Built a thing: SecTools.ng Free cybersecurity tools, no sign-up. Career path finder, CV reviewer and interview coach if you are breaking in. Report generator and risk explainer if you are already in. Try one, tell me what breaks. sectools.ng

Proposed: Lagos Hack Day. Let them break it, with written permission, on staging, and the findings stay private. Not announced yet. Waitlist: michaeladeyanju.com/hackday

Done and Delivered ❤️

I am looking for a handful of Nigerian companies willing to let strangers try to break their product for a day. That sentence is deliberately uncomfortable, so here is exactly what it means. A live hacking day in Lagos this Q4. Several testers who have never seen your product, one focused day, and a debrief at the end where the people who built it sit with the people who broke it. Everything is scoped and authorised in writing before anyone touches anything. You name the assets. Staging or a scoped test tenant, never production, never customer data. Rules of engagement signed by every tester, and no signature means no participation. And the part most companies actually want to ask about. The findings are yours. Nothing is named on stage, in a post, or in a recap, now or later. That is not a courtesy I am offering, it is the condition that makes any of this possible, and I would rather lose a sponsor than break it. What you get is not a report. It is a morning of several people with no assumptions about your system, and an afternoon where your engineers understand why a flaw existed rather than just that it does. In my experience that conversation outlives every document I have written. This is not announced. No date, no venue, because I am not booking either until enough companies commit. If you would put a product in that room, the next step is a 15 minute call that ends in a clear yes or no. luma.com/iz0b1daz

I am putting a room together in Lagos this Q4, and there is now a page where you can put your name down. The shape of it. Vetted testers. Nigerian products volunteered by the teams who built them. Every asset authorised in writing before anyone opens Burp. One focused day of testing, then a debrief where the people who built the thing sit with the people who broke it. No production data, staging or a scoped test tenant only. Three ways to be in that room. If you test, you get a real target instead of another lab box, and a write-up you can put in front of an interviewer without redacting it into nothing. If you build something, you get several testers who have never seen your product, one day of their full attention, and findings that stay private. Nothing is named on stage, in a post, or in a recap. That is not a courtesy, it is the condition that makes a company willing to volunteer at all. If you sponsor, you get a room of people who do this work on a Tuesday, not an audience rented for a logo. There is no brief yet because there is no headcount yet. Now the part most event posts leave out. This is not announced. There is no date and no venue, because I am not booking either until enough companies say yes. If that does not happen, everyone on the list hears it from me directly instead of watching the posts quietly stop. luma.com/iz0b1daz

Lagos HACK DAY: luma.com/iz0b1daz

The first question under my last post was the right one. Is this legal? Yes, and the answer is the whole design rather than a disclaimer at the bottom. Scope. Every asset written down and named before the day. Staging or a scoped test tenant. Nothing in production and no customer data, which also keeps everyone clear of NDPA territory. Authorise. Rules of engagement signed by every tester, and written authorisation from someone at the company who can actually give it. Not a verbal yes from a founder in a WhatsApp group. If there is no signer, there is no participation. Test. One focused day inside the agreed window. Nothing outside the list, no matter how interesting it looks sitting there. Scope discipline is most of the professionalism in this work and it is the part beginners find hardest. Debrief. The people who built it sit with the people who broke it. Findings stay private. Technically there is very little separating what happens in that room from a crime. The difference is a document, a signature and an agreed window, and that paperwork is not overhead sitting in front of the interesting part. It is the entire thing that makes this a profession. If you run a product and that structure sounds like something you could get signed off, the door is open. #Cybersecurity #PenetrationTesting #ApplicationSecurity #InfoSec

Vulnerability disclosure programmes for Africans

I am looking for a handful of Nigerian companies willing to let strangers try to break their product for a day. That sentence is deliberately uncomfortable, so here is exactly what it means. A live hacking day in Lagos this Q4. Several testers who have never seen your product, one focused day, and a debrief at the end where the people who built it sit with the people who broke it. Everything is scoped and authorised in writing before anyone touches anything. You name the assets. Staging or a scoped test tenant, never production, never customer data. Rules of engagement signed by every tester, and no signature means no participation. And the part most companies actually want to ask about. The findings are yours. Nothing is named on stage, in a post, or in a recap, now or later. That is not a courtesy I am offering, it is the condition that makes any of this possible, and I would rather lose a sponsor than break it. What you get is not a report. It is a morning of several people with no assumptions about your system, and an afternoon where your engineers understand why a flaw existed rather than just that it does. In my experience that conversation outlives every document I have written. This is not announced. No date, no venue, because l am not booking either until enough companies commit. If you would put a product in that room, the next step is a 15 minute call that ends in a clear yes or no. #Cybersecurity #ProductSecurity #Startups #Fintech #Lagos

Most breaches aren't sophisticated. They're boring. A forgotten subdomain. A reused password. A compliance checkbox someone mistook for security. I've spent years finding these exact three mistakes inside companies that thought they were fine. The pattern doesn't change, only the logo on the report does. If you're a founder or CTO and you've never had someone actually try to break in, that's the gap. DM me "PENTEST" and I'll send you a sample report so you can see what one looks like before you commit to anything. #penetrationtesting #offensivesecurity #cybersecurity #infosec #startupsecurity #SOC2 #CISO #applicationsecurity