Pentesting
Penetration testing on web applications, networks and infrastructure
,:.
;X3hHSS#B&BGX
2#@@@@@@@&&&@@@#2.
M@@@BH32XssrrsXX5S9;
H@&@GAssi;;;:::;;ir5G,
s@B@92Xsri;;;::::;irr55
A&&@S2Xi;;:,,,::,,:;ii3
X&&@MsXAA232s:,,:r53223s:
s&B#A3SHM353HM5AhSH53h22M,
XH9Hs3MM#SG3MHH;hHHGMhX;;
XAGhrXXA322Xs5A;i52AAAAs
r22iiXsrsXXsXAXr,i2Xsss;
:AA;;ssii;;:iA5M552iiii;
:XrirXXr;;;iX3MhMGhh5Xi
;rrX22s2S#Sh3A2hHSGsr
XXXsXX5h2AsrAAXsrXX;
r552AXsrri;;rrrriXX
i;5hhh32AXrrii;iAXr
XB ;5hMHHMGSSGMhH93
2&@h .r5HSS#9BBB9#2AX
:2S@@@@h ,i5HGGSSGhAXh5 sMX;
.sH&@@&&&&@M. ;X55552AAH2, h@&9G5s;
rh9@@@&&&&&&B@G, ,iXXAXAHX ,M@@@@@B#Hr
,XM9@@@&&&&&&&&&&B@S, .i::irrA: is3&B&&&&&&@5
rhB@@@&&&&&&&&&&@&&BB@S. ,;;:,,;i: ir#&B&&&&BB9@X
;59@@@&&&&&&BBB&&&&&BBBBB@G, ,r 3@9B&&@&BBBB
2@@@&&&&&&&BBBBB&&&&&BBBBBB@M ; . H@9&&&&BBB@2
r@@&@&&&&BBBBBBBBB&&&&&BBBBBB@3 ,9BB&B&&BB&9
H@&@@&&&&&BBBBBBBBBB&&&&BBBBBB@A . s@9B&B&&9B@s
#@&@@&&&&&&&BBBBBBBBB&B&&&&&BBB&r M@9&&&&B9@H
;#B@@@&&&&&&&&&B&&B&&BBBB&&&&&&B&B; i&BB&&&&B&@i
2&&@@@@&&&&&&@&&&&&&&&&&BBB&&&&&B&S. h@9&&&&&B@G
G@@@@@@&&&&&&@@&&&&&&&&&&&&&&&&&&B@M ;BBB&@@&B@@i
@@@@@@@@@@@@@@@@&&&&&&&&&&&&&&&&&&B@A M@B&&@&&@@H
&@@@@@@@&@@@@@@@@&&@&&&@&&&&&&&&&&&&&; , 2@B&&@@&@@&: C:\BORBOLLA> type profile.txt
Renato Basante Borbolla
Pentester | Red Team | Offensive Security
AI Engineer — Vibe Coding & Vibe Hacking
Hacker by essence. Low profile by choice.
Vibe Coding. Vibe Hacking. Secure by design.
Security tested from the attacker's perspective.
São Paulo, Brazil
+ 3.959 followers
Active presence in the cybersecurity community
Who I am
I am an Information Security professional specializing in Offensive Security, with a strong academic background that includes undergraduate and postgraduate studies in Cybersecurity with an offensive focus, as well as an MBA in Information Security. I hold relevant industry certifications and have hands-on experience in Pentest, Red Team and continuous risk assessment in enterprise environments.
I currently work with Bradesco's Red Team, conducting penetration tests and adversary simulation exercises across web and mobile applications. My work focuses on proactively identifying vulnerabilities, validating realistic attack paths, analyzing impact, reducing exposure and continuously strengthening the organization's security posture.
Rather than treating vulnerabilities as isolated issues, I focus on understanding how different weaknesses can be chained, exploited and used in realistic adversarial scenarios. This approach makes it possible to assess not only whether a vulnerability exists, but also its exploitability, operational context, potential impact and the controls capable of interrupting or reducing an attack.
I work collaboratively with technology, development, infrastructure, security and business teams, turning technical findings into actionable evidence, understandable risk scenarios and recommendations aligned with organizational needs. The goal is to support more precise decisions and contribute to the continuous evolution of security controls, processes and architectures.
