Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Ozgur Alp, SRT Legend, on the Evolution of Hacking
Guest:
Ozgur Alp
Published:
Duration:
25 min
Episode summary
Ozgur Alp has spent nine years on the Synack Red Team, a run that’s earned him legend status within the community and a front-row seat to how offensive security has changed.
In this episode of WE’RE IN!, Ozgur traces his path from university to Big Four consulting to full-time SRT researcher, and shares his unfiltered take on where AI actually helps in pentesting and where it still falls short.
Which parts of a pentester’s job is AI actually ready to take over? Is the rising cost of AI-assisted testing sustainable long-term? What’s changed the most about offensive security since Ozgur got started?
Don’t miss Ozgur’s nine years of perspective on where hacking is headed next.
Listen to the episode
S4 E10 · Ozgur Alp, SRT Legend, on the Evolution of HackingWE'RE IN! Podcast · 25 min
Key takeaways
Business logic bugs still need humans Ozgur says AI handles technical flaws like XSS and SQL injection well because the signals are known, but authentication, authorization, and business logic issues have no full checklist and remain hard for AI to find.
AI speeds up recon Reviewing obfuscated JavaScript for API keys and sensitive endpoints used to be slow and tedious, and AI can now summarize it in a couple of minutes.
Low-hanging fruit hunting is at risk Ozgur expects hunters who rely only on automation or low-level bugs to lose ground, while researchers who go deep into complex applications will still be needed.
Vibe coding will add vulnerabilities He points to OpenClaw, a hyped project built without security in mind, as an example of why AI-written apps are likely to increase the number of vulnerabilities.
Attackers chain what testers stop at Ethical testers stop after proving one finding in scope, while attackers and AI-powered attack tools use each vulnerability to find and chain others.
Notable quotes
People are talking about all the time about the burnout in the IT, but the real burnout is in the consulting firms.
…the business logic vulnerabilities are really hard to find with the AI because there are no definitions for them, actually.
So it's impossible to remediate all the vulnerabilities, even with the AI, even with the future…
Try to find out how to use AI better and focus on the really complex problems…
Questions this episode answers
Will AI replace penetration testers and bug bounty hunters?
Ozgur thinks hunters focused on low-hanging fruit or pure automation may lose work, with only the best few surviving, but deep testing of complex applications will still need humans because AI loses context on large, complex systems. Read this section
What kinds of vulnerabilities can AI find, and which does it miss?
AI works like a smarter scanner that can reason, so technical flaws such as XSS and SQL injection are easier for it. Business logic, authentication, and authorization flaws are much harder because there is no definitive checklist for them. Read this section
How do you become a full-time Synack Red Team researcher?
Ozgur joined SRT shortly before leaving his consulting job, got reports accepted within his first weeks, and earned the equivalent of a year's salary in bounties within three months, so he kept doing it full time. Read this section
Will AI-powered security testing get cheaper over time?
Ozgur is not sure. He suspects AI companies keep prices low so people get used to the tools, and that costs may rise later unless a major technological change lowers them. Read this section
About the guest
Ozgur Alp has been a member of the Synack Red Team (SRT) for about nine years and has worked as a full-time SRT researcher since leaving consulting. He started his career as a penetration tester at Deloitte for four years after studying computer science. He was SRT champion three years in a row, SRT of the Year in 2021, and Mentor of the Year in 2022, and at the time of recording was focusing more on AI research and development.
Hello, and welcome to the latest episode of WE'RE IN brought to you by Synack. I'm Josh Mason, solutions architect. And today I've got with me Ozgur. Ozgur is one of our SRT, Synack Red Team members, and, has been around for quite a bit. Ozgur, tell folks about yourself.
Yeah, sure. Hello everyone. My name is Ozgur. I am in this Synack Red Team for like last nine years and like fully like doing this as a like full time job after like I resigned from my job while I was looking for another job. I actively entered to the Synack Red Team and things went well and instead of finding an area, I just continued in here, Like maybe eight to 90% of my time, I focused in the Synack. So it was really good for me.
