Pentesting - Essential Advice from BHIS Pentest Lead

What Happened

After the Wild West Hackin’ Fest 2026, Corey Ham, the head of the ANTISOC Team at BHIS, shared his insights on how to start a career in pentesting. His advice is particularly valuable for newcomers aiming to break into this specialized field.

Starting Blue May Not Be the Best Path

Common wisdom suggests starting in defensive roles (blue team) before moving to offensive roles (red team) in cybersecurity. However, Corey believes that if your goal is to become a pentester, you should focus on developing those specific skills directly.

While blue team roles help build a foundational understanding of cybersecurity, they may not be necessary for aspiring pentesters. Instead, Corey emphasizes honing your pentesting skills from the get-go.

Difference Between Red and Blue Teamers

Corey explains that blue teamers are experts in the tools and processes their organizations use, while red teamers (pentesters) are adaptable problem-solvers who learn and create tools as needed. This fundamental difference highlights the unique skill sets required for each role.

Starting as a Junior Pentester

To prepare for a pentesting role, Corey suggests a progression path:

1. IT Fundamentals: Gain a solid understanding of information technology.
2. CTFs: Participate in Capture the Flag competitions to practice exploitation and offensive techniques.
3. Bug Bounties: Start finding vulnerabilities in real-world applications and learn to document findings professionally.

This pathway is designed to build a strong pentesting skill set without relying heavily on certifications.

Importance of Practical Skills

Corey stresses that practical experience is critical. When applying for junior pentesting positions, candidates should be prepared to demonstrate their ability to conduct tests and produce clear, professional reports. The first few months in a pentesting role are crucial for proving one’s capabilities.

Role of Certification

While certifications can signal a baseline knowledge, Corey believes that hands-on experience is far more valuable. He mentions the Offensive Security Certified Professional (OSCP) as a decent indicator of skill but emphasizes that real-world engagement is the gold standard in evaluating a pentester's competence.

Final Thoughts

Corey’s key takeaways are to pursue your passion and focus on acquiring the skills necessary for your desired role. If pentesting is your dream, it’s better to strive directly for that goal rather than settling for a related position that may not fulfill your aspirations. However, exploring defensive roles can also lead to valuable insights and skills.

In conclusion, aspiring pentesters should prioritize practical experience, continuous learning, and a passion for offensive security to succeed in this dynamic field.