Can AI Beat Hackers? The Future of Cyber Training Has Changed | Hack The Box
The eminent discourse of this podcast episode delves into the pivotal role of artificial intelligence in the contemporary cybersecurity landscape, underscoring the symbiotic relationship between AI and human expertise. I, Joseph Carson, engage in a compelling conversation with Gerasmus, a distinguished figure from Hack the Box, as we explore the transformative impact of AI on both offensive and defensive cybersecurity strategies. Our dialogue illuminates the necessity for practitioners to adapt and evolve their skill sets in tandem with rapid technological advancements, highlighting the significance of platforms such as Hack the Box in fostering a culture of continuous learning and practical application. We further examine the implications of AI governance and the emergence of agentic AI as a potential risk factor, urging a meticulous approach to data management and security protocols. Ultimately, this episode serves as a clarion call for cybersecurity professionals to embrace innovation while preserving the essential human element in safeguarding digital infrastructures.
In this special edition recorded live at RSA Conference, Joseph Carson is joined by Gerasimos Marketos (gmar), Chief Product Officer at Hack The Box.
They explore how AI is reshaping cybersecurity skills, why traditional education is struggling to keep up, and how hands-on platforms are redefining how defenders and ethical hackers are trained. From real-world fraud detection to AI-powered CTF competitions, this episode dives into the evolving relationship between humans and machines in cybersecurity.
🔑 Key Themes & Topics
- AI vs Humans in cybersecurity competitions
- Why AI is an accelerator, not a replacement
- The evolution from traditional training → hands-on gamified learning
- Closing the cybersecurity skills gap
- Red, Blue, and Purple team upskilling
- AI governance, risk, and agentic threats
- The future of cybersecurity careers and hiring
⏱️ Chapters
- 00:00 – Introduction & RSA Conference insights
- 02:00 – GMar’s journey: Data → Fraud → Cybersecurity
- 06:30 – Who and What is Hack The Box?
- 10:30 – AI vs Humans: CTF research findings
- 13:00 – AI as a productivity multiplier
- 15:30 – Real-world example: AI winning competitions
- 16:00 – RSAC trends: AI everywhere
- 17:00 – AI governance & emerging risks
- 18:00 – AI for security vs security for AI
- 19:00 – Staying relevant in cybersecurity
🚀 Hack The Box Explained
Hack The Box is a cybersecurity upskilling platform offering:
- 🎓 Academy – Structured learning paths
- 🧩 Challenges & Labs – Hands-on environments
- 🏁 CTFs (Capture The Flag) – Competitive exercises
- 🏢 Pro Labs – Enterprise-scale simulations
- 🔎 Talent Search – Connecting skilled professionals with employers
It supports:
- Red Teams (Offense)
- Blue Teams (Defense)
- Purple Teams (Collaboration)
Resources:
https://www.hackthebox.com/
https://www.linkedin.com/in/gmarketos/
https://www.hackthebox.com/ai-augmented-cyber-workforce-report
Takeaways:
- In our latest episode, we explored the symbiotic relationship between artificial intelligence and cybersecurity, highlighting their mutual dependence.
- The insights gathered from the RCC conference emphasize the necessity of integrating AI to enhance cybersecurity measures effectively.
- We discussed the evolution of Hack the Box, illustrating its transition from a challenge-based platform to a comprehensive cybersecurity training ecosystem.
- The significance of continuous learning in cybersecurity was underscored, particularly in light of rapidly advancing AI technologies and their implications.
- We examined the results of our recent CTF events, showcasing how AI agents can enhance human capabilities in cybersecurity tasks and competitions.
- Lastly, we asserted the importance of maintaining foundational skills in cybersecurity, even as AI tools become increasingly prevalent in the industry.
Links referenced in this episode:
Companies mentioned in this episode:
- Segura
- Hack the Box
Transcript
Hello everyone, my name is Joseph Carson.
Speaker A:I'm the chief security evangelist and advisor at Segura.
Speaker A:And today, welcome to the latest episode of the Security By Default podcast.
