Simon Chapman
Manchester, England, United Kingdom
4K followers
500+ connections
4K followers
500+ connections
Articles by Simon
-
Ready Player One?
Ready Player One?
When Sony’s PlayStation Network went dark in 2011, it wasn’t just a disruption to online gaming – it was a glimpse into…
-
The Seven Deadly Managers
The Seven Deadly Managers
Do you have poor morale, high staff turnover, stress, burnout and general unhappiness in your team? If so, there's…
-
Criticism Sucks
Criticism Sucks
Why does having your work challenged hurt so much? Well the truth is, it shouldn't, but there are many reasons why it…
1 Comment -
Clown Combat School
Clown Combat School
Without context, you're probably missing something. Or you're just plain wrong.
-
If I Designed Pen Testing Exams...
If I Designed Pen Testing Exams...
I’m going to design my own pen testing certification. It will simulate actual, real-world pen testing.
10 Comments -
Develop a Superpower: The Management Summary
Develop a Superpower: The Management Summary
Do you know which group of people really appreciates a drum solo? That's right. Other drummers.
-
Preparation, or how to avoid being eaten alive
Preparation, or how to avoid being eaten alive
Being unprepared for the task at hand can be a stressful experience, but it doesn’t have to be that way. As a…
1 Comment -
Admit it. You're not good enough.
Admit it. You're not good enough.
A little self-doubt can be a good thing. It keeps us focused, humble and open to constructive criticism.
-
Replacing Anxiety with Curiosity
Replacing Anxiety with Curiosity
For a variety of good reasons, many of us are anxious about uncertainty. We like to be certain of many aspects of our…
Activity
4K followers
-
Simon Chapman posted thisThe boundaries around the traditional pentest provider are being attacked from several directions. MSSPs are adding offensive security, compliance firms are acquiring pentest capability, exposure-management platforms are pulling testing into continuous validation. And autonomous platforms are starting to compete for work that would once have gone straight to a consultancy. At the same time, some acquirers appear keen to preserve the specialist operating model rather than simply absorb the pentest team into the wider business. This makes the competitive landscape much less obvious. A few years ago, a pentest company broadly knew who its competitors were. Other pentest companies. Now, that is changing. The competitor might now be an MSSP with an existing client relationship, a compliance provider bundling testing into a wider programme, or a software platform offering continuous validation at a very different price point. Each of those businesses sells pentesting for a different reason. For the traditional provider, the challenge is to provide a clear reason for the customer to buy that capability from you rather than from one of the businesses moving in from the edges.
-
Simon Chapman shared thisWhat does promotion look like for a pentester these days? Technical ability, certifications and delivery skills still matter. But so does what happens when the work comes under scrutiny. So...can they explain the limits of the test? Defend a finding’s evidence and severity? Recognise when the client has a fair point and amend the report? I’m increasingly convinced that report defence should form part of promotion assessment, particularly before someone moves into independent client-facing delivery. A promotion should reflect not only what someone can find, but whether they can stand behind the work when challenged. I’d be interested to hear what other teams use as evidence that a pentester is ready to progress.
-
Simon Chapman posted thisAnother interesting cyber services deal. (they just keep coming, don't they?) PE-backed Quorum Cyber is acquiring Ontinue, an MXDR provider whose SOC already uses autonomous investigation. On the face of it, yet another AI announcement. But it's more than that - It's the operating model again. Automation handles more of the repeatable work. Human expertise gets concentrated where judgement and customer context are needed. We're seeing a similar question emerge in offensive security, are we not? If technology changes the amount of human effort needed to deliver the technical work, simply doing the same work with fewer people isn't much of a strategy. Instead there seems to be a broader pattern forming here, with the question being asked - what are those people becoming capable of delivering next?
-
Simon Chapman posted thisIs the pentest report still the product? I remember when PlexTrac was, broadly speaking, a better way for pentesters to write reports. It solved a very familiar problem. But over time it moved beyond reporting into workflow, remediation, retesting and validation. Now it has been acquired by Brinqa, an exposure management company. I think there is something interesting in that progression for pentest providers. For years, the natural boundary of a pentest has been: Scope. Test. Report. Retest. Done. But the client's problem doesn't end when the report is delivered. They still need to decide what matters, get things fixed, track progress and establish whether the fix actually worked. Increasingly, that looks less like a series of isolated pentests and more like a continuous process. The report still matters. But perhaps it is becoming the record of the service, rather than the service itself. The more interesting question for pentest providers is what part of that process they intend to own.