I also work with Artificial Intelligence Engineering applied to cybersecurity, using Vibe Coding and Vibe Hacking concepts to accelerate the development of prototypes, AI agents, automations, analysis tools and workflows focused on offensive security.
This approach combines rapid experimentation, technical creativity and an adversarial mindset with Secure Engineering principles, result validation, risk control and Security by Design. AI is used as a resource to extend human capability, reduce repetitive tasks, organize evidence, support technical analysis and make security exercises more efficient and consistent.
My work connects Offensive Security, automation and artificial intelligence to anticipate adversary behavior, validate risk in practical ways and help ensure that applications, products and infrastructure are built and tested from an attacker's perspective.
// Areas of Interest
Red Team
Adversarial simulations and advanced offensive exercises
Threat Intelligence
Cyber threat analysis and attack surface monitoring
OSINT & Social Engineering
Passive reconnaissance and ethical social engineering
Digital Forensics
Investigation and forensic analysis of cyber incidents
AI Engineering — Vibe Coding & Vibe Hacking
AI-assisted engineering, offensive workflow automation and secure prototyping focused on productivity, security and technical validation.
How I operate
Red Team (The Attacker)
FOCUS: Adversary Simulation.
ACTION: Exploits flaws using real TTPs.
OBJECTIVE: Find the "path" before the criminal does.
Pentest (The Hunter)
FOCUS: Identify and validate vulnerabilities.
ACTION: Perform controlled exploitation within the authorized scope.
OBJECTIVE: Prove exploitability, demonstrate technical and business impact, and drive remediation priorities.
Purple Team (The Collaborator)
FOCUS: Continuous Improvement via Feedback.
ACTION: Red and Blue operate together with full transparency.
OBJECTIVE: Speed up flaw remediation and increase organizational resilience in an agile way.
Digital Forensics (The Expert)
FOCUS: Investigation and analysis of digital evidence.
ACTION: Collection, preservation and forensic analysis of data.
OBJECTIVE: Determine root cause, support incident response and back attribution hypotheses with available evidence.
Competencies
Penetration Testing
Red Team Operations
Cyber Threat Intelligence
OSINT
Social Engineering
AI Engineering & Vibe Coding/Hacking
C2 Frameworks
AWS Cloud Security
Azure Cloud Security
Purple Team
Tools & Technologies
Metasploit · Cobalt Strike · Burp Suite · Nmap · Wireshark · Splunk · BloodHound · Mimikatz · Responder · CrackMapExec · Impacket · Evilginx · GoPhish · Sliver · Havoc C2 · Kali Linux · Hashcat · John the Ripper · Hydra · Aircrack-ng · Bettercap · Nuclei · ffuf · Gobuster · Amass · Subfinder · httpx · Katana · sqlmap · XSStrike · Nikto · Nessus · Masscan · Frida · Objection · JADX · Apktool · MobSF · Ghidra · YARA · Volatility · Autopsy · CyberChef · Codex · Claude Code · Opencode · DeepSeek · Cursor · LLM Studio · Velociraptor · Sigma · KQL
Professional Experience
Bradesco [CURRENT]
Senior Cyber Security Engineer | Red Team Ops
Apr 2026 – Present | São Paulo, Brazil
Itaú Unibanco
Senior Cyber Security Analyst | Pentest
Dec 2022 – Apr 2026 | São Paulo, SP
3 yrs 5 mos
Riachuelo
Senior Cyber Security Analyst | Red Team Ops
Jan 2020 – Dec 2022 | São Paulo and Region, Brazil
3 yrs
PwC
Senior Cyber Security Consultant | Pentest
Oct 2018 – Jan 2020 | São Paulo and Region, Brazil
1 yr 4 mos
KPMG Brazil
Cyber Security Consultant | Pentest
Mar 2018 – Oct 2018 | São Paulo, Brazil
8 mos
PROOF
Cyber Security Analyst | Blue Team
May 2016 – Mar 2018 | São Paulo and Region, Brazil
1 yr 11 mos
Education
> Education
Faculdade Líbano
Lato Sensu Postgraduate Specialization, Forensic Psychology
2025 – 2026
Universidade Cruzeiro do Sul
Lato Sensu Postgraduate MBA, Computer and Information Systems Security/Information Assurance
2020 – 2021
Faculdade Facint
