Skip to Main Content

Martin Bos

EXPERIENCE

In 2007, Martin Bos stumbled upon hacking and penetration testing. Intrigued by the parallels between exploiting vulnerabilities in computer systems and the technical intricacies of professional audio equipment, Martin decided to venture into the security field. He started as a junior penetration tester, where his relentless dedication and ability to think outside the box quickly set him apart. His professional sound background played a pivotal role, allowing him to approach security challenges with a unique perspective.

Martins’ knack for full-scope penetration tests, red team exercises, and crafting innovative solutions earned him recognition within the InfoSec community. He climbed the corporate ladder, transitioning to more senior roles. Along the way, Martin honed his skills in risk assessment, incident response, and security architecture. His ability to draw parallels between networking and audio systems continued to influence his approach, enabling them to uncover vulnerabilities that others might overlook.

As CSO, Martin has orchestrated a cybersecurity strategy that integrates his diverse background to bridge the gap between technology and creativity. Drawing on lessons learned from his previous experiences, Martin always emphasizes the importance of resilience, adaptability, and collaboration in the face of evolving cyber threats.

In day-to-day operations, Martin oversees project execution and delivery for Technical Services, Advisory Services, and Remediation Services. Martin’s primary expertise is in full-scope penetration testing, red team-style engagements, and other areas of testing that require a non-standard black-box approach. With over 15 years of experience doing attack simulations and a number of years in other aspects of security and networking, Martin brings a wide range of unique skills, threat models, and attack methodologies to every engagement. Additionally, Martin is also considered an expert in password recovery methodologies.

EDUCATION & CERTIFICATIONS

Associate of Science, Computer Networking Services, ITT Technical Institute

PROFESSIONAL AFFILIATIONS

Martin Bos is a founding member of Team Hashcat, which competes every year in the DEFCON “Crack Me if you Can” Password Cracking Competition:

  • 2014 - 2nd Place
  • 2013 - 1st Place
  • 2012 - 2nd Place
  • 2011 - 1st Place

INDUSTRY CONTRIBUTIONS

Martin Bos was a co-founder of the DerbyCon Security Conference, a former developer for Backtrack/Kali Linux, and co-author of smbexec. Beyond his corporate responsibilities, Martin has become a respected figure in the InfoSec community. He frequently shares his insights at conferences, produces thought-provoking articles, and contributes to open-source security projects. Martin continues to emphasize the value of interdisciplinary learning, encouraging aspiring security professionals to embrace diverse interests and unconventional paths.

PASSION FOR SECURITY

Martin works extensively with clients to help understand where and why their defenses failed and, more importantly, how to remediate the issues. For this reason, Martin is passionate about testing the security posture of organizations with all of the defenses and security controls in place. While working in the security field, Martin has conducted penetration testing against a large number of Fortune 500 companies in varying business verticals such as financial institutions, retail chains, casinos, manufacturing, and education.

Featured Blogs And Resources

Discover the blogs, analysis, webinars, and podcasts by this team member.

Blog November 07 2023

The Triforce of Initial Access

LootWhile Red Teamers love to discuss and almost poetically describe their C2 feature sets, EDR evasion capabilities, and fast weaponizing of N-day exploits,…

Read about this article
Blog November 02 2023

JS-Tap: Weaponizing JavaScript for Red Teams

How do you use malicious JavaScript to attack an application you know nothing about?Application penetration testers often create custom weaponized JavaScript…

Read about this article
Blog October 17 2023

A Hitch-hacker's Guide to DACL-Based Detections (Part 3)

This blog series was co-authored by Security Consultant Megan Nilsen and TAC Practice Lead Andrew Schwartz.1    IntroductionIn this third and final…

Read about this article
Blog October 12 2023

A Hitch-hacker's Guide to DACL-Based Detections (Part 2)

This blog series was co-authored by Security Consultant Megan Nilsen and TAC Practice Lead Andrew Schwartz.1    IntroductionThis is a continuation of A…

Read about this article
Blog October 11 2023

A Hitch-hacker's Guide to DACL-Based Detections (Part 1B)

This blog series was co-authored by Security Consultant Megan Nilsen and TAC Practice Lead Andrew Schwartz.1    IntroductionIn this continuation to our first…

Read about this article
Blog October 10 2023

A Hitch-hacker's Guide to DACL-Based Detections (Part 1A)

This blog series was co-authored by Security Consultant Megan Nilsen and TAC Practice Lead Andrew Schwartz.1    IntroductionIf you were to collectively ask any…

Read about this article
Blog September 21 2023

Basic Authentication Versus CSRF

I was recently involved in an engagement where access was controlled by Basic Authentication. One (1) of the findings I discovered was a Cross-Site Request…

Read about this article
Blog September 18 2023

Okta for Red Teamers

For a long time, Red Teamers have been preaching the mantra “Don’t make Domain Admin the goal of the assessment” and it appears that customers are listening.…

Read about this article
Blog September 05 2023

Creative Process Enumeration

Very often in engagements, you'll want to list out processes running on a host. One thing that is beneficial is to know is if the processes is a 64-bit or…

Read about this article
Blog August 31 2023

Crafting Emails with HTML Injection

Have you ever wanted to send an email from a domain you don’t have SMTP credentials for? With some HTML injection, we may be able to do just that. From time to…

Read about this article

Empower your business through better security design.

Talk directly with our experienced advisory consultants to learn how we can help.