Does Hiring the World’s Best Hackers Improve Security?

Bringing the world’s best hackers into an organization can certainly make it stronger, but their capabilities do not automatically become the security level of the entire company.

A long time ago, I started writing an article with this title and then stopped. At the time, I was watching companies hire famous hackers or acquire highly capable security firms, and one question kept bothering me. If an organization brings some of the world’s best offensive security experts inside, does the organization’s overall security really improve by the same amount?

I could not fully organize my thoughts back then. But while watching DEF CON CTF in 2026, that old question came back. This time, it was no longer about hiring one or two famous hackers. Researchers employed by companies were competing across multiple teams at one of the world’s most prestigious CTFs, and their employers were actively presenting those results as evidence of research capability and technical competitiveness. Researchers from ENKI WhiteHat participated in teams that placed 1st, 5th, and 12th in the DEF CON CTF 34 qualifiers, with all three advancing to the finals. SK Shieldus EQST reached the finals as part of an international coalition that included researchers from NAVER Cloud, Finland, and Japan. Theori also publicly highlighted Team ABCD’s participation in the DEF CON 2026 finals.¹

At first, I saw this simply as evidence that Korean CTF teams had become stronger. But the more I looked at it, the more I saw a different change. The twenty-year effort to turn the capabilities of individual hackers into organizational capabilities has entered another stage.

This article is not written to tell companies how to use hackers. It is for younger people who are doing CTFs today, or who are just beginning vulnerability research, bug bounty work, or penetration testing. I want to think about what kind of opportunity is opening in front of you, and what may lie beyond that opportunity, from the perspective of someone who has watched this industry for a little longer.

1. At First, Companies Hired Exceptional Individuals

In the early 2000s, the security industry had its share of star hackers. Hiring someone who had built a reputation in reverse engineering, malware analysis, packer analysis, vulnerability research, or another specialized field could itself become a signal of a company’s technical strength. From a company’s perspective, this was a rational strategy. Someone who deeply understood an attacker’s techniques could find problems that the existing organization had never seen.

Over time, many of these people moved into freelance work or specialized consulting. As the penetration-testing market grew and companies increasingly asked external specialists to evaluate systems from an attacker’s perspective, individual technical skill began to acquire a market price. Naturally, some of those specialists eventually formed teams and companies of their own.

That was an important transition. Companies were no longer buying the capability of a single talented individual. They began to acquire groups of people who already knew how to work together, along with the culture that had formed around them.

GrayHash was one of the examples I spent a long time thinking about when I first tried to write this article.

2. GrayHash Was an Attempt to Bring a Hacker Collective Inside the Company

In December 2018, LINE Plus acquired GrayHash and reorganized it as an internal security organization called GrayLab. LINE was explicit about its goal. It wanted to bring GrayHash’s offensive research capabilities inside the company and use them to develop and apply security solutions for messaging, fintech, AI, blockchain, cryptocurrency exchanges, and other businesses. LINE’s Japanese announcement also described GrayHash as becoming a wholly owned subsidiary.²

What makes this case interesting is that GrayHash was not a large company. Looking back at financial data I had collected years ago, GrayHash reported roughly KRW 1.399 billion in revenue and KRW 84.4 million in operating profit in 2017. In 2018, it reported roughly KRW 1.336 billion in revenue and KRW 28.8 million in operating profit.³

Judged only by those numbers, it was not the kind of company a large technology company would acquire for revenue scale alone. Yet LINE acquired it. That matters. The acquisition price does not appear to have been publicly disclosed, so it would be inappropriate to make claims about how much LINE paid. But it is reasonable to infer that GrayHash’s value to LINE was not primarily its revenue. LINE itself emphasized the offensive research capability and security expertise of a team made up of world-class white-hat hackers.²

In other words, what the company was buying was not simply the revenue of a consulting business. It was closer to people, accumulated experience, an attacker’s way of thinking, and an already established research culture.

