebook in my college, and I used to monitor Facebook for what all features they are releasing new, are there any hidden features in the app that no one else has access to. So if I see that they have released something new, I will always jump in and see, can I access it? If I am not able to access it, how do I get access to that feature? And the moment I get, I would always find a critical issue because most of the time, the beta features, they are not often released to everyone, right?
Because they are meant to be in beta. So security researchers, they end up finding so many critical findings in them, and that's what I used to do. But in the end, what matters is when I was doing bug bounties initially, was very hard for me to find security bugs in these bigger companies. Really hard. You can't be number two or number three very easily on these boundary platforms where thousands of hackers are hacking continuously because they pay a good amount as well as there is a large exposure. So, what method is consistency. Like, keep on looking for finding. Even if you don't find, you try to become more aware about the platform by going through the APIs again and again. At the end, there will be a day where you will be very familiar with platform than any other hackers, and you will be able to find more findings. Because the moment you see any API or some intrachain, you will be the first one to note it because you are treating like you were actually employed by Facebook.
Hacking for the... Some of these major corporations, Facebook, Uber, Twitter, what were some of the the coolest or most interesting or impactful bugs that you found over your career?
Yeah. So there are a couple of one. So the first one is I'm not sure if you use Tinder, but I could have I could have hacked your Tinder account. You could. So your method just takes and try from your account all the time.
I do not use I do not use Tinder. I have helped friends who've used Tinder though. So I know how bad that would be if you're... Are just forced to constantly... Yeah. Fight the wrong way.
Yeah. Yeah. Then the other one worked like I could have Twittered from any Twitter account. I could have posted from Mark Zuckerberg's profile to any profile with any message out there. So compromise any Facebook account out there, deleted your... Could have deleted your LinkedIn post, any post that you have done.
Please, please do. My LinkedIn posts are terrible. No. Just kidding. That... That's not good. That's very alarming. And in fact, the Twitter point, you know, we've seen bad actors leverage that to move markets. I remember, what was it, in 2016, 2015 era, there was the Syrian Electronic Army explosion at the White House, and president is injured. And the stock market plummeted. That's a huge bug. You don't wanna be tweeting from from from presidential accounts or AP accounts or anything official like that. Yikes. They're fixed now, I hope. Right?
Okay. Well, those those are some pretty blockbuster bugs and takes a lot of dedication and focus, obviously. Yeah. It's interesting. You mentioned joining that field and and kind of exploring security vulnerabilities, finding those on a bug bounty basis back in 2013. Now how has the culture shifted? Because for instance, right now, I feel like it's a pretty accepted point that, you know, a good security testing program is is a very responsible thing to do. You can have ethical hackers scanning for possible vulnerabilities to fix, and and that's like... That's fine, and that's good, and large organizations kinda trust that model. But in 2013, I feel like it was a little bit, why are you on my network? So did you ever have to navigate that in your in your bug bounty days of maybe people pushing back on findings or not appreciating the work you were doing?
Yeah. So there were a lot of times where I found something on the company, and I tried disclosing ethically to the company because they were not having a responsibility to close the program or a bond program. And then I got an email from CISO or from the legal team, like, why were you trying to find that? But this was way early on, 2012, 2013, 2014, right? Now there is a cultural chip when you see so many hacks happening, everyone is scared about data breaches right now, right? So they are much more open. That's what I feel like. Platforms like Synack, HackerOne, they have completely revolutionized the way CISOs used to think about it. For example, the way you run bounty programs, the way Synack runs bounty programs is very, very private, in a private way. So if I was a CISO, I would be more comfortable doing that kind of a program to start with.
So it was not there in the very initial years. So I feel like there are more things that companies could do right now. And there are fewer legal challenges. And the CISOs understand severity of this, so they have of prioritized the way they want to think about this.
Yeah, I couldn't agree more. And it's exciting to see, but, yeah, there's definitely still more to be done. And to that end, on The US side here, the cybersecurity and infrastructure security agency has been trying to kind of beat the drum of better security practices and is leading this big secure by design push. It was actually sent in the one that I noticed as a signatory as a Synack, including a pledge for software manufacturers to, quote, demonstrate actions taken towards enabling a significant measurable reduction in the prevalence of one or more vulnerability classes across the manufacturer's products, end quote. So in other words, they're they're trying to get organizations to reduce entire categories of vulnerabilities. What do you make of that goal? Is is that achievable?
It's a really complex problem. Example of insecure direct object reference. They are very difficult to mitigate at a large scale because mostly these are business logic flaws, logical flaws which lead up to a very large amount of data. Similarly, if you look at software supply chain, if you run any tool out there, you would find thousands of issues right away. Majority of these tools are missing context. If something is getting used in production, deployed in production, if that library is in use somewhere, sometimes what happens is, this is the most common issue with attackers exploit. They claim the library wherever it's all hosted, some of the platforms allow it. And then the library automatically has attackers code inducted.
