About Me
It is better to be a warrior in a garden than a gardener in a war.
often attributed to Miyamoto Musashi
whoami
Igor “iggy” Stepansky. Security Researcher at OX Security, where I build agentic AI for offensive security: autonomous systems that chain vulnerabilities and logic flaws into real attack paths, the way a pentester would, minus the coffee breaks. Before that, Orca Security’s Research Pod.
My research has turned up unauthenticated remote code execution in AI/LLM serving frameworks, a use-after-free race in the Linux kernel’s ksmbd SMB3 server, and a steady stream of supply chain and CI/CD vulnerabilities across the modern developer stack. Under all of that sit years of hands-on AppSec: SAST, SCA, IaC scanning, secrets detection, malicious-package hunting, and hardening cloud, container and GitHub environments.
The pattern, if there is one: I like high-impact bugs in infrastructure that is deployed everywhere, I like handing the fix back (a regular CVE contributor to open-source software), and I like to learn by being slightly out of my depth. New domain, new target, new rabbit hole. That’s the fun part.
7CVEs found+1 pending 8talks4 recorded
Experience
- 2026 - present
Security Researcher @ OX Security
Teaching machines to hack. Autonomous, agentic pentesting at the intersection of offensive security and AI: the detection engines, the decision-making logic, and the research into vulnerability chaining and logic flaws, prototyped and shipped into production alongside engineering and data science.
- 2025 - 2026
Security Researcher @ Orca Security
The Research Pod. AppSec, API and Kubernetes research, detection logic for new vulnerabilities and supply-chain threats, and zero-days found and responsibly disclosed along the way, a use-after-free in the Linux kernel's ksmbd among them. Plus the writing, and the conference stages that come with it.
- 2022 - 2025
Security Engineer @ Axonius
Where the AppSec muscle was built. Owned security across the full SDLC: SAST, SCA, DAST, IaC and secrets-detection programs, security code reviews for R&D, malicious-package analysis, cross-company remediation, and pentest engagements. The first DEF CON talk happened from here.
- 2020 - 2022
Cyber Security Analyst @ Rafael Advanced Defense Systems
Blue team first. SOC monitoring, alert triage and first-response incident investigation across network and endpoint. Knowing what the defenders actually see is still the most useful thing I carry into offense.
Community
- OWASP Israel, CFP committee. I read the abstracts. Write a good one and I will go to bat for it.
- BSidesTLV, volunteer staff. The crew that keeps the con running. Come say hi.
- Off the security scene. Volunteered with ELEM (youth in distress) and in elderly community support, 2024.
Certifications & education
- OSWE (Offensive Security Web Expert), in progress
- AWS Certified Cloud Practitioner
- B.Sc. Computer Science, the Open University of Israel, in progress (the slow way, around everything above)
Off the clock
Dad life first. Everything after this sentence is a hobby: Brazilian Jiu-Jitsu (chess with chokes) and long runs (a marathon just wasn’t long enough), a soldering iron and whatever has a CPU, and whichever new thing I’m learning this month. Three human languages (English, Hebrew, Russian) and more computer ones than is healthy.
Contact
- GitHub: https://github.com/iggypopi
- LinkedIn: https://www.linkedin.com/in/igor-stepansky