Tested against real systems.
Offensive security gave me a professional environment where assumptions had consequences. My work included enterprise consulting at EY across software, networks and real-world environments, with the objective of finding paths the system was never designed to allow.
- projects
- 172
- clients
- 42
- findings
- 1,692
- critical & high severity
- 130
The most consequential findings often came from broken assumptions rather than obvious technical failures.
- Business logic flaws
- Making applications behave outside the rules their designers expected.
- Access control bypasses
- Reaching data, functions or privileges a user should never have been able to reach.
- Human and physical weaknesses
- Getting in through people or premises rather than software.