At the time, this looked like a fairly advanced strategy. Building an offensive research team one hire at a time is difficult. Bringing in a team that had already worked, researched, and produced results together could be much faster.

After the acquisition, GrayLab researchers described their role as finding cybersecurity problems inside LINE and working with engineers to solve them. LINE also continued to expand its external security community activities, bug bounty program, and internal security organization.⁴

So was the strategy successful?

That is where the question becomes difficult.

3. Even the Best Hackers Cannot Solve Every Security Problem in a Company

Several years later, the security issues surrounding LINE and NAVER revealed a very different class of problems. After the information leak disclosed in late 2023, LY Corporation’s own explanations pointed to issues involving outsourced service providers, the system and network structure between NAVER and the former LINE organization, and the security of employee systems. Japan’s Ministry of Internal Affairs and Communications subsequently called not only for improvements in security controls and vendor management, but for a fundamental review of security governance across the group.⁵

I had focused on similar issues in notes I wrote years earlier. Those notes highlighted broadly permitted network access, insufficient multi-factor authentication for important internal systems, and weaknesses in mechanisms for detecting unauthorized activity.³

It would be wrong to conclude that “LINE hired world-class hackers and still had an incident, therefore the GrayHash acquisition failed.” There is no evidence for such a simple causal relationship.

The more important lesson is different.

Having a world-class offensive research organization and having a secure enterprise architecture are not the same thing.

The ability to discover vulnerabilities is different from the ability to redesign network boundaries across affiliated companies. The ability to build a sophisticated exploit is different from the ability to replace authentication mechanisms used by thousands of employees. A researcher may identify a dangerous structure, but changing that structure may require business teams to give up convenience, different organizations to renegotiate responsibility, and the company to spend money and accept operational disruption.

The difference becomes clearer when we look at scale.

In 2024, LY Corporation said it planned to spend approximately JPY 15 billion per year on security measures after the incident, including enterprise-wide improvements such as strengthening firewalls.⁶

I am not trying to compare that number directly with GrayHash’s revenue and claim that one was “more expensive” than the other. They are different kinds of numbers from different periods and should not be compared that way. But together they illustrate something important.

Acquiring a world-class hacker team and changing the security structure of a very large enterprise are problems of very different scale and character.

In my old draft, I had also written down an estimate of around USD 18.5 million for the cost of security improvements associated with the Japanese regulatory response. However, I had explicitly marked that number as a ChatGPT estimate, so I do not use it as evidence in this article.³ The more reliable figure is LY Corporation’s official statement that it planned approximately JPY 15 billion in annual security investment.⁶

That distinction matters.

Offensive Security is extremely important, but Offensive Security is not the whole of Security.

4. In 2026, We Are Moving to the Next Stage Again

That is why GrayHash came back to mind when I watched DEF CON CTF this year.

In the 2000s, companies hired exceptional individuals. In the 2010s, some of those individuals formed companies, and larger organizations sometimes acquired those companies and entire research teams. Now something slightly different is happening.

Companies are no longer waiting for fully formed hackers to emerge before hiring them. They are entering the ecosystem in which hackers grow, compete, and conduct research.

Several teams in the 2026 DEF CON CTF 34 finals included researchers from Korean companies and universities. Researchers from organizations such as EQST, NAVER Cloud, ENKI WhiteHat, Theori, Toss, and Samsung Research were involved across different teams. ENKI researchers were spread across three separate teams that placed 1st, 5th, and 12th in the qualifiers, while an international coalition involving EQST advanced to the finals alongside researchers from NAVER Cloud, Finland, and Japan.¹

Companies do not describe these activities as mere personal hobbies. SK Shieldus has connected CTF results and support for research activities to stronger cybersecurity response capabilities, while Theori presents international hacking competitions and offensive security expertise as part of the company’s identity.⁷

I do not think this is a bad change. On the contrary, it creates a valuable opportunity.

In the past, talented hackers often had to create their own market. They might become freelancers, start small companies, or move abroad. Today, companies are increasingly willing to provide research time, equipment, peers, international competition opportunities, and stable salaries while building offensive security researchers.

