Chat with a White Hat

Dylan Lahan, a full-time bug bounty hunter and independent security researcher, shares insights on ethical hacking and cybersecurity.

Takeaways

• Ethical hacking as a career
• Importance of bug bounty programs

Chapters

• 00:00 Introduction to Ethical Hacking and Bug Bounty Hunting

Dylan Lawhon (aka iQimps) shares his journey from gaming to bug bounty hunting, including real-world hacking stories, zero-day discovery, SAML abuse, and advice for breaking into cybersecurity in 2026.

00:00 – 00:25 Intro & background
00:25 – 01:44 Getting into computers (gaming era)
01:44 – 03:44 First cybersecurity interest (game hacking & PSN breach)
03:44 – 08:30 Early hacking mindset & CTFs
08:30 – 13:44 First major live hacking event (bug bounty experience)
13:44 – 19:12 CSS injection → SSRF → account takeover case study
19:12 – 23:54 Favorite type of security testing (code review)
23:54 – 27:22 Bug bounty vs pentest time management
27:22 – 30:32 Improving vulnerability impact communication
30:32 – 33:41 Using AI in cybersecurity & automation
33:41 – 38:52 Future of AI in offensive & defensive security
38:52 – 45:48 Underestimated attack vector (SAML abuse)
45:48 – 48:48 Breaking into cybersecurity advice (2026)
48:48 – 51:11 SQL injection + documentation mindset
51:11 – 52:10 Where to find Dylan + closing

Whether you're a beginner in cybersecurity, a bug bounty hunter, or a seasoned pentester, this episode is packed with real-world insights from the front lines of offensive security.

The conversation emphasizes the critical role of planning in cybersecurity testing, highlighting the need for thorough preparation, open source intelligence, and understanding the environment. It also emphasizes the importance of reflection and different planning approaches for various types of tests.

Takeaways

• Thorough planning is crucial for cybersecurity testing
• Different types of tests require different planning approaches

Chapters

• 00:00 The Importance of Planning

The conversation covers the importance of hands-on experience in cybersecurity, the value of starting at the foundational level, and the overlap between offensive and defensive cybersecurity roles. It also emphasizes the need for a strong foundation and the potential risks associated with inexperienced consultants and pen testers.

Takeaways

• Hands-on experience is crucial
• Start at the foundational level
• Overlap between offensive and defensive roles

Chapters

• 00:00 Risks and Responsibilities of Consultants and Pen Testers

The conversation covers the importance of network diagrams in pen testing and the need for a partnership approach in security testing. It also highlights the challenges of security testing and the need to work collaboratively with organizations to improve security.

Takeaways

• Partnership approach
• Challenges in security testing

Chapters

• 00:00 Network Diagrams and Pen Testing

Neil Kettle discovered a bug in 2010 that became public in 2015. He was contracted to create government malware that could key log on Mac OS X without informing the user. He reverse engineered Apple's method and completed the task in 20 minutes.

Takeaways

• Bug discovery in 2010
• Creation of government malware
• Reverse engineering Apple's method

Chapters

• 00:00 Reverse Engineering Apple's Method

The conversation covers advice for breaking into cybersecurity in 2026, emphasizing the importance of fundamentals and contributing to projects.

Takeaways

• Fundamentals are key
• Contribute to projects and have a body of evidence

Chapters

• 00:00 Breaking into Cybersecurity in 2026

Dylan Lahan, a bug bounty hunter and security researcher, shares his journey from gaming to cybersecurity. His interest in computers was sparked by gaming, leading to his exploration of programming and technical skills. Additionally, early exposure to game hackers influenced his interest in cybersecurity.

Takeaways

• Gaming sparked interest in computers
• Early exposure to game hackers influenced interest in cybersecurity

Chapters

• 00:00 Interest in Cybersecurity and Game Hacking

Nick Aures, a senior pen tester at Sprocket Security, shares his journey from childhood fascination with computers to his entry into the field of cybersecurity.

Takeaways

• Early exposure to home computing sparked Nick's interest in technology.
• Nick's interest in cybersecurity began in the mid-2000s with the use of Backtrack, a predominant hacking OS at the time.

Chapters

• 00:00 Entry into Cybersecurity

The conversation delves into a security incident involving infrastructure enumeration and the discovery of a critical security vulnerability. The incident highlights the importance of thorough infrastructure testing and the potential risks associated with security vulnerabilities in network infrastructure.

Takeaways

• Infrastructure Enumeration
• Security Vulnerabilities

Chapters

• 00:00 Infrastructure Enumeration and Security