So wherever the company is using, you can do everything. So I think it's a complex problem, but of course, we'll have to start somewhere. For example, if you look at cross site scripting today, SQL injection today, you would find they are near mitigated to state. Right? You won't find them very often. For example, Facebook had the written library which mitigates cross site scripting and SQL injection by default. HPHP. I think it was called HPHP.
It's funny you mentioned SQL injection because CISA also called out SQL injection in a recent alert. And basically, the alert was like, we've been talking about this since the two thousands as like... I think they referenced it. I think it was MITRE that categorized it as like a quote, unforgivable vulnerability, which maybe is a little harsh. Right? People are gonna make mistakes. It's gonna some... Sometimes weave its way in there. But we've noticed this on the Synack side too of like a huge chunk of folks are still suffering from SQL injection vulnerabilities. Why is it so difficult to stamp out these certain types of fuzz when we know, like you pointed out, we know ways to mitigate them very effectively?
Yeah. Main problem is, like, these three existing older frame, but the bigger enterprises, they are still dragging... Running on legacy systems, legacy code languages. And that's where the issue is most prevalent. So that's the problem. And it's not hard to mitigate if they enable maybe proper code tenor, somebody looking at some kind of training for developers, giving feedback to developers on the ID itself, I think that could be very easily mitigated. But I think it has to do with legacy because I don't see that very common in the newer technologies which are out there.
That makes sense. Yeah. And a lot of organizations from a cost perspective or what have you, it just doesn't make sense yet to to update those. I know I used to cover the critical infrastructure security space, sometimes there's like something that's been on for twenty years and it's like, don't turn that off. We need that. It's like, you know, nobody's gonna update those environments very frequently, because it's costly. The downtime just isn't worth it. Let's talk about cloud security vulnerabilities for a bit. Now, cloud misconfigurations can certainly be a big issue for many organizations. But for those unfamiliar or or or we'll say less familiar with cloud environments, can you walk through, you know, what what a misconfiguration can look like in practice? Why why that is so common?
So the most common one is open SRT. For companies, they end up storing data on storages like S3 bucket. And I've seen this where companies, like, they go to cloud provider, do next, next, next, and make bucket public. Though now that option is disabled, by default, some of the cloud providers show warning when you try to do that. This was one of the current changes. But this is the most common one where the storage bucket is public, and they don't want to fix it. Companies are more like, No one is going to guess the bucket name, right? But you know it's very easy to figure out the name. It might get leaked in some application which is public. Similarly, there are things like open ports. We still see issues like Elasticsearch open to public without any authentication.
MongoDB open to public. Full database open to public without any authentication. So these are some of the issues which are very prevalent. But what I've seen is these are most common with companies who are just adopting cloud journey right now. But companies who are on a very mature cloud right now, they would have other sophisticated kind of issues, like subdomain takeover all the time. SSRF issues coming in. Exploitable TV is coming in.
You mentioned the cloud journey. Right? And and I I feel like there's this notion of digital transformation that's been around for a while. Where are we at with that? Are are are most mature organizations already in the cloud, essentially? I feel like we we we often hear about cloud transformation, but who's who's left to go to the cloud?
No. So I think it's still work in progress. There are companies who were born in cloud who are by default 100% on cloud. Right? The newer companies. But then there are legacy companies, the bigger organizations, where they are still running on hybrid mode. They are using both on prem plus cloud for something, then they are slowly moving from on prem to cloud. Because the way their application were architected long back, they will have to re architect when they move to cloud. So it's definitely going to take some time. And that's when most of the migration happens. Someday, some developer would think that no one is going to see if I make this public. But there are hackers who are continuously looking for it, and they figure it out during migration, even if for a short period of time.
That makes sense. Yeah, that would be a particularly sensitive stage in the process. It's almost like going through an acquisition. There are a lot of other circumstances. Even adopting... I guess, more organizations are turning to multi cloud environments. Right? So you have your cloud, you know, backups available, but tailoring that, that sounds... I'm glad I don't have to do that. Let's put it that way. Nobody's gonna be breathing down my neck for for that sort of work. Now stepping back for a second, we've seen India become a a a really major player in global tech. And I know you're you're based in Singapore. But particularly on the security research side, we've seen a ton of activity, expertise, and interest in bug bounty and pentesting as a service programs. Why do you think that is, and and what do you see coming around the bend for for India's tech ecosystem as somebody who comes from Indian heritage there.
So you must be aware that India has the second largest or largest, I don't know, number of ethical hackers. As far as, I think, Facebook bounty report or something. Right?