Lato Sensu Postgraduate Specialization, Ethical Hacking and CyberSecurity
2019 – 2020
UNINOVE
Bachelor's degree, Information Security
2013 – 2015
> Areas of Expertise
Ethical Hacking · Penetration Testing · Red Team Operations · Cyber Threat Intelligence · Mobile Pentest
> Recent Courses
Purple Team Operations
GoHacking | 2026
Skills: Penetration Testing
Ethical Hacking iOS Mobile Application Pentesting
GoHacking | 2025
Skills: iOS App Testing
Ethical Hacking Mobile Application Pentesting
GoHacking | 2023
Skills: Android Testing
Web Application Penetration Tester eXtreme
INE Security | 2024
Skills: Penetration Testing
Cyber Threats: Attack and Defense
Universidade do Vale do Itajaí | Univali | 2023
Skills: Vulnerability and Threat Management
Professional Pentest
Desec Security | 2021
Skills: Penetration Testing
Breaching Cloud
Black Hills Information Security | 2020
Skills: Penetration Testing and Cloud Computing
eLearnSecurity Web Penetration Tester v1
INE Security | 2020
Skills: Penetration Testing
Microsoft Certified: Azure Fundamentals – AZ-900
Microsoft | 2020
Skills: Windows Azure
Analysis, Observation and Detection of Suspicious Behavior
National Police Academy | 2020
EHPX – Ethical Hacking Post Exploitation
GoHacking | 2020
Skills: Penetration Testing
Ethical Hacking Command and Control
GoHacking | 2020
Skills: Penetration Testing
Mobile Pentest on Android Applications
Desec Security | 2020
Skills: Penetration Testing, Android Testing
Wireless Hacking Enterprise
Desec Security | 2020
GitHub Projects
Selected public GitHub projects, excluding the portfolio repository itself.
UltimateSpray
AWS API Gateway proxy manager for authorized identity-security assessments, with proxy rotation, multi-region deployment and offline test previews.
Python | AWS · Red Team · Proxy
OffensIA
Evidence-driven AI offensive-security orchestration platform with default-deny scope, finding validation and a hash-chained audit trail through MCP.
Python | AI · MCP · Pentest
imovel-radar
Real-estate search platform with daily collection, price history, property comparison, cost analysis and home-purchase planning.
Python | Real Estate · Data · Automation
HackerDummy
Benchmark for evaluating AI/LLM pentest agents with deliberately vulnerable labs, answer keys and recall/precision metrics for offensive-agent assessment and fine-tuning.
Python | AI · Pentest · Benchmark
airset
Router Social Engineering Toolkit for simulating router interfaces and awareness/social-engineering test flows in controlled environments, combining HTML and Shell.
HTML / Shell | Wireless · Lab · Shell
Crowdfinder
PowerShell tool for inventorying domain endpoints and identifying hosts without the CrowdStrike sensor, supporting coverage validation and protection-gap discovery.
PowerShell | PowerShell · Endpoint · Detection
reverse-apk
Reverse APK Analyzer for Android decompilation and security assessment, integrating Manifest analysis, permissions, components, URLs/endpoints, certificates and Nuclei scans.
Shell | Mobile · Reverse · APK
public-pentesting-reports
Curated collection of public pentest reports for research and benchmarking of methodology, evidence, findings, impact and remediation patterns across assessment types.
CSS | Reports · Research · Pentest
Checklists
Operational collection of checklists and references for Pentest and Red Team, designed to support enumeration, technical validation, coverage and assessment consistency.
Markdown | Methodology · Red Team · Pentesting
Talks and Interviews
Why new data leaks matter (and why you should pay attention)
I contributed to this report alongside other cybersecurity specialists, discussing the real-world impact of new data leaks — from spear phishing, smishing and identity fraud to reputational, legal and operational risks — and reinforcing the importance of continuous prevention and data protection.
TecMundo (Estadão) | Feb 20, 2025
We put a HACKER to analyze HACKER GAMES!