Speaker A:I'm the host of the show and it's really a pleasure to have you all joining me back again.
Speaker A:And this is a very unique episode that we're doing.
Speaker A:It's a special from the RCC conference here in San Francisco.
Speaker A:We've been going around looking at all the buzz and all the transwords which seems to be heavily, you know, AI is going to be either going to kill us or going to save us.
Speaker A:But one thing I've found from this conference is definitely is that we need AI in order to be able to accelera.
Speaker A:Right.
Speaker A:Also, AI needs us.
Speaker A:This is a.
Speaker A:It's probably like a marriage that we need to do in order to make sure that we move forward at a pace and also keep it protected at the same time.
Speaker A:So I'm really excited about today's episode.
Speaker A:I've had Hack the Box on before, so I'm really excited about doing this again.
Speaker A:Welcome to the episode.
Speaker A:Welcome to the show.
Speaker A:Gmar, do you want to give us a little bit about you, your background, a little bit about your origin story and how you got into the industry?
Speaker B:Hi Joseph.
Speaker B:Yeah, thank you.
Speaker B:Thanks for having me.
Speaker B:It's a pleasure actually to join you here today.
Speaker B:So, yeah, I'm Gerasmus or gmar.
Speaker B:Yeah.
Speaker B:So basically where should I start from?
Speaker B:Well, yeah, let me tell you actually about my background.
Speaker B:So computer science graduate.
Speaker B:You know, I did my PhD also and spatial temporal data management.
Speaker B:So initially my focus was on, you know, data management, data architecture, this kind of stuff.
Speaker B:Most likely, this is not the typical story you're going to share from other.
Speaker B:I don't know, actually you, you tell me.
Speaker B:So, yeah, like, you know, I started working, you know, in the data space.
Speaker B:That was my, my original focus.
Speaker B:I moved to the US also back then.
Speaker B:And you know, after some point I realized that I don't want to build, you know, analytics, you know, dashboards for the rest of my life.
Speaker B:So I really, I, I really want something else.
Speaker B:And this is how I got into fraud analytics.
Speaker A:Okay, very interesting.
Speaker B:So, you know, my role was to build basically to, to work where, you know, with a, you know, the top banks, top US banks actually to understand the fraud trends going on out there and translate everything.
Speaker B:All this actually into, you know, fraud prevention models using machine learning and static rules and all these, you know, type of things.
Speaker B:So in a sense, actually I have experienced, you know, in this, in that specific industry, how we went from more traditional techniques like we're doing scorecards and stuff like that.
Speaker A:Absolutely.
Speaker B:You know, in the, in the beginning and how we transition from there to, you know, machine learning models and AI and all this.
Speaker B:Absolutely.
Speaker B:Anyway, I did that actually for, for several years.
Speaker B:Then I got into ad fraud.
Speaker B:So in the digital advertising space, pretty much the same, same approach again, static rules and machine learning models, you know, crazy stories.
Speaker B:Basically bots, you know, visiting sites to pick up cookies to make it seem that, you know, they're like actual consumers with, with specific interests, interest in traveling and stuff and then ending up in fake sites basically to consume ads and so that the advertiser is going to pay all this money to, you know, to the fake pants that was.
Speaker B:This is how I got also into product management, which also is.
Speaker B:So I was more like a fraud SME, coming from the financial services, you know, side to digital advertising.
Speaker B:And from there, like, you know, I realized that it was time for me to return back to Europe.
Speaker B:So I was looking for something broader like fraud.
Speaker B:Fraud prevention is.
Speaker B:It's a very interesting space, but it's a bit, you know, specifically.
Speaker B:So I was looking for something broader and I wanted to do something in the cybersecurity space.
Speaker B:So this is how I got into Hack the Box.
Speaker B:I was, you know, I was connected with the team at Haris.
Speaker B:They were looking and actually for the, for the first, you know, product manager.
Speaker B:And this is how I joined back then, actually users had to solve a challenge in order to get into, you know, the platform.
