Key Takeaways
- Alex Mor began hacking at 16, progressed through military service, a physics degree, and roles at EY Hacktics and AB InBev before leading A Security’s research team.
- The ten‑person research squad works in short cycles: teaching the agent new skills, sharpening existing ones, and building proof‑of‑concept capabilities driven by real‑world gaps and internal benchmarks.
- Human judgment is translated into explicit rules for AI agents, enabling rapid deployment—discoveries made on a Tuesday can be active in production within weeks.
- The team’s most notable finding was a Zoom zero‑day that allowed silent computer takeover via the annotation feature, uncovered in a single day using publicly available AI models.
- Mor’s “Moby Dick” is not a single exploit but the ability of an agent to chain findings, asking “what can I do with this?” after each discovery.
- While AI accelerates vulnerability discovery, the harder task is teaching agents to validate, contextualize, and trust their own conclusions; human researchers will shift toward teaching, evaluating, and exercising judgment.
Background and Early Hacking Journey
Alex Mor began hacking at 16, learning mostly through Capture‑the‑Flag competitions and by probing systems on his own. When he found vulnerabilities he reported them to the vendors, receiving a “premium” account as a reward—a modest incentive that kept him motivated. After completing infantry service in the IDF and earning a Bachelor’s degree in physics, he sought his first professional role and was drawn to an opening at EY for penetration testers. The fact that an accounting firm housed an elite hacking team intrigued him, and joining EY Hacktics marked the start of his career in cybersecurity.
Professional Path: From IDF to EY Hacktics
At EY Mor spent nearly eight years conducting hundreds of penetration tests across web, thick‑client, mainframe, VDI and internal networks for major banks, insurers, telecoms and hospitals. He later transitioned into leadership, shifting the focus from isolated bug hunting to full red‑team simulations that covered reconnaissance, phishing, and the “trophy hunt.” Working under the EY Hacktics CTO, he authored the team’s playbook, defined tactics, techniques and procedures, built internal tooling, and trained the next generation of hackers before advancing to senior manager roles overseeing software security and product security architecture.
Expanding Experience at AB InBev
After leaving EY, Mor spent six years at AB InBev, the world’s largest brewer, confronting the same puzzling question: why does a beer company need a cybersecurity team? He built the security testing capability from the ground up, scaling it across hundreds of applications and thousands of developers. This experience gave him deep insight into securing large‑scale enterprise environments and reinforced his belief that security must be embedded wherever valuable digital assets reside.
Joining A Security: Mission and Team Structure
Mor joined A Security, a cybersecurity startup founded in 2025 that now employs 66 people. He leads a ten‑person research team that he describes as operating like a small squad rather than a collection of isolated specialists. Each researcher owns one or more areas from start to finish—understanding a technique, writing specifications, reviewing documentation, testing in hard and misleading environments, trying the method on real targets, and collaborating with engineering to ensure the implementation matches intent. Ownership is collaborative; researchers frequently validate each other’s work to prevent knowledge from becoming siloed in a single individual.
How the Security Research Team Operates
Research is organized into cycles, each falling into three buckets: teaching the agent a new skill, sharpening an existing skill, and building a new capability accompanied by a proof‑of‑concept. Two main inputs drive the agenda: real‑world shortcomings the platform missed during client engagements, and internal benchmarks that reveal where the agent is weak. Defining what “thorough” means for the AI is a core challenge; researchers must decide what evidence suffices, when to doubt a result, when to pursue a hypothesis further, and when to stop—judgments that expert pentesters make instinctively but must be made explicit for the agent.
Teaching Agents: Turning Human Instinct into Explicit Logic
Agents can uncover findings that would take human researchers considerably longer, yet they also hallucinate, lose context as a story unfolds, or chase the wrong hypothesis for too long. When an agent fails, the team investigates the root cause and converts that lesson into the next research cycle. The feedback loop is remarkably tight: a discovery made on a Tuesday can be encoded into the agent and deployed against live environments within a couple of weeks, after which it runs on every engagement indefinitely, continuously improving the platform’s coverage.
Research Influence on Product Development
Insights gleaned from real targets, customer environments, and newly discovered vulnerability classes feed directly into product direction. Researchers review agent runs, pinpoint missing checks, note where workflows are too shallow, and identify infrastructure that needs strengthening. Lessons derived from a failed run or a real‑world incident can become benchmarks, prompt engineering tasks, formal product requirements, and eventually code, ensuring that the platform evolves to close the very gaps it discovers.
Landmark Discovery: The Zoom Zero‑Day
The team’s highest‑impact finding to date was a zero‑day in Zoom’s annotation feature. By exploiting the trust the feature placed in the amount of data a peer claimed to send, an attacker could overflow a buffer and gain code execution on any participant’s machine—Windows, Mac, iPhone or Android—without the victim clicking, downloading, or seeing anything. The flaw allowed silent takeover of a computer simply by being present in the same meeting. Privately reported to Zoom, the vendor issued a patch before the vulnerability was disclosed publicly.
Chaining Vulnerabilities: The Researcher’s “Moby Dick”
Mor stresses that isolated exploits are less valuable than the ability to chain them into a realistic attack path. He seeks a “rabbit hole” where privilege escalation leads to misconfigurations, exposure of secrets, access to production databases, and ultimately unencrypted personally identifiable information. His “Moby Dick” is not a specific target but the behavior of an agent that, like a human pentester, immediately asks, “What can I do with this?” after each finding and decides whether the result is worth pursuing further. Teaching this chaining behavior remains one of the hardest aspects of agent training.
Competitive Landscape and AI’s Impact
The local offensive‑security community is tight‑knit; researchers know each other, ideas circulate quickly, and this familiarity keeps standards high. Globally, autonomous offensive security is still a nascent field—many teams experiment, yet no consensus formula has emerged. AI changes the nature of competition: discovering a new bug class is only the first step. The greater challenge lies in teaching an agent to recognize the flaw, investigate it, test exploitability, and reach a decision that can be trusted, turning raw detection into reliable, actionable intelligence.
Future of Human Security Researchers
Mor does not anticipate the disappearance of human researchers; instead, their role will evolve. They will spend less time manually executing every test and more time teaching agents, evaluating agent performance, and exercising judgment on business logic, trust boundaries, and how seemingly minor issues combine into real attacks. The most effective researchers will leverage AI to cover far more ground, reserving their own creativity for context‑rich questions that machines struggle to interpret, such as interpreting subtle policy implications or anticipating adversary motivation.
Conclusion: The Evolving Role of Offensive Security
In summary, A Security’s research team illustrates how offensive security is shifting from manual, expert‑driven hunts to AI‑augmented, continuously learning agents. By marrying deep human expertise with systematic agent training, the team not only uncovers critical flaws like the Zoom zero‑day but also builds the mechanisms to prevent similar flaws from reaching customers. The future points to a partnership where human insight provides judgment and creativity, while machine speed and scalability handle repetitive testing and rapid deployment—together delivering stronger, more resilient security outcomes.
