# Understanding Hackers' Work: An Empirical Study of Offensive Security Practitioners

**Authors:** Andreas Happe, Jürgen Cito  
**arXiv:** [2308.07057](https://arxiv.org/abs/2308.07057)  
**Date:** 2023-08-14  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2308.07057v3/

## Key points

- Qualitative study on offensive security testing focusing on security professionals' work processes
- Aim to gain insights into hackers' decision-making and challenges during assignments
- Recommendations for enhancing automation efficiency and identifying areas for further research
- Opportunities for researchers and tool builders in offensive security testing
- Emphasis on hackers' work processes compared to existing research in secure software development and defensive security testing
- Discussion on prevalence of web application frameworks among interviewees and preference for grey-box testing
- Limited utility in researching collaborative solutions except for Red-Teaming scenarios with C2-framework integration

## Summary

This paper presents a qualitative study on offensive security testing, focusing on the work processes of security professionals. The aim is to gain insights into hackers' decision-making and challenges during assignments. The analysis provides recommendations for enhancing automation efficiency and identifies areas for further research. The discussions and implications section addresses opportunities for researchers and tool builders based on tedious or time-consuming areas in offensive security testing. The related work section highlights existing research in secure software development and defensive security testing, emphasizing the novelty of this study's focus on hackers' work processes. Comparisons with previous studies underscore the unique contribution of this paper in delving into hackers' thought processes, decision-making mechanisms, and challenges faced in academic and automation research. The prevalence of web application frameworks among interviewees is discussed, along with their preference for grey-box testing, suggesting that SBOM-based solutions may improve efficiency. It also notes that most assignments were carried out individually or in small teams, indicating limited utility in researching collaborative solutions except for Red-Teaming scenarios where collaborative solutions integrated into C2-frameworks are commonly used. This refined summary highlights the significance of understanding hackers' work processes to enhance automation efficiency while providing valuable insights for researchers and tool builders to address challenges and explore new avenues for innovation in offensive security testing.