Speaker B:My challenge was to, to convince Harris to stop thinking about the product and, and, and features and how we provide value to, to our users and customers and you know, focus on the common strategy and funding which obviously he did an Amazon job.
Speaker B:So yeah, since then I, I built a team of product managers, product designers, product analytics people.
Speaker B:And here we are today.
Speaker B:I'm the chief product officer of Hack the Box, overseeing product development across the portfolio.
Speaker B:B2B, B2C.
Speaker B:Amazing R& D team and yeah, solving interesting problems.
Speaker A:Fantastic.
Speaker A:I do remember the Hack the Box challenge.
Speaker A:In order to get your token.
Speaker A:In order to get.
Speaker A:I remember very, very well.
Speaker A:I do, I do remember the celebration of, what was it, 2 million machine that was actually took on.
Speaker A:I go back and actually celebrate that original kind of origins.
Speaker B:Exactly.
Speaker B:Because actually that was the point where we took down the original platform and we moved to a new one.
Speaker B:But we wanted that platform and the challenge to stay forever.
Speaker B:So that's why we created that's fantastic.
Speaker A:For me, I've been doing this for a long, long time and I went through a very traditional education and training to get into this industry.
Speaker A:I always feel, you know, at the pace that we're moving and the technology advancements is moving so quickly, traditional education is not enough in order to get the next generation of talent into the workforce.
Speaker A:And sometimes by the time they even get in the workforce, the tool sets already changed.
Speaker A:What I find is the most valuable thing through my journey and training was the kind of the ideology and the kind of the core skill set that I got, the practical stuff, and that became the most valuable.
Speaker A:And one of the big things I really enjoyed was when I was getting into game theory because I'm a big retro gamer.
Speaker A:I love gaming.
Speaker A:And that's really where I guess I find Hack the Box and others.
Speaker A:That was really new way of learning and doing it from a game style and challenges and meeting new people as well.
Speaker A:So how do you see the security awareness and security training industry evolving, especially with platforms like the Hack the Box?
Speaker A:Maybe give the audience a little bit about what is Hack the Box and what does it do.
Speaker A:I think some of the audience has probably heard before, but if you just do a recap and share.
Speaker B:Yeah, sure.
Speaker B:So Hack the Box actually is a cybersecurity upscaling platform.
Speaker B:We focus on security professionals.
Speaker B:So originally we started on the offensive side, like pen testers, red teamers, like these folks.
Speaker B:Since then we started embracing also, you know, the defensive side of the house.
Speaker B:So our focus today is on red, blue, you know, and purple teams.
Speaker B:We provide training and upskilling.
Speaker B:We do it in many different ways because what we believe is that, you know, one size doesn't fit all.
Speaker B:So what this means in our case is that, you know, people can start from what we call academy.
Speaker B:That's very like, you know, the structural learning, guided learning.
Speaker B:You go step by step.
Speaker B:Still actually very practical.
Speaker B:There's a practical aspect.
Speaker B:There's a practical part as well.
Speaker B:But from there you can go to more like, you know, black box exercises.
Speaker A:That's the ones I love.
Speaker A:I call it the adventure mode.
Speaker B:Exactly.
Speaker B:But even this actually has multiple layers, Right.
Speaker B:It can be like a, you know, a single target like that you're supposed to attack if, if you.
Speaker B:If you are on the offensive side.
Speaker B:But also we have what we call ProLabs, which is our enterprise network.
Speaker B:Multiple, multiple targets.
Speaker B:So.
Speaker B:And, you know, environment like this, you can exercise basically different skills, so.
Speaker B:But also other things like, you know, our CTF platform, like.
Speaker A:Oh, absolutely, yeah.
Speaker B:Capture the flag exercises, other products like what we call talent search.
Speaker B:Basically it's a way to connect recruiters with, with our community.
Speaker B:It's an amazing, it's an amazing product.
Speaker B:So yeah, you know, we have all these multiple, all these layers.
Speaker A:I always believe that eventually, you know, I'm hoping that, you know, my Hack the Box profile ultimately becomes my resume.
Speaker A:So ultimately, you know, when you're going and you're, you know, you're looking as like here, here's, here's my badge of honors that I've got over over the years.