Technical analysis of hacking games from a cybersecurity professional's perspective.
Voxel | 2024 | Appearance
Intrusion Techniques XP with Bruno Fraga
Special appearance at the event on advanced intrusion techniques.
Técnicas de Invasão | 2023 | Appearance
The new SCAM that can steal your data: BitB phishing
Media appearance about Browser-in-the-Browser (BitB) phishing, fake pages and credential theft.
Cibersegurança / Phishing BitB | 2022 | Appearance
Akamai - Cyber Security Talks
Talk on cybersecurity, modern threats and infrastructure protection.
Cyber Security Talks | 2022 | Talk
Introduction to Red Teaming
Talk on Red Team fundamentals and practices in corporate environments.
StarsCTF - Virada Hacker | 2021 | Talk
He gets paid to hack - TecMundo
Interview about a professional career in offensive security and pentesting.
TecMundo Entrevista | 2020 | Interview
Cyber Talks - Interview with Renato Borbolla
Details about research on a database with 260,000 logins and passwords.
Cyber Talks | 2019 | Interview
Talks and Interviews appearance
Additional video featuring Renato Borbolla. Public date/title metadata was not indexed for verification.
YouTube | Data não informada | Appearance
Contributions
Tecmundo (Estadão)
External Cybersecurity Contributor
Aug 2019 – Aug 2026 | Cybersecurity
7 yrs
Hakin9 Magazine
Technical Writer on Penetration Testing
Apr 2016 – May 2018 | Pentesting
2 yrs 2 mos
Pentest Magazine
Technical Writer on Penetration Testing
Jan 2017 – Dec 2018 | Pentesting
2 yrs
eForensics Magazine
Technical Writer on Penetration Testing
Mar 2017 – Nov 2018 | Digital Forensics
1 yr 9 mos
Rádio Animix
System Administrator
Mar 2013 – Jan 2014 | Culture and Arts
11 months
Recommendations
Recommended by renowned market professionals.
Thiago Brandão
Analista de segurança sr | Itaú Unibanco
Em 14 de setembro de 2026, Thiago trabalhou na mesma equipe que Renato
Trabalhei com o Renato no Itau e foi uma das melhores parcerias que eu tive. Entrega com qualidade, comunica bem e assume responsabilidade sem medo. Tenho orgulho da parceria que tivemos e do quanto ele me ensinou.
Felipe Payão
Editor-chefe do TecMundo, Minha Série, Voxel e The BRIEF
Em 11 de setembro de 2026, Felipe trabalhou com Renato, mas em empresas diferentes
Excelente profissional com ótimas contribuições, também, para a comunicação da cibersegurança no Brasil.
Tiago Iahn
CISO | CISM | SecurityX | Pentest+ | CySA+ | Linux+ | ISO/IEC 27001 Lead Auditor | Information Security Leader
Em 17 de dezembro de 2024, Tiago foi mentor de Renato
Renato é um profissional de primeira linha. Definitivamente está e se mantém atualizado perante novos conhecimentos, assuntos e demandas relacionadas a segurança da informação. O conheço desde muito tempo, participando em eventos de segurança, trocando informações e conhecimentos.
Diogo Gonçalves Soares
Lead Security Engineer | OSWE | OSCP | Pentest+ | eCPPT | Threat Hunting | Elastic Security
Em 12 de dezembro de 2022, Diogo Gonçalves trabalhou com Renato, mas em equipes diferentes
Excelente profissional que tive o prazer de conviver! Dedicado, comprometido e sempre buscando aprender cada vez mais!
Se ele entrar na sala, tire os seus dispositivos da tomada! É sério!...
Paulo Brito
Editor do CISO Advisor
Em 14 de julho de 2020, Paulo trabalhou com Renato, mas em equipes diferentes
Renato é um profissional que apesar de já acumular grande experiência nunca descuida da atualização dos seus conhecimentos. Tenho testemunhado o esforço, o trajeto e os resultados. Nota 10 ao Renato pelo cuidado em manter-se atualizado com o conhecimento da área de cibersegurança - o que, diga-se de passagem, nunca foi fácil. Mas ele consegue.
