Three years on the road
When I told people I was going to live and work on the road, nobody really believed me. The reaction was something like: sure, maybe for a couple of months. That was over three years ago. I'm still on the road, and I'm running my cybersecurity company, Rivanorth, from wherever I happen to be.
I've been asked to write about how that happened, what it's done to the way I see things, and how it all ties back to cyber, so here's my take, in roughly the order it happened.
The slow build
It wasn't one moment, it was more of a slow build that started during COVID, when I'd spent years not being able to travel and traveling was something I'd always loved. Before that I had a pretty typical cyber job: fully remote, living in Sydney, regular 9 to 5. The kind of week most people in this industry would recognise.
When COVID ended and a lot of companies stayed remote, it clicked. If I can do this job from my apartment, I can do it from anywhere.
The other part is harder to say out loud, but it was the real driver, which is that we don't know how long we've got. Especially when you're younger you assume you'll make it to 80 or 90 and there'll be time for everything later, but the reality is you could be gone any day. I didn't want to take that chance, I wanted to see Australia and work on things I actually cared about, and I didn't want to pick one over the other.
It's not a holiday
The biggest misconception about this lifestyle is that people think it's a holiday. They take their two-week camping trip, imagine that feeling stretched out indefinitely, and assume that's what it's like. It isn't, because whatever problems you have in your life come with you, and the things that actually change are your location, how you work and what you do on the weekend. Everything else stays the same.
That said, the weekends have been pretty amazing. Less so lately because I'm working a lot, but I've had great ones all over the place.
One belief I dropped along the way: that I needed three monitors to be productive. That turned out to be a mindset thing rather than a real constraint, and these days I can open my laptop on a staircase and get as much done as I would at a desk. If you really want to do something, you can do it from anywhere.
Something I didn't expect was the exposure to a part of society I'd never really spent time with. Around Australia there are a lot of grey nomads, retired people living on the road. Most of us only ever talk to people over 70 if they're our grandparents. Spending time around them gave me a perspective I wouldn't have found in a Sydney office.
And I got to do all of this without giving up the professional side. That was the whole point, life goals and work goals without one coming at the expense of the other.
Losing the passion
A few years into my career I'd lost it. I was consulting at the time and I was a bit unlucky with some of the engagements I got assigned to, so day in, day out it was the same thing.
If you've done pen testing you'll know what I mean. Take web application testing. The sector that buys the most of it is finance, and those apps all look very similar after a while. It's the same patterns, the same findings and the same report, and you get bored.
Maybe that's just me. I need different challenges and I need to see different things, and when it's always the same I switch off. But I suspect it's not just me, and I suspect a lot of people in this industry are quietly in the same place.
Letting curiosity drive
How I got into research was completely accidental. When I first went out on my own, I was really into blockchain hacks, mostly because of the size of the financial damage. Some of those numbers were enormous.
After a while I realised that industry wasn't for me, and I drifted back towards traditional security. But understanding crypto turned out to matter. It meant I understood how threat actors move money and get paid. Once you understand the payment infrastructure and the incentives, the dark web and the cybercrime forums start to make a lot more sense.
That's how I ended up in dark web intelligence. It wasn't a plan, I was just following what I found interesting and seeing where it led.
From a service to a product
I didn't set out to build software. At first I ran the dark web monitoring as a tech-enabled service. Clients were interested, they started trying it, and that gave me a reason to look closely at the commercial tools already on the market.
What I found was noise, huge amounts of it, generic alerts with no context and nothing that told you what to actually do. I thought it could be done cleaner and simpler, with more value, and specifically built around answering the "so what" question rather than dumping everything on the customer.
So that's what I build now: Rivanorth Oko. I specialise in finding data leaks for companies, whether the data sits with them or with one of their third parties. Wherever it leaks, Oko picks it up. It does that by monitoring the core places where stolen data gets shared and sold: the dark web, ransomware groups, and now the new frontier of AI agent data leaks.
What excites me now
Mostly AI. I think the way companies work is about to change a lot. We'll move away from UIs and start working inside agents, and when that happens the thing that matters is having good, clean, reliable data to feed those agents at the right time.
For someone whose whole job is finding and filtering signal out of noise, that's a very good place to be. It's the first time in a while I've felt this excited about where the industry is heading.
If you're burnt out
If you're in cyber and you're wondering whether to blow it all up and try something different, here's what I'd say.
Take a step back, take a little break, and give yourself some time to do research on the topics that actually interest you. Don't look at industry trends or where the money is. Let your passion guide you and I think it comes back.
Too often we only look at the career upside: the next title, the next pay bump. In the long run, a good title isn't enough to sustain a long and happy career in this industry. Curiosity is, and mine happened to lead me onto the road and into a niche I didn't know existed.
Published by Exploit Security in The Exploit Society. Alexander Wilczek on three years running a cybersecurity company from the road, and why curiosity outlasts a title.
What is The Exploit Society? The guest series on the Exploit Security blog.
"Writers do not work here. The topics are theirs."
Is life on the road a holiday? No. He argues the problems come with you. What changes is the location, how you work, and the weekend. The rest stays. He dropped the belief that he needed three monitors, and found he could open a laptop on a staircase and get the same work done.
How did curiosity bring him back? Repetitive testing had switched him off. Following what interested him, from blockchain to how threat actors get paid, led him into dark web intelligence and then to a product that answers the “so what” instead of dumping alerts. His advice to anyone burnt out is to stop chasing the next title and let the work that interests you lead.
Who published this? Exploit Security, a CREST-approved offensive security practice in Sydney offering penetration testing services and offensive security consultancy. The author is Alexander Wilczek, founder of Rivanorth.
Comments