Speaker B:Yeah, you should take.
Speaker B:Actually you should Hack the Box profile because what we have done actually lately was to move from separate profiles across our platforms to something unified.
Speaker B:So what the idea is to unify activity across all platforms to a single.
Speaker A:That'd be awesome.
Speaker A:Good to sit you in product management.
Speaker A:A good way is maybe connecting it with other, you know, being able to export it or link it into LinkedIn and actually have people to display it.
Speaker A:You know, as, as you're basically, you know, credibility side of things would be a really cool.
Speaker B:Yeah, absolutely.
Speaker B:Which by the way is what we have seen happening with our users right in the community.
Speaker B:We know that they are proud of what they have achieved, you know, at Hack the Box and they put actually the rank and the badges and on their resumes in order to communicate that these are the things that I have achieved at Hack the Box.
Speaker B:Which means a lot, right, because we are famous for our content and you know, the level of difficulty when it comes to challenges.
Speaker B:But although we have content forever from very beginners to, I can tell you.
Speaker A:That, you know, I do the challenge.
Speaker A:I mean, I don't get to spend as much time as I would love to on the platform, but I can I.
Speaker A:As I go through the levels from easy to hard and those insane machines are.
Speaker A:I think that's the, it's definitely the right name for those machines because I've spent time going, oh my goodness, whoever created this was.
Speaker A:The creativity is impressive.
Speaker A:So I want to get into.
Speaker A:So you know, what's, what's.
Speaker A:You've been doing a lot of research recently and a lot of using analytics and telemetry.
Speaker A:Any interesting findings, any anything good observations you've had from, from recent research.
Speaker B:Obviously we have been looking into how AI basically is going to, is going to change the industry.
Speaker B:So what we have done is a series of CTF events and the idea is to, to compare like, you know, AI capabilities versus human capabilities.
Speaker B:So we started actually doing this like a, a year ago that was the first event that.
Speaker B:At a small scale, I would say.
Speaker B: know, I mean, I guess around: Speaker B:When we say AI teams, the reality is that these are like, you know, human in the loop, AI with human in the loop.
Speaker B:So the results are pretty interesting actually.
Speaker B:And by the way, we have a talk today at RSA to present these results and in a few days we're going to publish a research paper which lends exactly what we did.
Speaker B:But yeah, like in a nutshell, basically what we found out was that especially when it comes to elite players, like if, let's say the productivity actually skyrocketed.
Speaker A:Absolutely.
Speaker B:So yeah, this is something very, very interesting.
Speaker B:The other interesting part was that we see, basically we see AI agents and models not doing very.
Speaker B:When it comes to broad networks, like enterprise level, you know, networks when they're focused on, you know, microfen specific tasks and all these things.
Speaker B:Yes, they're doing, they're doing fine, obviously.
Speaker B:The other interesting part is that it seems that AI automates and streamlines basically, let's say the low level tasks which typically, traditionally is with water.
Speaker B:People start their career in cybersecurity.
Speaker B:That's something that, you know, I know that the industry is thinking about, like how we bridge that gap.
Speaker B:I think for us, for me is in this case, training and upscaling is even more important.
Speaker B:Right.
Speaker B:You spend more time on, you know, platforms like hack the books.
Speaker B:In order to bridge that even I.
Speaker A:Find myself, you know, I like to learn things, I like to do it manually because I like, because I find that I learn more when I actually understand what's happening in the background.
Speaker A:So I like to build a particular slow approach, learn how it works.
Speaker A:But of course, when you get into the ctf, time is so critical, you have to move fast.
Speaker A:If I'm doing it just to target and learn skills, I can go at my own pace.
Speaker A:In a ctf, you want to be like, you know, it's like I compare it like a Formula one race seconds counts.
Speaker A:So you want to be able to go as fast.
Speaker A:And AI is an accelerator.
Speaker A:I always call it the Mushroom and Super Mario Kart.
Speaker A:When I get it, it makes me go super fast.
Speaker A:Doesn't make me a better driver.