Ataide Junior
Sócio Diretor | CISO | IPv7.Group | Hunterspay
Em 13 de julho de 2020, Ataide trabalhou com Renato, mas em empresas diferentes
Renato Borbolla, já fizemos alguns trabalhos juntos, e o mesmo tem uma capacitação imensa na área de segurança, redteam e blueteam. Um cara completo!
Ezequiel Souza
Cybersecurity, Privacy, Governance, Risk Management Partner
Em 5 de novembro de 2019, Ezequiel supervisionava Renato diretamente
Renato é um ótimo profissional, demonstra muito comprometimento, assiduidade e profissionalismo.
Tecnicamente é muito eficaz e atua de forma clara e transparente.
Está sempre se aperfeiçoando e buscando conhecimento. Tem paixão por desafios e provê resultados consistentes e constantes.
Samir Maia
Cyber Security Analyst Senior | Bradesco
Em 30 de março de 2019, Samir trabalhou na mesma equipe que Renato
Renato é um excelente profissional com grandes conhecimentos em segurança e pentest. É um prazer fazer parte da mesma equipe que o mesmo, obtêm muitas habilidades que no dia a dia faz a diferença. Além de ser muito ético, sempre colabora com os profissionais que estão ao seu redor.
Marcos Henrique
CISO
Em 16 de janeiro de 2019, Marcos supervisionava Renato diretamente
O Renato é um profissional diferenciado, além de ser muito responsável e comprometido com seus entregáveis está sempre em busca de novos conhecimentos, trabalha muito bem em equipe, compartilha conhecimentos de forma descomplicada e se destaca pelos sólidos conhecimentos em segurança da informação, principalmente na realização de PenTest, sem dúvidas é um dos melhores profissionais que já tive a oportunidade de trabalhar.
Dimas Tomadon
Docente Centro Paula Souza / Coordenador de Segurança da Informação / Perícia Forense Computacional | Perícia Judicial | Auditoria de SI | SOC | MSS
Em 6 de novembro de 2018, Dimas supervisionava Renato diretamente
O Renato é um profissional e pessoa que da orgulho de dizer que foi um prazer trabalhar com ele.
Traz uma característica marcante que é a determinação em crescer na carreira, mas não a qualquer custo. Isso envolve ética, respeito pelo colega de trabalho e muita dedicação no cumprimento das atividades e desafios que lhe são atribuídos.
Recomendo fortemente ter o mesmo como parte da equipe.
Marcelo Leite dos Santos
Analista de Infraestrutura | Cloud AWS e Azure | Suporte | Redes
Em 25 de outubro de 2018, Marcelo supervisionava Renato diretamente
Trabalhei com Renato. É um profissional focado, sempre em busca de conhecimento e com foco de trazer os melhores resultados para equipe e a empresa.
Thiago Ramos Fanfoni
Senior Platform Engineer | Kubernetes | Terraform | AWS | CI/CD
Em 28 de abril de 2017, Thiago era sênior em relação a Renato mas não supervisionava Renato diretamente
I worked with Renato while he was an intern at the Cásper Líbero Foundation.
Renato is quite skilled and has very high knowledge in matters related to IT security despite being at the beginning of his career.
Rafael M da S Santos
1º MVP da Splunk no Brasil | Instrutor Certificado da Splunk e EC-Council | Especialista em SOC | Líder do Grupo de Usuários da Splunk no Brasil
Em 26 de abril de 2017, Rafael trabalhou com Renato, mas em equipes diferentes
Renato is a highly applied professional, has a high degree of focus in his studies (Information Security) and is always looking for new challenges, as well as being a good listener for ideas.
Marcelo Azevedo
Arquiteto de Segurança da Informação - C|EH, CySA+, Security+, MCSA, ISO 27001
Em 13 de janeiro de 2016, Marcelo trabalhou na mesma equipe que Renato
Excelente profissional e pessoa, obstinado, proativo, ótimo na identificação de vulnerabilidades.
Artigos & Cases
Let's talk
Reach out through my social networks or send an email to
© 2026 Renato Basante Borbolla. All rights reserved.
🛡️ Protected by me — Yes, I tried to hack it myself. Couldn't.
{ EOF — Built. Broken. Secured. }