AH-001: After Hours in the GhostShell — CTFs vs Real Pentesting (6 Sep 2026)
Source: YouTube · HaxrByte · published Sep 8, 2026 · 1:07:45
In the debut episode of "After Hours in the Ghost Shell," Hackbite and Tom from Pentest TV debate whether CTF skills transfer to real penetration testing 0:45.
Key Takeaways:
• Tom argues CTFs alone aren't right for beginners—repetition on well-known exploits (e.g., PortSwigger labs) matters more, since CTFs feature obscure, unrealistic targets 11:02.
• Hackbite counters that CTFs help if you treat each like a real engagement: document vulnerabilities and hunt all attack paths, not just flags 14:02.
• CTFs create bad habits—every box is compromisable, while real engagements mostly yield low-severity dead ends and often no root 16:54.
• A pro pentester needs technical knowledge, enterprise architecture, and communication—write reports, do peer reviews, and practice presenting findings 23:02.
• Tom recommends deep architecture certifications (Cisco, AWS, Active Directory) over pentest certs—domain depth wins client trust 28:41.
• AI (e.g., Claude) speeds up pentesting—reverse engineer exploits in a local lab before touching production 43:25.
• Never blindly trust AI—EU laws mandate human involvement, and companies are dropping bug bounties over AI garbage reports 53:36.
The stream continues weekly with free mentorship via their channels and Discords—CTFs are great, but just one small piece of becoming a professional pentester 1:06:26.
Sources:
- 0:45 Show introduction and hosts
- 11:02 CTFs not ideal for beginners
- 14:02 Treating CTFs as engagements
- 16:54 CTF bad habits vs. reality
- 23:02 Three pillars and report writing
- 28:41 Architecture certs over pentest certs
- 43:25 AI's positive impact
- 53:36 AI trust and accountability
- 1:06:26 Closing thoughts
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hi everyone. Welcome, welcome, welcome. I just have some feedback. Oh my goodness. I think that sounds better. Welcome everyone. This is after hours in the ghost shell uh the weekly live cyber security discussion and it's going to be with hackbite and Tom from Pentest TV and the idea is to be live every Sunday at 8:00 p.m. Eastern and 700 p.m. Central. So hopefully hopefully we can keep this going. Uh just a quick quick intro about myself. I'm Axabite. I spent more than 20 years working in cyber security penetration testing and red team operations. And let me hand it over to Tom. >> Yeah. So my name is Tom Wilhelm. Uh I've been hacking for over 20 years to offensive security for over 30. Um written a couple books like seven to be honest. Uh, and uh, right now I'm a for a uh, penetration te…