Ethical Hacking: Finding Security Gaps Before Attackers Do | Ep 335 | DevReady Podcast
How can ethical hacking help businesses uncover security gaps before attackers exploit them? In this episode of the DevReady Podcast, Victor Hanna, Director & Chief Hacking Officer of Exploit Security, joins Anthony Sapountzis, CTO and Co-Founder of Aerion Technologies and DevReady.Ai, to explore penetration testing and the value of ongoing security expertise. Their conversation covers connected devices, physical security, ageing infrastructure and the risks emerging from AI-assisted software development. For technology leaders and organisations seeking specialist support, Victor explains how an attacker’s perspective can help teams understand their exposure and strengthen their defences. Curiosity has shaped Victor’s journey from IT support, systems administration and networking into ethical hacking and business ownership. He introduces Exploit Security as a boutique offensive security consultancy with particular strengths in IoT and hardware hacking, alongside web application and physical security testing. Reflecting on his decision to establish the business, Victor describes the challenge of applying his experience independently and building relationships with clients and partners across Australia. That curiosity continues to inform his approach to investigating systems, questioning assumptions and uncovering overlooked weaknesses. Victor explains how ethical hackers use the techniques of malicious attackers during authorised assessments to identify ways an organisation could be compromised. A phishing link or stolen credentials can provide an initial foothold, while social engineering and physical access can create further opportunities. Through examples involving impersonated IT personnel, malicious USB devices and modified charging cables, he illustrates why security assessments need to consider people, processes and technology together. Anthony and Victor also discuss the consequences of a breach for revenue, reputation and customer trust, reinforcing the value of layered protection. The conversation extends to operational technology and legacy environments, where outdated firmware, unsupported systems and overlooked maintenance can leave vulnerabilities unresolved. Victor advocates involving security specialists early and maintaining visibility across the systems an organisation depends on. AI adds another dimension to that challenge: drawing on discussions he attended at DEF CON, he reflects on an account of AI agents coordinating and exploiting weaknesses in a testing environment. The discussion explores oversight of agent behaviour, zero-day vulnerabilities and responsible disclosure, including the importance of giving vendors time to address security findings. As AI-generated software and vibe coding become more common, Victor highlights the risks of overlooking authentication, permissions and data protection during development. He describes how Exploit Security works closely with clients to assess weaknesses, prioritise relevant Common Vulnerabilities and Exposures (CVEs) and understand how vulnerabilities could combine into an attack. This ongoing advisory approach supports teams as their software and security needs evolve. Penetration testing then helps validate protective measures and identify weaknesses that still require attention. For organisations without an internal security team, Victor outlines an on-demand model that provides specialist expertise during the periods it is needed. His focus is on developing a trusted partnership, helping clients make informed security decisions throughout development and beyond. The episode offers a practical perspective on how ethical hacking, targeted assessments and ongoing collaboration can support stronger business defences. #ExploitSecurity #StayCurious #OffensiveSecurity #IoTSecurity #PenetrationTesting