Well, after I graduated, I was looking for like jobs, but I graduated from computer science and on the last semester I took a network security course and I really enjoyed some like, we had some challenges, offensive security challenges like SQLIs, etcetera, as like homework for like a project for the whole semester, so after that, well, I was looking some jobs, there are actually maybe 10 to 20 developer jobs and only one security job in that time, it was not that kind of common on that time. I see the description and I said, okay, I know this stuff from the the security course that I had in the college. Let's apply it, and I started like that.
After graduating, like, four years. Four years, I worked in a consulting firm as a penetration tester. After four years, it was done for me because like working in a consulting firm, it was one of the like big four, and it was like really struggling, lots of works, like the hard working times, like the projects are which... It was a really good experience actually. If I start like my career today again, I will start like this again because I have a lot of like good things from that job that I compare for my career. So it was a good start, but four years is okay.
Yeah, yeah, yeah. So lots of stuff, lots of projects. It's really good for the start, but after some time, like you are just like, it's a real burnout actually. People are like talking about all the time about the, like, burnout in the IT, but the real burnout is in the consulting firms.
The process was like completely different nine years ago. It was actually harder on that time because like the challenge were really strict. At the moment, you can like... Within the AI, the technical challenges are like really easy to solve, like comparing to the back. Like nine years ago, Synack had like some technical actually questions which you cannot answer directly within the Google search or like within the AI at all, so it was really tough to enter, but I entered somehow and on that time it was like really limited capability, so I applied it maybe three or four months ago before I resigned, so after I resigned while I was like looking other jobs, after one month I get bored, I wanted to do some work, and I said, okay, let's look into some stuff in the Synack, like what can I do?
And after one week, I got one report accepted, so like it was a really good time for me. I said, it's a good money, it's a good start. The second day, my second vulnerability is also approved, so like after two or three weeks, I got really good money comparing to like another job, and I said, okay, if I can make this one sustainable, then why should I have a job since like we are working all of the... For because of the money. So after three months, I made the like bounty of the potential one year salary. So after that I said, okay, let's continue with the like Synack because getting a job is like worse comparing to the like the real salary. So I continued on that. After that, on that time we had some challenges in the Synack, we had some competitions.
For the last three or four years after COVID, Synack stopped doing that, but on that time we had some like, it was like a life hacking events we had on that time. So there was, the first one was in the Mexico and I get go to the Mexico with the Synack. After that year, we did it in the Bali, I go to the Bali too. So after that, the third one was in the Costa Rica, and the Costa Rica event was different because it was not like just a... It was not an award for the holiday. Did hacking challenge in the Costa Rica too within an award over the last two days, like the most submitted vulnerabilities. So I get the first SRT champion on that year too. So I had awards three years in a row as SRT champion.
After that one, Ryan stopped doing the challenges because I was winning them all. So he changed the full concept. On the last year, I also got the SRT of the Year in the 2021, in the 2022, I got the Mentor of the Year because like I started mentor, a lot of mentoring stuff. After 2003, I become like less active, but not in the just SRT, but in the terms of the job, I started working less actually. I still work in the SNC, but for the last six months, I focused more on the AI stuff in the research of the development instead of the like direct defining bugs. That's- Nice. That's my main story in the Synack.
Wow. It's quite, quite a story. You are you are one of our top SRT members and we're glad to have you. What is... Is there... Sorry. Is there a specialty when you're doing bug bounty or when you're looking at one of the missions that's available on Synack? Is there something that you look at that makes you want to work on that piece?
Do not do missions too much, but I focus mostly on the like finding vulnerabilities. The main thing is actually I am looking into the like authentication and authorization stuff mostly on the back of the time, but not like low level ones, but the real critical ones, the real like the business bugs that, like, no automation can find. I am still not an automation guy. Most of the time I didn't use any scanners. I did my recon and, like, all of the... My exploitation stuff by manual tests. Also, I still use, by the way, an old version of the Burp. It is, like, 1.7... After one point seven point three seven, I think, it's upgraded to the second, and the whole concept was changed, but within the manual testing, actually, the old burp had, like, really good functionalities, which is the second, like, the new burp that doesn't have.