For a young researcher, there is no reason to reject that environment.

But there is one thing I hope you remember.

The capability a company pays you for today is not necessarily the capability you should spend your entire career optimizing.

5. CTF Is an Extraordinary Place to Learn Problem Solving, but Reality Does Not Give You the Problem

CTFs are an excellent environment for learning security. Under time pressure, you analyze code, identify vulnerabilities, think about bypasses, and build exploits. Solving many problems also gives you intuition for the kinds of mistakes people repeatedly make when designing systems.

But CTF has one crucial difference from reality.

It tells you that a problem exists.

You start knowing that there is a flag somewhere. If you receive a binary, you assume there is an intended weakness inside it. If you receive a web challenge, you assume there is some path that can be discovered and exploited.

Real systems do not tell you that.

You do not begin with the statement, “There is a vulnerability here.” You begin with, “This system is currently operating normally.” You first have to decide what to look at. You may not know whether the real problem is in the code, the authentication model, a network trust boundary, or the relationship with an external service provider.

I ran into the same distinction while thinking about attack paths. Finding one vulnerability and building a real attack path from multiple vulnerabilities and environmental conditions are different tasks. A single finding does not automatically become an intrusion scenario. You have to keep asking what capability the attacker gained and whether that capability satisfies the preconditions of the next step.⁸

And there is an even harder question beyond that.

What must change to eliminate the attack path?

6. A Good Hacker Will Not Always Mean the Person Who Finds the Most Vulnerabilities

When you are young, people who solve very difficult problems look impressive. They are impressive. Solving in a few hours what others struggle with all day, or finding a vulnerability nobody else saw and proving it with an exploit, is not an easy capability to develop.

So this is not an argument against CTF. If you have the opportunity, I hope you do a lot of it.

I just hope you do not stop there.

At first, you solve problems that someone else designed. Then you start finding vulnerabilities nobody told you about. With more experience, you begin to notice strange relationships in the system rather than isolated bugs. Why can this server reach that network? Why does this service account have this privilege? Why do we trust this external system this far?

At that point, hacking starts to become something different from problem solving.

In a recent article on attack paths, I described human intuition not as the ability to compute every possible combination, but as the ability to decide what does not need to be explored and to choose the directions worth investigating. Experienced analysts do not brute-force every combination of vulnerabilities in their heads. They use knowledge of systems, protocols, architecture, and operational practice to look first at the places that feel wrong.⁸

I suspect this capability will become more valuable, not less.

7. As AI Gets Better, Knowing What to Ask May Matter More

I do not think AI will simply replace all security professionals. But I also do not think today’s division of labor will remain unchanged.

AI-assisted security research is already improving rapidly at finding vulnerability candidates, analyzing code, executing commands, and maintaining attack sequences in constrained environments. At the same time, current agents still show important limits when tasks require unusual discovery, long adaptation, or moving beyond familiar challenge patterns.⁹

That raises a question I hope younger researchers will think about.

If AI becomes able to solve more problems and generate more vulnerability candidates, is it wise to build your entire competitive advantage around “getting the flag faster than everyone else”?

In a world with too many findings, something else may become scarce.

The ability to decide which problem matters. The ability to look at the whole system and identify suspicious boundaries. The ability to connect phenomena that appear unrelated. And the ability to explain a discovered problem in a form that can actually be acted upon.

When I divided the roles of humans and AI in my attack-path work, these were largely the tasks I kept on the human side: deciding which assets and impacts matter, identifying suspicious boundaries in architecture and operations, choosing which hypotheses deserve verification effort, and making the final judgment about real-world impact.⁸

8. “Knowing How to Solve the Problem” Also Needs a Different Definition

At this point, it is tempting to say, “Then the next generation should not only find problems, but solve everything themselves.”

Reality is not that simple.

