Penetration Testing Experience and How to Get It

The talk, given by Phillip Wylie, addresses a common obstacle for people trying to enter penetration testing: plenty of learning resources exist, but employers still ask for experience. He opens with his own path from retail and construction work into security, noting that a self-taught background and an interest in how systems work helped him land a consulting role. He also separates penetration testing, which aims to find and validate every exploitable weakness, from red teaming, which emulates a real threat actor and tests whether defenders detect it.

The middle of the session covers the tools and skills to pick up, including vulnerability scanners, Linux and Windows administration, Nmap, Metasploit, Burp Suite and ZAP, and basic reverse engineering of Java archives and Android apps. For proof of ability, he recommends platform-based labs such as TryHackMe and Hack The Box, paired with written walkthroughs. He also suggests bug bounty programs and low-cost or pro bono testing for nonprofits and small businesses as real-world practice, and argues that discovering CVEs can impress employers more than a certification.

In closing, he encourages newcomers to publish writeups, sample reports, scripts on GitHub and short videos, and to network at local meetups and online communities. Audience questions covered promoting content, moving from contracting to in-house roles, and whether AI will replace testers, with his view that AI will mostly automate routine scanning and validation work. The overall message is that visible, demonstrable evidence of skill matters more than waiting for a title.