Rachel Tobac

Yeah. So they wouldn't tell me the names of the companies that were potentially going to be acquired. But I would say things like, I saw a rumor about XYZ company. Is this the type of company that you would be excited about? And then the wink, wink, hand-waving process starts of, you know, I can't confirm it, but we are interested in integrating things like XYZ.

Yeah. So they wouldn't tell me the names of the companies that were potentially going to be acquired. But I would say things like, I saw a rumor about XYZ company. Is this the type of company that you would be excited about? And then the wink, wink, hand-waving process starts of, you know, I can't confirm it, but we are interested in integrating things like XYZ.

So I was able to glean information such that when I reported it back to the team, they were like, I mean, yeah, you got the right information. Nobody said anything in plain language, but you can get people to say things kind of beating around the bush. So in the end, I got M&A info out of 50% of the interviewers, three out of six. I debrief with the security team.

So I was able to glean information such that when I reported it back to the team, they were like, I mean, yeah, you got the right information. Nobody said anything in plain language, but you can get people to say things kind of beating around the bush. So in the end, I got M&A info out of 50% of the interviewers, three out of six. I debrief with the security team.

I ask them when they want to discuss the results with the organization. They say, well, let's just wait up and just finish the hiring process so that it's not a distraction to them. And in the meantime, the next day, I actually get an email that I used to apply for this role, that I was being moved to the next stage of the interview process to get an offer.

I ask them when they want to discuss the results with the organization. They say, well, let's just wait up and just finish the hiring process so that it's not a distraction to them. And in the meantime, the next day, I actually get an email that I used to apply for this role, that I was being moved to the next stage of the interview process to get an offer.

So not only did I siphon out the info I needed during the interview pen test, I also got the job, I guess.

So not only did I siphon out the info I needed during the interview pen test, I also got the job, I guess.

I know, I should put PM on there.

I know, I should put PM on there.

They realized that when they explained to people that they were not allowed to say the words of the acquisition, they realized that they needed to be clearer in their communication. That... No, just because you're not saying we are acquiring XYZ company, it doesn't mean that friends, family on social media, people can't glean information to understand, oh, they're interested in AI.

They realized that when they explained to people that they were not allowed to say the words of the acquisition, they realized that they needed to be clearer in their communication. That... No, just because you're not saying we are acquiring XYZ company, it doesn't mean that friends, family on social media, people can't glean information to understand, oh, they're interested in AI.

This person's talking about how their role is going to change. They're talking about how much they love this specific technology and they're tagging certain companies on Instagram or Twitter.

This person's talking about how their role is going to change. They're talking about how much they love this specific technology and they're tagging certain companies on Instagram or Twitter.

They realized that they needed to be much more specific in their protocols and language, saying, when we're planning an acquisition, once we talk about it internally, please do not talk about it even in a hand-waving fashion with friends or family or on social media. Don't talk about how your role is going to change on LinkedIn. Don't talk about what you're excited about upcoming on Instagram.

They realized that they needed to be much more specific in their protocols and language, saying, when we're planning an acquisition, once we talk about it internally, please do not talk about it even in a hand-waving fashion with friends or family or on social media. Don't talk about how your role is going to change on LinkedIn. Don't talk about what you're excited about upcoming on Instagram.

They had to be really clear about that. And once they did that, those leaks stopped because it wasn't an insider threat. It was just people not 100% getting what an attacker is interested in and how they could find that info.

They had to be really clear about that. And once they did that, those leaks stopped because it wasn't an insider threat. It was just people not 100% getting what an attacker is interested in and how they could find that info.

It did. Yeah, it doesn't necessarily mean that it's coming through the interview process. Now, maybe it was, but it's probably just that people in general at the company didn't understand that when talking in generalities, that can be used by attackers too.

It did. Yeah, it doesn't necessarily mean that it's coming through the interview process. Now, maybe it was, but it's probably just that people in general at the company didn't understand that when talking in generalities, that can be used by attackers too.