So I am still going within the old fashioned way, but at the moment, I am really struggling automation within the AI because, like, I'm not that kind of automation guy, but since like all industry is going on that side, I am also trying to do something different, like manual testing with AI actually, not within the automation, I am like trying to do that at the moment, but still AI is one kind of automation, which is I think hard to do, not my style.
Yeah. You've actually written a Medium post, a blog post recently about AI and its effect on pentesting and bug bounty. How do you see AI working? Or either is it going to replace pentesters? Is it going to help you all? It sounds like it has its own struggles.
Yeah. Well, does it change to the whole, like, software development system? Yes. Because, like, the vibe coding is real and maybe for the last years, nobody is like coding anymore. AI is not doing this job by its own. For example, I am not a developer, and when I try to do huge projects within the AI, I really struggle because I have experience in the security area. Vibe coding is nice, but still for using it, it's really productive. We need still developers or like product designers. So on the bug bounty area, it's the same. If you do not have any security knowledge within just the use of AI, you can find vulnerabilities, but not all of them.
Human interaction is still needed to go further and deeper. At the moment, yes, AI is really helpful in terms of the recon. For example, normally analyzing a JavaScript file for looking for like the sensitive API keys or like sensitive endpoints from that JavaScript file is really struggling for us. Sometimes you are going blind, like looking into the, like the all obfuscated code. However, the AI, you are just giving code to the AI, and in the two minutes, it's like summarizing everything you look for. So, like, it's a really great technology. However, you can use it on whole of the different process.
Interesting. Is there kind of a flavor to the things that AI is good at finding versus the things that, a human with experience like you is better at finding?
AI is like similar to the actually automated vulnerability scanners. It's like just smart... Smarter one. It's not just looking into the deterministic way, just the scanners do, but it also thinks and makes reasoning about it. But still, the technical vulnerabilities are easier to find within the AI. However, like the authentication authorization stuff, or the business logic vulnerabilities are really hard to find with the AI because there are no definitions for them, actually. There are no full checklists to check for a business logic. Like it's actually indefinite reasons that can be exist for a vulnerability. Like for example, for an XSS, it's easy.
If you do not sanitize input, you can execute JavaScript, or in the SQLite, it's easier to find within the NAI to analyze it, but because you know exactly what to look in the response and how to analyze it, but for the business logic vulnerabilities, at least at the moment, it's near impossible. Not impossible, but hard, we can say.
Interesting. Interesting. You've been following a lot of the companies that are claiming to be AI pentesting full bore, if you will. Have you noticed any of the things that they've announced of finding that has surprised you? Or is there anything that... Or does it rather kind of follow what you've been saying here?
Well, they're actually finding some really good vulnerabilities in the production systems. For example, like one company find a vulnerability in the Salesforce, which has a bug bounty program and like is active for many years and nobody has find it before, so it's really good. However, it's like the same in the all the offensive security sector, like let's go with the Google, they have maybe hundreds of the security engineers in here, in their headquarters, both in the defensive and the offensive. Plus, they have probably external consultants for the pentesters. Plus, they have vulnerability vulnerability robot programs. Even Google said like three or four years ago, they said they burned out the XSSes.
They said there will be no XSSes at all because we figured out how to solve it systemically. And after two years, one guy finds an XSS vulnerability in the main google.com in the search area. So it's impossible to remediate all the vulnerabilities, even with the AI, even with the future, because now coding is with the AI and security is also with the AI. There will be, like, the human perspective still will be unique.
There is a lot of hubbub, a lot of talk recently about mythos and a lot of the news and the talking heads are talking about how attackers are going to have access to more powerful AI. What's your take?
Well, actually, it is definitely because within the AI powered attack... This is actually different from the, like, the real attacker sites and the, like, our sites. We are looking for only vulnerabilities, which is in the scope, actually. Attackers don't. Attackers are only think... Have actual reasons, not like us, and they are trying everything. So they also use like social engineering. They are using leaked API keys. If we find, for example, one API key leaked, we only report it. We do not go with the further, or if we find an SQLite or like path traversal, etcetera, we only read one file and show it, and that's done. However, the attackers and also probably the mythos is not doing that.
It wants one vulnerability, it changes it with other ones. It uses that vulnerability to find other ones too. So that is where the game changed actually from the attacker side and our side.