-
Simon Chapman shared thisMost of the work I do involves direct involvement with the people doing the job. But there’s a time for measuring and taking stock, as well as hands-on work. If you need to gather some hard numbers about what’s working or not working in your pentest team, this framework might help. Will it make your life easier, fix all your pentest team challenges, and double your revenue? Nope. But it might help you to ask some meaningful questions along the way to doing so.Simon Chapman shared thisUtilisation is an important metric. But it isn’t a clear way to measure whether the team is delivering well, developing properly, or becoming too dependent on a handful of senior people. So we built the Conversec Pentest Team Performance Framework. It looks at delivery flow, quality, client friction, capacity resilience and consultant development. Because there’s a time for people leadership: being present, understanding what’s happening and giving the team the support and assurance it needs. And there’s a time to step back, measure what’s happening and look for patterns that aren’t always obvious day to day. We’re giving the framework away because knowing what to measure is only part of the problem. Understanding what the numbers are telling you, and what to change as a result, is where experience comes in.
-
Simon Chapman shared thisThe way customers consume offensive security may be about to change more than the way we test. Point-in-time pentests will remain. But buyers are increasingly being offered continuous validation, AI-assisted testing, attack simulation and specialist human-led services. For owner-managers, particularly those who also run a SOC or defensive practice, there is a bigger question. What do you want customers to buy from you in three years? Individual pentests and a separate managed detection service? Or something more joined-up, where offensive testing validates the controls, feeds detection engineering, tests the SOC and then verifies that improvements actually worked? The same applies to red teaming and adversary simulation. Their role may become less about producing another report and more about proving whether the established defensive capability performs under realistic attack. That affects the skills you need. 🟢 Testers who understand detection and response. 🟢 SOC analysts who understand offensive techniques. 🟢 Consultants who can move between both teams and explain it all. Recent consolidation across cyber services suggests customers will increasingly have the option to buy these capabilities together. Owner-managers don't need to copy the large providers, but they do need to decide what sort of security relationship they want with their customers. Worth deciding where you want to sit before customers decide for you.
-
Simon Chapman posted thisThe Bank of England has made a useful point for pentest companies, with interesting commercial implications. Essentially they're saying that using a powerful AI model isn't really enough. Its value depends on the surrounding “harness”: tools, context, workflows and controls. There's quite a lot to unpack in the Bank's update but some key commercial implications are: 🟢 Model access will commoditise. Differentiation will be in controlled execution, validation and integration with remediation. 🟢 “Human in the loop” needs more qualification. Where does that actually change things? 🟢 AI-assisted, sandboxed-agent and live autonomous testing are different things, and require different controls, scoping and pricing. And buyers will expect evidence around data handling, permissions, logging, stop conditions, insurance and liability - an increasingly common theme at the moment (and there are costs associated with building and running these things) So the Bank sees AI as a service-design decision spanning methodology, team skills, scoping, QA, pricing and client assurance. Firms that build this well should become harder to compare on day rate alone. Those offering a thin wrapper around the same model will compete mainly on price.
Simon Chapman replied to a comment
2d
Synack I thought you might say that 😉
Simon Chapman commented on a post
3d
A few recent examples:
• NetSPI + Synack: offensive security consolidating around human + AI testing
• Accenture / CyberCX: major cyber services platform acquisition
• A-LIGN / Pathfynder: compliance adding specialist pentest capability
• CyberMaxx / Avertium: MDR adding offensive security
Different scales admittedly, but same direction.
Simon Chapman replied to a comment
4d
Branislav Osadkovski Interesting insight. It is perhaps reassuring that human expertise is still needed. Maybe that will always be the case, and that's what we're discovering now - without informed oversight, these things simply tend towards chaos.
-
Simon Chapman liked thisSimon Chapman liked thisOur roller banner arrived. It looks great. It also has a Canva watermark printed across the Manchester skyline, because apparently, we are a security community that forgot to check the build artefact before shipping to production🤦🏾♂️ . No budget for a reprint this close to the event, so it stays. We're calling it a known issue, documented and accepted. Come say hello to it and tag us with the watermark in October. #BSidesManchester #SoftwareEngineering.