Speaker A:So you still have to know the skills.
Speaker B:Exactly.
Speaker B:That's a great point.
Speaker B:Actually.
Speaker B:You still need, you know, the reason part, you still need to know what are the questions actually that you're going to Ask, what are the prompts that you're going to make?
Speaker B:If you don't know all these things, then to your point, you're not.
Speaker B:You're not going to be.
Speaker A:Yeah, you're not going to be.
Speaker A:You'll be all over the place, like in Super Mario Kart, if you're not a better driver.
Speaker B:Exactly.
Speaker B:So I think, I think this is going to.
Speaker B:This is going to stick around.
Speaker B:This is going to be part of the training from now on.
Speaker B:Yeah.
Speaker B:How we're thinking about this task.
Speaker B:Yes, fine.
Speaker B:You know, certain parts will be automated, basically, but, you know, this doesn't mean that people, you know, are not going to be around to govern legacy.
Speaker B:All these agents basically, to orchestrate, to provide feedback in order to become better.
Speaker A:So, yeah, absolutely.
Speaker A:I think it becomes an observability and, you know, we become the watchers to make sure they're actually doing the things we expect them to do.
Speaker A:And even I love, you know, when I'm doing CTFs, I tend to also, you know, use things like Actrix AI, which is like, you know, it helps me move faster and do things quicker from, you know, the data that I'm getting back is where should I go next?
Speaker A:Or how should I use that?
Speaker A:It was interesting, is one of the things that, you know, I'm based in Estonia and last year we have an event every year, it's called Cyber Spike, which is like a.
Speaker A:This is a Nordic cyber battle.
Speaker A:It's a lot of, you know, kids come together and they compete.
Speaker B:Right.
Speaker A:And it's interesting last year because I think, you know, ski, what you're talking about from the research is the teams that didn't use AI, their skills were really good and they did well.
Speaker A:But the group that actually used AI, their skills were not the best.
Speaker A:They were good, but because they used AI, they would be able to move at a faster pace.
Speaker A:And they won.
Speaker A:They, they, you know, they won the competition because they were able to keep ahead of the other teams by actually complementing their, their skills with AI to make them much more empowered and stronger.
Speaker A:Just like that mushroom.
Speaker B:Yeah.
Speaker B:Very, very interesting.
Speaker A:Yeah.
Speaker A:So, so what here at RSA conference?
Speaker A:What.
Speaker A:What's been your observations?
Speaker A:I felt like I'm a bit of an AI conference rather than a security cyber conference.
Speaker A:But what's been the key takeaways?
Speaker A:What have you found walking around the floor, the messaging and even that in community here?
Speaker B:Yeah.
Speaker B:Frankly speaking, it's my first rss.
Speaker B:Yeah.
Speaker B:So so far I was leaning towards like, you know, black hat and defcon type event.
Speaker B:So it's my first time, so I have nothing really to compare.
Speaker B:I mean, it's a huge event.
Speaker B:It's a scale that I couldn't imagine, to be honest.
Speaker B:Like before I come here.
Speaker B:Yeah, like, you know your point?
Speaker B:Yes.
Speaker B:AI is everywhere.
Speaker B:You know, sometimes as people say, like, like a lot of the things we, we see, you know, around us, like, I think in the future they're going to be just like features right under, like something bigger.
Speaker B:I think that's, that's a trend that, let's say I was able to confirm here, like very, very specific focus.
Speaker B:At some point we're going to see merges and acquisitions.
Speaker B:Like.
Speaker A:Yes, absolutely.
Speaker B:To become, to become something, something bigger.
Speaker B:The other thing I noticed, I mean, it was like, you know, some focus on AI governance.
Speaker B:I think that's important.
Speaker A:Absolutely.
Speaker B:So yeah, it's not, it's not, it's not only about, let's say, cyber capabilities of AI and the offensive defense.
Speaker B:It's also like, you know, how we're thinking about orchestration, how we're thinking about, you know, governance and all this.
Speaker B:I think they're going to be even more important.
