I’m Ahmed Sultan. Some people know me as 0x4148, others by different names I’ve used around the internet.
I work somewhere between offensive security, research, security engineering and entrepreneurship. Usually all at once.
I have over 13 years of experience in offensive security. Add a few more if you count the unpaid years of curiosity, experimentation, and occasional destruction.
I got into hacking for fun. I was curious about how things worked, how they broke, and what I could do with them. Somehow, that turned into a career. I’m still doing pretty much the same thing, except now there are meetings, budgets, and people expecting me to act responsibly.
I’ve spent most of my career in offensive security, vulnerability research, red teaming, and bug bounty hunting. I’ve worked with national cybersecurity teams, security firms, financial institutions, startups, and other organizations across different industries. I’ve broken into plenty of systems (with permission, unfortunately), built security capabilities, and led technical teams.
Knowledge isn’t an object. It’s a flow.
What keeps me busy
I’m the CTO and co-founder of DeXpose, where we’re building a unified cyber risk and threat intelligence platform. My work combines engineering, threat intelligence, security research, product development, and business strategy.
I also lead Security Engineering and Red Team at Callsign.
Previously, I worked with EG-CERT and co-founded RedForce, among other roles and organizations throughout my career.
Despite spending more time leading teams and building products these days, I still enjoy hands-on hacking, independent vulnerability research, bug bounty hunting, and experimenting with AI-powered offensive security.
I’ve published security research and vulnerability disclosures on Exploit-DB and Packet Storm.
Certificates, training & other expensive hobbies
Over the years, I’ve earned:
- OSCE
- OSCP
- OSWE
- OSEP
- GXPN
- GCPN
- GSLC
- GDAT
- GMOB
- GWAPT
- OSWP
- eCPTX
- eWPTX
- eCRE
- CPTE
- Certified Windows Security Master
- Certified Red Team Operator
- Red Team Lead
…and others.
I’ve also spent a lot of time in live, instructor-led offensive security training — hands-on courses and specialized workshops run by some of the sharpest teams in the field, alongside years of self-study and practical research. Among the ones I’ve trained with:
- SpecterOps
- Offensive Security
- FortyNorth Security
- MDSec
- Corelan
- Dark Side Ops
- CQure Academy
…among others.
I’ve learned that certifications don’t automatically make someone a good hacker. I’ve met brilliant researchers without any, and certified experts who probably shouldn’t have sudo access.
There’s always more to learn, which is slightly annoying after all these years.
Why this blog exists
I originally started this blog to share security research, vulnerabilities, and technical findings. But cybersecurity isn’t the only thing that interests me.
I’ll write about pretty much anything that catches my attention, technical or not.
Some posts will be deeply technical. Others will be opinions, random thoughts, or things nobody asked me to write about.
This is my personal corner of the internet, not a corporate knowledge base.
No fixed topics, no publishing schedule, and definitely no LinkedIn stories about how ordering coffee taught me five leadership lessons.
Beyond the keyboard
I enjoy reading, movies, music, good food, and spending time with friends and family. I’m curious about almost everything, and I rarely run out of things to read or question.
Good restaurant recommendations are always welcome.