Available for select engagements
Find the breach
before attackers do.
Samit Hota is a security expert and advisor working at the intersection of offensive engineering and business risk — helping founders, security leaders, and engineering teams close the gaps that scanners miss.
$ whoami
samit_hota · security researcher & advisor
$ ./scan --target=your-stack.io
scanning surface area...
[!] 3 exploitable misconfigurations found
[+] cloud IAM over-permissioning
[+] unauthenticated internal API
[+] stale third-party dependency (CVE)
$ ./fix --with=advisory
access hardened. risk posture: green
Trusted by security-conscious teams
10+
Years in Security
80+
Engagements Delivered
7
Public CVEs & Advisories
5
Fortune 500 / Unicorn Clients
About
Security that survives contact with real attackers.
I spend my time thinking like the people trying to break in — because that's the only way to build something that actually holds up. My background spans defensive Security Operations Center work, hands-on incident response, and offensive penetration testing and bug hunting, with a track record of mapping critical risk vectors and driving audit-ready security programs across complex digital infrastructure.
Beyond hands-on execution, I'm committed to security education and knowledge-sharing — publishing technical guides, vulnerability advisories, and threat actor breakdowns to help engineering teams and the wider security community stay ahead of real-world adversaries. I also keep a close eye on emerging technology and full-stack systems architecture, and advise founders and security leaders on building security into their business from the ground up.
Explore advisory servicesWhat I do
Four ways I help teams get ahead of risk
Offensive Security Assessments
Red team simulations, penetration testing, and adversarial emulation that mirror how real attackers actually operate — not a checkbox scan.
Cloud & Infrastructure Hardening
Architecture reviews and hardening programs across AWS, GCP, and Azure — closing the gaps between "compliant" and "actually secure."
Strategic Security Advisory
Fractional CISO-style guidance for founders and leadership teams — threat modeling, board reporting, and building security into the roadmap.
Incident Readiness & Response
Tabletop exercises, IR playbooks, and hands-on support when things go wrong — built before the breach, not after.
Disclosure bulletins
Latest security advisories
CVE-2015-5477: Dissecting the ISC BIND TKEY Denial of Service Vulnerability
ProFTPD CVE-2015-3306: Analyzing the Critical mod_copy Vulnerability
CVE-2021-3199: Unauthenticated Remote Code Execution in ONLYOFFICE Docs
Latest research
From the blog
Unmasking eBPF Rootkits: Kernel Telemetry and Detection Artifacts
Learn how offensive eBPF intercepts kernel calls to hide activity, and master the bpftool and kernel telemetry workflows required to detect them.
Oct 6, 2026Mobile & Device SecurityChaining Mobile Permissions: Auditing Accessibility and Clipboard Abuse
Learn how Android accessibility services and clipboard access interact, and implement concrete developer controls like FLAG_SECURE and UIPasteControl.
Oct 6, 2026Offensive SecurityPipeline Poisoning: Auditing and Hardening GitHub Actions CI/CD Workflows
A practical guide to identifying context confusion in GitHub Actions workflows and implementing OIDC and least-privilege security controls.
Oct 1, 2026Ready to stress-test your defenses?
Let's talk about where your biggest exposure actually is — not where the compliance checklist says to look.
Start the conversation