Most security problems cannot be solved by one person. Network teams control networks. Product teams have to change product architecture. Replacing an authentication system may require dozens of services to move together. Some problems require budget. Others require management decisions. Some cannot be fixed immediately at all.

So when I say “someone who knows how to solve problems,” I do not mean a hero who personally fixes everything.

I mean someone who can turn a technical discovery into a problem that other people can understand and act on.

There is a big difference between saying, “We found an SSRF,” and saying, “Because this service is allowed to reach an internal trust zone, the SSRF we found today—and future input-validation bugs of the same class—can repeatedly produce the same attack path. If we remove this condition, we can eliminate several paths at once.”

Attack-graph research points in the same direction. For defenders, counting every possible attack path is often less useful than identifying the small number of conditions whose removal can break many paths at once. That is why I emphasized this point in my recent work as well.⁸

You do not have to be the person who changes the firewall policy yourself. The important part is knowing what needs to change.

9. Looking Again at CTF in 2026

The change taking place in the Korean security industry is fascinating.

Individual hackers formed teams. Teams became companies. Some of those companies were absorbed into larger organizations. Now large companies and specialized security firms are using capital and infrastructure to build stronger research collectives from the beginning.

I do not think this trend will fail.

It will probably succeed quite well.

Korea may produce more DEF CON finalists, more CVEs, and more Pwn2Own results. It is also a good thing if talented researchers can spend more time doing offensive research without worrying constantly about how to make a living.

But history suggests one thing clearly.

We have become progressively better at bringing individual offensive capability into organizations. We hired star hackers. We acquired companies created by hackers. Now we are directly cultivating hacker ecosystems and research teams.

Yet there is still a large gap between bringing offensive capability into an organization and turning that capability into a real improvement in security.

When GrayHash was a small company, what it possessed could not be explained by revenue alone. LINE recognized the value of its people and technical capability and brought that inside. But years later, many of the issues LY Corporation had to address involved access control, system separation, vendor management, authentication, and governance—problems at a much larger organizational scale. The company ultimately moved toward approximately JPY 15 billion per year in security measures.²⁵⁶

This history is not a story about who did well and who failed.

It is a story about how large the problem called security really is.

10. What I Want to Say to Younger Hackers

Companies will continue to pay for excellent hackers. They will probably pay even more in the future. CTF results, CVEs, Pwn2Own wins, bug bounty results, and published research will create good opportunities.

I hope you take those opportunities.

Join a good company. Meet strong colleagues. Compete internationally. Get research funding. Do the research you have always wanted to do.

But do not confuse the price a company puts on your current skills with the final destination of your own growth.

Being good at solving problems is an excellent place to start.

But some people can notice that something is wrong even when nobody tells them there is a problem. Some can see the larger structure hidden behind one vulnerability. And some can take what they discovered and turn it into a form that other people can understand, prioritize, and act on.

I believe the last two kinds of people will become increasingly rare and increasingly valuable.

Especially as AI lowers the cost of solving problems.

So enjoy the moment when you capture the flag. CTF is a powerful way to learn, and that moment is worth enjoying. But eventually, you have to step into systems where nobody has hidden a flag for you.

There, the problem has no name. There is no score. At first, you may not even know whether a problem exists.

And even if you finally find one, nobody necessarily fixes it immediately.

Maybe that is where hacking really begins.

For more than twenty years, we have kept improving the way we move the capabilities of individual hackers into companies, teams, and larger organizations. The corporate involvement now emerging around CTF is part of that same history.

The next generation may have to prove something slightly different.

Not how difficult a problem you can solve, but whether you can find something nobody considered a problem—and help create a direction in which it can actually change.

Does hiring the world’s best hackers improve security?

My answer today is this.

Great hackers certainly make an organization stronger. But individual offensive capability does not automatically become enterprise security capability.

And for younger hackers, the more important question may be this:

Will I stop at becoming one of the world’s best problem solvers? Or will I become someone who can find the problem when nobody even knows what the problem is—and turn it into something that can actually be solved?

References