Rishi :verifiedpurple:<p>Many a times <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> folks ask about <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>redteam</span></a> or <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentest</span></a> & the what's one of the most important thing in it.</p><p>Lemme tell you, the skills, attack-lifecycle, MITRE, evasion techniques are ever-evolving, and frankly can be learned & taught. Though I may want some baseline to fit you in the team, but it's not a deal breaker if you are eager to learn. To me it boils down to is how you perceive <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a>, how can you explain complex concepts in simpler terms away from the buzz words with some daily life analogies. How you write reports, communicate, deliver briefings etc.</p><p>If you miss this narrative coming out of an amazing gig (got the flags, hacked the sh** out of the application, environment, whatever) and couldn't articulate in the report - your stakeholder is like "sorry we didn't understand”. And worse if they didn't understand the <a href="https://infosec.exchange/tags/impact" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>impact</span></a> the <a href="https://infosec.exchange/tags/exploitation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>exploitation</span></a> may have; they ain’t fixing it, my friend & event getting a write-off on it aka. <a href="https://infosec.exchange/tags/risk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>risk</span></a>-acceptance </p><p>Work with your <a href="https://infosec.exchange/tags/clients" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>clients</span></a>, <a href="https://infosec.exchange/tags/stakeholders" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>stakeholders</span></a>, <a href="https://infosec.exchange/tags/businesses" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>businesses</span></a> as <a href="https://infosec.exchange/tags/partners" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>partners</span></a>, as extended teams. Sometimes, we have to educate them to have a secure ecosystem. Please understand - If they lose, we lose in making world a safer place. My boss once mentioned to me "Rishi, no matter how well you do, it's often the <a href="https://infosec.exchange/tags/perception" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>perception</span></a> of your clients that will define the outcome”. So, while we have the facts, skills etc. but if your stakeholder didn't understand or didn't have a good experience, they won't be paying attention to you. Period.</p><p>So next time your do your <a href="https://infosec.exchange/tags/SANS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SANS</span></a>, <a href="https://infosec.exchange/tags/OffensiveSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffensiveSecurity</span></a>, <a href="https://infosec.exchange/tags/CREST" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CREST</span></a>, <a href="https://infosec.exchange/tags/PentesterAcademy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PentesterAcademy</span></a>, remember to understand and try to explain the concept to you non-tech friend, partner, sibling and if they get it - you are in the right space to grow.</p><p>Why should you listen to me? Fair point.<br>I have been in this space for nearly 2 decades, and have gone through 1000s of such reports, talked to 100s of clients - tech folks, CXO, board, public forums .. and have sat on both sides of table; suffered enough burns to engrain this in my approach. </p><p>While you have skills in the binary world, have <a href="https://infosec.exchange/tags/empathy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>empathy</span></a> in the real world and sometimes it may take some effort educating them. </p><p>Tags: <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/hack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hack</span></a> <a href="https://infosec.exchange/tags/bugbounty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bugbounty</span></a> <a href="https://infosec.exchange/tags/wickedwildworld" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>wickedwildworld</span></a> <a href="https://infosec.exchange/tags/audit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>audit</span></a><br>%toot_12%</p>