Yeah. Yeah. Because thing is bug bounties are a lucrative thing thing from an earning perspective if you compare to some, like, the entry level jobs at majority of the places in India. Right? So basically, the services company. And the other thing is we have so many universities where people offer a computer science degree, and they are so much interested in computers by default. And the first thing that comes to mind, even this happened with me, is hacking. I need to learn hacking. And then it turns to ethical hacking, and then to bug bounty. Right? So I feel like it's a good source of income, as well as gives you a good experience overall. Right? So that's why I feel like so many people are interested in doing this.
Now, you mentioned a little bit how you got into Bug Bounty around that 2013, '20... You know, that time frame. How did you get into cybersecurity in the first place? Tell me a little more about your your background.
Yeah. So that's a weird story. So I was 16, 17 years old. I was studying somewhere. I went to some place in North Of India preparing to get into university. I went to a cyber cafe over there. So, of course, I was not having a computer at home, so there are cyber cafes where there are multiple systems, and you go either play Counter Strike on them or maybe surf the Internet. So I was doing both. Right? There was this something called Orkut at that point in time, the social media site by Google, which Google acquired. So I got to know about the word hacking over there. Like someone wanted to hack account. And I was like, how do I hack Orkut account?
And I Googled a few steps. I Googled how to hack Orkut account, and 10 steps came in. Like, copy this page, post it to our third party website, and send it to your friend. And I posted it as crap, and my friend, they entered the username and password. And this excited me. Then I got into it.
The how to hack, it's funny because that how to hack phrase, it's like one of the most Googled how to hack x is like, you see all sorts of Google results for that, which obviously can have nefarious intentions, but it can also have completely, you know, responsible and ethical intentions of, like, wanting to learn how all this works, which is kind of interesting. I remember, you know, seeing some cyber cafes here and there and... Yeah. May... Maybe not Counter Strike, but there are a lot of lot of other games available too. If you could wave a magic wand and take away one cloud security weakness or vulnerability forever, which one do you think it would be?
That's a tricky one because there are so so many. So maybe I I think the most damaging ones are the ones which are related to security groups and open storage instances, which cause a lot of damage to companies' reputation as well as companies end up being bigger data breaches. So I think these are the two ones. Securing storage and securing instances.
That makes sense. Yeah. Those those could be pretty impactful when they do occur. Now, you knew that we'd have to talk about artificial intelligence at some point in a podcast in 2024 here. How do you see AI shaking up the security landscape for the cloud?
I have seen couple of good companies coming out in AI who are trying to solve for AppSec, Red Teaming. For example, there was an AppSec company which is trying to analyze behaviors across the entire lifecycle and trying to surface issues very early in the pipeline. But I think it's still early. There are innovation has to happen on this front for now. But right now, the state, if you talk about AI, the AI platforms which are built right now, they themselves have traditional vulnerabilities. So I feel like there is a scope for improvement. If you look at the number of API keys being leaked by these AI platforms all across GitHub, GitLab, Bitbucket every day, the number is Huge.
Yeah. I feel like there's been a lot of buzz around AI's specific security vulnerabilities or, like, ways to to steal model training data and, like, inject, you know, poison the well for the actual
Large language models. But on the flip side, like you mentioned, at the end of the day, AI, there's still apps essentially. And you're still gonna have... It's just like Buzz recently was all about API vulnerabilities. Before that, web three vulnerabilities. Now it's AI apps. They're still gonna fall prey to some of the same types of vulnerabilities that you see in other environments. It's just... Yeah. Folks folks have gotta be on guard with those for sure.
This is about API and AppSec where a lot of innovation has to happen on the AI front. But if you talk about endpoint, were the first one, SentinelOne was the first company who did AI. Started doing AI for endpoint ten years back, when no one AI was like an explanation thing at that point in time. And that's been really helping us surface more issues, better outcomes for our customers because of the AI capabilities that we have on the platform. For example, a recent offering around Purple AI, it's really game changing for SOC analysts, for security teams out there. I feel like they're... So endpoint, analyzing endpoint data using AI that was very well tackled by us.
You mentioned AI helping SOC analysts and helping the defender essentially do their work a lot better. But on balance, attackers are gonna be using AI technology as well. Who do you think is gonna benefit more in the near term, we'll say, like in the next year or two, attackers or defenders from AI?
Yep. Cat and mouse. That's how it always goes. Yep. No. It's it's a really fascinating space and really appreciate you sharing some of your your insights across a a wide range of topics, including some that I'm sure the listeners of our podcast who hail from the Synack Red Team, which has a a sizable contingent, by the way, of Indian contributors. So we'll appreciate your insights there. Now, finally, this is something that we ask of everyone who joins on the podcast, and that's what's something that we wouldn't know about you just by looking at your LinkedIn profile?
That's great. That's a great story. And... That that's really funny. That you wouldn't find on Facebook, so that does constitute a fun fact. Well, thanks so much for joining, Anand. Really appreciate appreciate your time here, and good luck out there defending the cloud.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little infosec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
