Thoughts on Pentesting as a career

So, I tried for about a month to get a job as a pentester in the UK recently and I was unsuccessful even with an OSCP and VHL+ to my name and I realised that there really are not many jobs for this kind of work and the jobs that are available for this work have a short supply for junior pentesters or folks just starting off. Which I think is a real shame because this industry really isn’t easy and requires similar intellectual acumen to say a lawyer or a doctor.

I would argue that there is no barrier with how good you can be at pentesting because it requires a vast range of skills from programming, reverse engineering, networking etc. Just look at a machine from HacktheBox that is rated as insane, and you will see how difficult some machines can really be. Granted these are not real machines, but it would give some idea on the level of intellect needed to compromise a machine. This might be why imposter syndrome is so common in this industry. I will also just say that this industry right now is fairly new and therefore it’s a lot smaller than some of the other industries in tech.

I also realised that companies really cannot tell how much value a pentest really has. They do not know if they did not find anything because their cyber security is really good or the company providing the service is just incompetent. It is just difficult for a company to really tell. Yet I feel that there will be greater investment into this kind of thing in the future especially with the rise of ransomware attacks for businesses.

It is also important to note that most organisations want to defend against ransomware groups as that’s really the main threat these days. But for a pentesting company to really simulate such a group they need to have inside information into the tools and techniques that these ransomware groups use. So, I really question how valid attack simulations that attempt to mimic what a real ransomware group would do when there is little information out there publicly on the tools and techniques that these ransomware groups employ to compromise a business.

The risk in the future will only get bigger and bigger in my eyes because with the recent print nightmare vulnerability and the delay that it took for Microsoft to get a patch out illustrates that all companies are prone to cyber incidents. No company is exempt. Which is why I think that computer security research is an industry that needs more people in because if the vulnerabilities get in the wrong hands, then the chaos that it could bring to the world would be astronomical.

These are just my two cents, hope it was not too boring.