Interesting. Do you think it would be helpful for teams or organizations like SRT to have access to certain AI tools? Or do you feel like that's already happening and teams already working on stuff?
Definitely. I would actually love to have a real AI agent with me in the Slack to work with in the future because when you have it, you both have your perspective and its perspective too, you do not need to do a Google search and read like 100 pages to learn that stuff. If you just use the AI agent to summarize like the all the endpoints that technology has, and just scan them and show me the results. The pace is really good in here. So it's really definitely useful.
Very exciting. I know we have recently released Sara Synack's agentic tool, a lot of several customers have started to use it. Have you noticed any change as an SRT member to missions or opportunities?
I know when we first announced Sara, some SRT members were worried that it was going to fully replace our researchers. Have you found that that's a reasonable thing? Or
In in the future, actually, probably, the looking for the low level bug hunters will lose probably their jobs or, like, the guys only uses automation to find CVEs, etcetera. Maybe not lose the whole job, but maybe only the best one or the best three or four will survive because they will use AI too within their automation. Rather than that, only looking for the low hanging fruits will be not a good technique anymore. However, looking for the vulnerabilities still, like going into the deep ones will still be okay, I think. Because, like, still on the vibe coding sites, if you, like, code only one hour or two hour, it's good. It is giving a really good project, but after some time, it loses its context.
So it's starting reading it again and going and over and over. It's same in the security too. It is good for the like middle level stuff, like the technical stuff, but when the context is huge, when it's really complex banking applications, which uses different kind of functionalities, like the installments, like the stock options, etcetera, probably it may lose its context.
Well, like the increase of the AI is really fastened, the increase of the technology too. I do not see this one is like it will end our jobs in the offensive security side. And on the opposite, when the vibe coded apps increased, there will be more security vulnerabilities too. Like, just let's go with, for example, OpenClaw. It's a really good project, and it's hyped over in just one month. However, it has like lots of vulnerabilities because security was never actually a thing when it is developed because the guy who developed it, they didn't think about the security, because he didn't think that it will be this kind of really common and, like, got hyped.
So, if the coding person who uses AI takes a security as a measure, it will be secure. However, most of the people do not think about the security when they are developing the application. I think we will have like more vulnerabilities in the future comparing to today. However, they will detect it still within the AI. So it will be, like, really different area... Era in the future, actually.
Nice. I'm... Kind of the theme I'm hearing is with new tools for development, there's still the same issues of not developing securely. And with speed and lack of deeper context, there are still gonna be vulnerabilities.
And then just to make sure I, I'm understanding, even on the offensive side, we're gonna see more tools and that's going to kinda raise the bar for people who don't know how to use the tools or who can't keep up with the tools. But there's always going to be more advanced business logic and more technical deep dive that tools, even AI, is going to struggle with compared to experienced researchers.
For example, like I have like some code, like vibe coded for a project. I have like 50,000 like lines of the code in that project, I am just saying that okay, let's scan the whole code to find bugs, not the security bugs, but like the bugs in the code, It finds like lots of stuff. I say, okay, let's fix them. The agents fixed them. Okay. I said, okay, let's look it again, and it finds again and again. So on the first one, it didn't manage to find them all. It will be more in the regular pentesting too. So maybe the advantage of the usage of the AI is you can use it like twenty four hours is the biggest advantage, but on the response, you need to pay for it, actually, a regular person.
So in the future, will it be more cheaper or expensive? I don't know. I'm not sure it will be more cheaper because at the moment, I am thinking, like that's my opinion, I am thinking the AI firms are making AI systems cheaper to all the people get used to it. However, after ten years, when we do not have another alternatives, it will be more expensive because it's not sustainable, or some big technological revolutions we need to find out for the really decreasing the cost of the AI.
Great great insights there. Ozgur, I like to keep these at about typical, you know, drive to work length. So we're about at time. This has been really insightful and really fun. I appreciate you joining me.
In terms of the bug bounty, do not get hyped over, we are so over, we do not have, we will not have jobs anymore in the future, but just try to adapt to the new technology like always. Try to find out how to use AI better and focus on the really complex problems which you can solve with the AI in the future. Awesome.