Speaker A:Absolutely, absolutely.
Speaker A:I mean, I believe that agentic AI is the new insider risk.
Speaker A:So I think that in the next, probably within this year, we probably will see a massive, you know, incident or cyber incident or data breach that will actually be not from humans and not from misconfigurations, but from basically an agentic AI agent going rogue.
Speaker A:And that's something that, you know, we should be able to make sure that we have the visibility and the governance to be able to minimize the impact of it.
Speaker A:But my concern is that, you know, people are opening up their entire data sets to AI and that can be a massive risk if you don't approach it, you know, in the right way.
Speaker B:And this is one of the areas where we have been focusing on as hack the box.
Speaker B:We start with our AI red teaming basically path on the academy side and also a lot of labs basically around the same thing.
Speaker B:But we want to focus both on what we call AI for security and security for AI.
Speaker B:So yes, this means how you attack, how you protect, how you assess, basically AI powered systems, but also how you use AI in your job, in your day to day, basically job as a pen tester or as a defender.
Speaker B:You're going to see more actually coming out very soon.
Speaker A:Fantastic.
Speaker A:That's really exciting.
Speaker A:It's important to make us productive, but at the same time we need to also be effective and efficient as well.
Speaker A:You know, we need to maintain the skills and not lose the skills.
Speaker A:And I think that's really important is that, you know, we should use AI to help us move fast, but we should also use the kind of the training to make sure that we're learning and that when AI is not available that we still know how to do things.
Speaker A:That's the concern is that even a lot of times I always compare it to the vehicle and driving, you know, all of a sudden you're an autonomous vehic vehicle.
Speaker A:You know, it feels, do you still have a driver's license?
Speaker A:You know what to do?
Speaker A:Do you still know how to drive a car?
Speaker A:And I think that's important.
Speaker B:That's a good way to put it.
Speaker B:Yes.
Speaker A:So, so, you know, this industry changes so much and we all have to stay up to date.
Speaker A:We all have to learn new things.
Speaker A:What's your source of, you know, learning and, you know, knowledge?
Speaker A:Do you have mentors?
Speaker A:Do you have like podcast books, events like this that you go to, to, to stay up to date?
Speaker A:How do you, how do you step to date in this fast moving world?
Speaker B:Yeah, podcasts for sure.
Speaker B:Also like, you know, industry reports.
Speaker B:Frankly speaking, I have side actually to build my own agent that can analyze actually all these reports coming in because there's like so much information out there.
Speaker B:So I need at least you know, some, some summaries to start with and then I can, I can dive into like the details for, for the topics I need to.
Speaker B:LinkedIn for sure.
Speaker B:Like, it's, it's, it's a big, it's a big, you know, source for me, but also, you know, reports coming from industry analysts, firms we've been working with, you know, with some firms.
Speaker B:So yeah, I'll.
Speaker A:Fantastic, fantastic.
Speaker A:And if the audience.
Speaker A:Do you have questions or want to, you know, follow up what, you know, what's the best way to reach out or have questions how we should reach out to you?
Speaker B:LinkedIn.
Speaker B:LinkedIn is fine.
Speaker A:Fantastic.
Speaker A:We'll make sure we get all, we'll make sure that we also get the research paper and all of the kind of links and everything into the show notes.
Speaker A:So it'd make it easier for the audience in order to be able to follow up at a later stage.
Speaker A:Jimar, it's been awesome having you on the show and it's really exciting to do these episodes in person because normally for me it's always online and sitting in my office over a camera.
Speaker A:And it's a pleasure to have you and meet you here.
Speaker A:And I think what Hacktivox is doing is really awesome.
Speaker A:And I think you're definitely changing the workforce, knowledge and skill gap and closing that to a point where we can stay up to date and we can do great things and innovate and stay ahead.
Speaker A:So everyone, thanks for tuning in a special edition of the Security By Default podcast here at the RSAC conference for you.
Speaker A:Tune in every two weeks.
Speaker A:New episodes, new guests, new topics, stay safe, take care, until next time.
Speaker A:Thank you and goodbye.
