Sept. 2, 2026

Winning DEF CON CTF, Failing at Consulting, and Building an All-Senior Hacker Firm — Erik Cabetas (Include Security)

Show Notes

Erik Cabetas won DEF CON CTF his first year, failed at running a consulting shop, then came back five years later and built Include Security into an all-senior application security firm serving billion-dollar software companies.

Erik Cabetas is the founder and "head hacker herder" of Include Security, an application security firm he's run for nearly 15 years.

His path there was anything but linear. He was a materials engineering major who dropped an entire semester two months before graduation to switch to computer science. He learned to hack from zines and FTP servers before Google existed, after a college roommate put Back Orifice on his machine in 1998. He got his first security job by cold-emailing, at 4am, a guy he'd seen on a documentary that aired at 3am. He won DEFCON CTF in 2003 on a team that was in dead last when he asked to join — and his contribution wasn't the two exploits he wrote, it was reorganizing who on the team did what.

Then he tried to start a company, and it didn't work. He went solo for five quarters, took four clients, hit his revenue target almost exactly to the dollar — and quit anyway, because he'd worked himself into the ground to get there and couldn't see it getting easier.

Five years later he tried again. Include Security launched in January 2011 with three clients already signed.

This is a full start-to-finish conversation. Erik walks through the Ernst & Young Advanced Security Center team that spawned Bishop Fox, Gotham Digital Science, and his own company. Burning out on the road at Fortify Software. Running security, fraud, and trust & safety at The Ladders through the 2008 crash — including being handed the layoffs after HR was laid off. And what it actually took to build a firm that deliberately has no junior hackers on it, in an industry where nearly everyone runs a 70%-junior pyramid.

He's unusually candid about the parts founders normally skip: what his rent was, what number he set for himself, why sales and legal were harder than any technical work he'd ever done, why refusing to use his own network was a mistake, why it took him five years to find one salesperson he trusted, and why the real driver of pen testing demand is B2B contract language rather than compliance.

Some of what we get into:

Learning security in 1998, and why Erik thinks it's harder now, not easier
The Honeynet Project forensics challenges, and writing for 2600 at 20
Getting hired at E&Y off a cold email, and being 22 telling a Fortune 500 you have root
Why he left a job the moment they promoted him
Include Security "version zero" — the attempt that failed, and exactly why
Reading an entire commercial product's source code in a week to survive a customer site
Cutting seven-figure credit card fraud by 98% with a few hundred lines of T-SQL
The bad RFP responses that convinced him the industry could be done better
The all-senior model vs. the pyramid model, and what clients actually notice
54 programming languages, and what they found in the largest production Rust app they've assessed
How paid research time works, and the blog posts that turned into DEF CON talks
Concrete advice for starting a consulting firm today — including why he lets future competitors subcontract off his company
Drum & bass, the Spawn soundtrack, and searching Napster by random nouns

Links

Include Security: https://includesecurity.com
Include Security research blog: https://blog.includesecurity.com

Books Erik recommends

Security Engineering — Ross Anderson
The Ghidra Book — Chris Eagle & Kara Nance
Never Split the Difference — Chris Voss
The Trusted Advisor — David Maister