-
Simon Chapman liked thisSimon Chapman liked thisStill can't quite believe this idea I wrote in my kitchen appeared on a billboard in Times Square. What a couple of weeks! When I saw One Minute Briefs post the #SellMeThisPen challenge, I knew there were loads of ways to approach it. After all, AI has become an unavoidable debate. And if any pen brand has permission to weigh in with a few words, it's Parker. I scribbled "let's take this offline" as a playful way to send up a cliché of the digital workplace. The image of a Parker pen twists the jargon to become a literal call to solve problems offline. I'm a fan of ads that do this. Subversion is a shortcut to create a moment of tension and surprise, particularly in under seven words. There's a cheeky playfulness in Parker being the antidote to what can feel like an overly digital world in the face of AI. And it's based on a real insight from my own life. For ideas stuff, I always go back to a pen and paper. This shift unlocks things. Being offline engages my brain. I was over the moon to be shortlisted amongst a bunch of brilliant ideas. Then gobsmacked when Parker Pens reached out to run the ad. Seeing it go live has reminded me that being creative doesn't need to be complicated. Ultimately, a simple idea can become bigger than you imagined. Write it down and put it out there. Family and friends have been genuinely excited. My nan has been telling everyone from shop assistants to estate agents! The Parker brand clearly holds a special place with the people that matter. And they love the event of it being a billboard. This surreal chapter has got me reflecting about other analogue tools besides the mighty pen, too. A photographer I was chatting to has seen a huge demand for film photography courses. There's a resurgence of analogue music formats like cassettes. A youth movement for un-smart phones. Even my son has discovered the joy of a retro Gameboy. (No WiFi needed. But you do need to blow the cartridges.) Could this growing trend to take things offline be the natural rebalancing we all need? I hope so. Writing with a pen a little more often is a good place to start. Before I put my phone down to practise what I preach, a huge thanks to Parker Pens, One Minute Briefs and everyone involved for this incredible opportunity. 🖋️ Photo Credit: Nasdaq.
-
Simon Chapman liked thisSimon Chapman liked this"Three of the five file hashes I'd have happily handed a client as an IOC package would never have matched a second victim." That's a line Jack Lewis wrote in our PAPERMILL report. It's an uncomfortable thing for a security consultancy to publish, though I'm glad we did. The operator mints a unique payload for every download, so an IOC package that looks thorough on paper can be close to useless in practice. If your detection still depends on hashes, this campaign will go straight past. The rest of the chain (image below) is built for the same purpose. It uses an ISO container to shed Mark-of-the-Web, and a signed Notepad++ binary that the operator didn't touch. The loader sleeps out the sandbox instead of exiting. The final VenomRAT payload runs in memory. What worked instead was pivoting on the builder's certificate, which is the same across every build. That surfaced seven sibling samples the file hashes alone would never have linked. The work is excellent, but what I'm proudest of is how honest it is. The playbook looks like Silver Fox and the tooling is different at every step. The team hasn't forced an attribution. They've set out a confidence ladder and been clear about what they can't prove yet. The practical takeaway: when someone hands you threat intel, ask what share of it is behavioural and what share is hashes. Credit to Jack L., Sean Moran and Dhaval Mukeshkumar. For the defenders here: how much of your detection still keys on file hashes? Full report and indicators in the first comment. #ThreatIntelligence #DetectionEngineering #ThreatHunting #MalwareAnalysis
-
Simon Chapman liked thisSimon Chapman liked thisJust 1 month to go until the Leeds Cyber Security Conference on Thursday 22nd October. The plan is coming together with a fantastic day planned for everyone. Talks from CISO's, Hackers and Communication Experts to interactive stands and of course arcade competitions it is going to be a belter. To get your ticket check the link in the comments or drop me a message. #CyberEvents #CyberSecurity #Infosec #LCSC2026
Experience
Recommendations received
4 people have recommended Simon
Join now to viewOther similar profiles
Explore more posts
-
Richard Southwell
PTP consultant Lewis Cradduck, discusses the latest changes to the CHECK scheme and what they mean for testers in PTP's latest blog. This blog covers how UK Cyber Security Council titles now map to CHECK roles, what NCSC expects from testing under the updated scheme, and how reporting and renewal requirements are tightening up for CTLs and CTMs. Please give it a read, feedback and connect! LinkedIn: https://lnkd.in/eZDaMSy4 X / Twitter: https://lnkd.in/eZVSUCZ4 PTP Website: https://lnkd.in/e8QYTMiu
-
Back to Work
𝗛𝗼𝘄 𝘁𝗼 𝘀𝘁𝗮𝗿𝘁 𝗮 𝗰𝗮𝗿𝗲𝗲𝗿 𝗶𝗻 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 + 𝗘𝗻𝘁𝗿𝘆-𝗹𝗲𝘃𝗲𝗹 𝗷𝗼𝗯𝘀 𝗮𝘃𝗮𝗶𝗹𝗮𝗯𝗹𝗲 🧑💻 The UK’s demand for cybersecurity professionals has never been higher — and with the right training, you don’t need a degree or prior IT experience to launch a successful cyber career. In this short blog, we take a look at some of the ways in which you can get started for free, such as our Level 2 and 3 fully funded courses in Cybersecurity. We also provide some of the entry-level job roles available once you've completed your training, which are in high-demand right now as the industry continues to grow at pace. Read the full article here: https://lnkd.in/e-45hC7N
Explore collaborative articles
We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
Explore More