Organisations hire me to break into their systems before someone else does. These are the field notes: how the attacks actually work, what the defences missed, and why it matters, from AI systems to corporate networks and everything in between.
A full methodology for red-teaming an enterprise AI deployment end to end: the attacker goals, the trust-boundary model, and every vector exercised across the identity plane, the LLM proxy, the cloud backend and the coding agent, with a one-line findings overview.
Read the methodology →LLM and agent security: prompt injection, RAG and memory poisoning, tool and MCP abuse, and permission-boundary bypass.
Adversary simulation and purple teaming: initial access, C2, evasive payloads, post-exploitation and debrief.
OWASP Top 10, broken access control, authentication failures and business-logic flaws across web, API and thick clients.
Misconfigurations, trust abuse and lateral movement that turn a single foothold into domain compromise.
Evading endpoint protection, web filters, proxies and firewalls, and building tooling that blends into normal activity.
RBAC abuse, credential sprawl and lateral movement across cloud tenants and the identity planes that gate them.
I'm Ridhwan Roshan. I grew up watching Sneakers and The Matrix on repeat, convinced that breaking into things for a living was the coolest job that would never actually exist. Turns out it does, and I've been doing it for years: leading red team engagements end to end, from social engineering the front desk to pulling Domain Admin out of a misconfigured certificate authority.
Now AI is rewriting the field in real time, and honestly, it feels like the Matrix is happening as we speak. I spend most of my time red-teaming AI-backed enterprise applications, internal assistants and agentic workflows, finding the ways that untrusted content, over-trusted tools and weak identity turn a helpful copilot into an attack surface.
I never had much fascination for writing blog posts. It always felt like the part of the job that took longer than the actual hacking. Then AI changed that too. Most of the heavy-lift writing on this site was done with the help of Claude, and I'm genuinely grateful for it. So: thank you to Claude for making a terrible blogger into a slightly less terrible one, and thank you to every organisation I've worked with for giving me the stories worth writing about.
Ghost Sec Writes is where those stories land, written for educational purposes, from the assessments I've delivered across data centres, automotive, financial services and other sectors.
Connect on LinkedIn →