Bug Bounties, Pentesting, and Automated Security Workflows with Trickest’s Nenad Zaric

Partially Redacted: Data Privacy, Security & Compliance

Companies use bug bounties and penetration testing to proactively look for vulnerabilities in their systems. These programs should be part of any security conscious organization.

However, even with these systems in place, it can be difficult to stay ahead of the hackers and potential attacks. Additionally, the tools available for running penetration tests can be complex to run and often require using a combination of tools.

Former pentester and bug bounty hunter Nenan Zaric joins the show to talk about the types of vulnerabilities that companies should be looking for and about how to automate security workflows through the Trickest platform, a company he founded. Nenad's advice from years of cybersecurity work is to be proactive and always attack yourself so that you can find the problems before the attacker does.

Topics:

• Tell me about your history as a former penetration tester and bug bounty hacker. First, what is pentesting and bug bounty hacking
• How did you get into this field and learn the skills necessary to hack into systems?
• What are some of the common mistakes companies make when it comes to security that allows a hacker to penetrate their security?
• How should companies think about protecting themselves and their customer data to prevent such attacks?
• What is Trickest?
• Is the idea of automating security workflows something new? How is this traditionally done and how does Trickest improve on the traditional model?
• What are the common use cases that people are using Trickest for?
• What sort of common attacks does Trickest help prevent?
• Who’s your typical user? Is it a white collar hacker, like a pentester, or is it security professionals within an organization wanting to have an automated system for testing their security?
• Walk me through how to set up an automated security workflow. What’s the output of a workflow?
• How do the ready-made workflows work? What are some examples?
• Where do these security workflows fit with the overall development process for a company? Is this an on-going thing that should be continually run and tested for weaknesses?
• A large amount of attacks have a human element, social engineering and such, how does Trickest help prevent such attacks?
• What are your thoughts on the future of security? Are we getting better at protecting and locking down systems?
• What’s next for Trickest? Anything in the future roadmap that you can share?

Resources:

• Trickest