I’m Łukasz Pastuszak, a penetration tester based in Lublin, Poland, working remotely for Velite. I break things professionally and then explain, in writing, exactly how and why they broke.

My work sits mostly on the offensive side: web application assessments, network penetration testing, endpoint hardening, and adversary emulation. I also speak at industry conferences and write up what I learn - some of that ends up here.

What I do

Web application security assessments - black-, grey- and white-box engagements covering OWASP Top 10, authentication and authorization flaws, and business-logic vulnerabilities, from scoping through exploitation to retesting.

Network penetration testing - internal and external network engagements, using C2 frameworks and a broad offensive tooling stack.

Endpoint hardening assessments - validating Windows and macOS configurations against real-world attack techniques, and testing the resilience of deployed AV/EDR solutions such as WithSecure, Microsoft Defender for Endpoint and Wazuh. Every technique that succeeds comes back as a concrete remediation and detection-engineering recommendation.

Adversary emulation - researching emerging APT tradecraft and TTPs, then operationalising and validating them during engagements, with a focus on techniques actively used against the banking, energy and healthcare sectors. Attack paths are designed and mapped to MITRE ATT&CK.

OSINT and external attack surface - reconnaissance-driven assessments mapping exposed assets and information leakage.

Reporting - technical and executive-level deliverables with risk ratings, proof-of-concept material and prioritised remediation roadmaps. In my experience this is the part that decides whether a test actually changes anything.

Speaking

I’ve presented in both Polish and English at:

  • The Hack Summit - 2025
  • BSides Kraków - 2025
  • BSides Warsaw - 2025

Background

Velite - Penetration Tester, March 2024 to present (contract, remote)

Certifications and training

Hack The Box Academy

  • AI Red Teamer path - 2026
  • Penetration Tester path - 2025
  • Bug Bounty Hunter path - 2024

CompTIA

  • Network+ (ce) - 2023

TryHackMe paths

  • Security Engineer, SOC Level 2, SOC Level 1, Cyber Defense
  • Offensive Pentesting, Red Teaming, Jr Penetration Tester, Web Fundamentals

Other training

  • CompTIA Security+ (SY0-701) course - Udemy
  • Learn Python & Ethical Hacking From Scratch - zSecurity

Platforms

Hack The Box - Grandmaster rank.

Contact

Email: [email protected] GitHub: lukasz-pas LinkedIn: łukasz-pastuszak

For anything sensitive, reach out by email first and we’ll arrange an encrypted channel.