Co-founder Appknox

Leading Appknox as Co-founder, my expertise in mobile security has been pivotal in advancing the safety of banking and payment apps across Asia. My 10-plus years co-founding and steering Appknox have been dedicated to developing robust security frameworks and fostering a proactive culture of innovation.

The team and I have achieved significant milestones in identifying and mitigating security vulnerabilities, thanks to our command of web applications and Android development. Embedding my deep-seated values of diligence and strategic foresight, we have successfully positioned Appknox as a trusted ally in the cybersecurity domain.

I grew Appknox 2X as CEO over the last 18 months. Today I'm stepping down.

Not because it stopped working. Because I found something I can't stop thinking about.

While building AI into Appknox, I kept watching the same thing play out across security teams. Engineers using LLMs for triage, analysis, even remediation suggestions. And the output was basically a coin flip. Sometimes excellent, sometimes dangerously wrong.

I watched a team spend days validating an LLM's triage output by hand because there was literally no other way to know if it was right. Thats not a tooling problem, thats an infrastructure gap.

Worst part? When someone claimed their agent was "better," there was no way to actually prove it. No shared harness, no reproducible benchmark, no regression test. Nothing.

We were generating mountains of security work every day but none of it was becoming structured eval data. So the models never actually got better in any measurable way. We just kept shipping and hoping.

Thats the problem I'm now building for.

I'll always be a part of Appknox. But right now my full focus is on something new.

𝗡𝗲𝘄 𝗰𝗼𝗺𝗽𝗮𝗻𝘆. 𝗦𝘁𝗶𝗹𝗹 𝗶𝗻 𝘀𝘁𝗲𝗮𝗹𝘁𝗵 𝗯𝘂𝘁 𝗰𝗼𝗺𝗶𝗻𝗴 𝗼𝘂𝘁 𝗶𝗻 𝘁𝗵𝗲 𝗻𝗲𝘅𝘁 𝗳𝗲𝘄 𝘄𝗲𝗲𝗸𝘀.

The way I see it, AI agents are shipping into production faster than security teams can evaluate them. There's no standard way to gate AI behavior before it goes live. Someone needs to build the infrastructure that makes security AI repeatable, measurable, and actually improvable. Think regression tests and structured evals but for security AI, not just software.

Thats what we're building. Already testing with a small group of security teams and the early signal is strong.

If you work in security, how are you evaluating AI output today? Genuinely curious. DM me if you want to help shape what we're building next.

PS: unrelated but I cleaned out the arcade today. Good omen. 😁 

#aisecurity #cybersecurity #startups #infosec #artificialintelligence

undefined undefined

Conducted training at BlackHat 2014, partnership with HOTWAN along with the team evad3rs ( The Jailbreak Team), Saurik, Justin Case ( Jon Sawyer ) and Jason Haddix at "Mobile Hacking Summit"
https://www.blackhat.com/us-14/training/mobile-hacking-summit.html

Trainer at BlackHat Las Vegas, 2014

Conducted training on "Android and iOS Hands-on Exploitation"
www.syscan.org/index.php/sg/training/details/sys_14_02

Trainer at SyScan 2014, Singapore

Conducted training at BlackHat 2013, on partnership with HOTWAN along with the team evad3rs ( The Jailbreak Team) on "Mobile Hacking 2"
https://www.blackhat.com/us-13/training/mobile-hacking-II.html

Trainer at BlackHat Las Vegas, 2013

Spoke at RSA Conference Asia Pacific, which was held in Singapore on "The Droid Exploitation Saga"
http://www.rsaconference.com/events/ap13/agenda/sessions/33/the-droid-exploitation-saga

Speaker at RSA Conference, Singapore, 2013

Was listed in Google Hall Of Fame, and got rewarded for the vulnerability.
http://www.google.com/about/appsecurity/hall-of-fame/reward/

Acknowledged and Credited by Google Again

Conducted training on "Advanced Android and iOS Hands-on Exploitation"
http://www.syscan.org/syscan13-training/sys_13_03.php

Trainer at SyScan 2013, Singapore

Spoke about "The Droid Exploitation Saga"
https://www.owasp.org/index.php/AppSecAsiaPac2013#tab=Speaker_Bios

Speaker at OWASP APPSEC Asia, South Korea 2013

Conducted training on "Advanced Android and iOS Hands-on Exploitation Course"
https://www.owasp.org/index.php/AppSecAsiaPac2013#tab=Training

Trainer at OWASP APPSEC Asia, South Korea

Spoke about NFC Hacking "Stand Close to Me, & You’re pwned! : Owning SmartPhones using NFC"
http://www.clubhack.com/2012/event/technical-briefings/stand-close-to-me-youre-pwned-owning-smartphones-using-nfc/

Speaker At ClubHack 2012

Spoke about Droid Exploitation Saga
https://www.blackhat.com/ad-12/briefings.html#Gupta

Speaker at BlackHat Abu Dhabi 2012

Speaker at Nullcon Delhi 2012

Spoke about "Attacking Your Droids with the Android Framework for Exploitation"

Speaker at Toorcon San Diego 2012

Conducted an Android and ARM Exploitation Training

Trainer at Toorcon San Diego 2012

Spoke about "All your Droids belong to me : A look into Mobile Security in 2012" and "Browser Kung-Fu" in the same conference

Speaker at The Hackers Conference, Delhi 2012

Credited multiple times at Microsoft Security Researchers Acknowledgments
http://technet.microsoft.com/en-us/security/cc308589

Acknowledged and Credited by Microsoft Security Researchers

Mentioned in Google Hall of Fame, Honourable Mention
http://www.google.com/about/appsecurity/hall-of-fame/distinction/

Acknowledged and Credited by Google

Spoke about Advance Malwares and Botnet in Android "Hacking your Droid"

Speaker at ClubHack 2011

Credited multiple times at Apple Security Researcher List
http://support.apple.com/kb/HT1318

Acknowledged and Credited at Apple Security Lists

Google Chrome before 26.0.1410.43 does not properly handle active content in an EMBED element during a copy-and-paste operation, which allows user-assisted remote attackers to have an unspecified impact via a crafted web site.

Mentioned in CVE-2013-0926

Microsoft

Graduate of Microsoft Ventures Accelerator

Bengali

English

Hindi

Appknox

Tata Consultancy Services

A site to help convert any website to a mobile version easily and quickly.

MobiIT

Eastman Corporation is a leading business house based out of Asia. Their website was built in three languages English, Chinese and French.

Eastman Corporation - Website

Developed a framework for Android Exploitation : Released in Blackhat, Abu Dhabi 2012. Its an open source framework to find and exploit vulnerabilities in Android based handsets and applications.


Android Framework for Exploitation

A website for group of professional wedding photographers.

Shadi Utsav

Developed the website of CAAYE.
The Commonwealth-Asia Alliance of Young Entrepreneurs (CAAYE) is a network of young entrepreneurs and the organizations that support them.

CAAYE

CEO @ Appknox | Security Vulnerability Detection

Mobile adoption is strategic in every industry today. Although it can be a great catalyst for growth, the security risks that come with it cannot be overlooked…

Unicom Conference - Mobile Application Security

NFC Research Study - Attack Surface and Vulnerabilities Exposed, Whitepaper

Analyzing near field communication(nfc) security

These slides were presented at GDG MeetUp in Bangalore which was held on 21st September 2013. Uploading the slides to help the people who wanted the slide Deck

Android Security & Penetration Testing

Android App (Vulner)ability - Teaser

Facebook has patched a security vulnerability that would have allowed hackers to turn on users' webcams without their knowledge and post the videos to their profiles. The bug was discovered in July by two computer-security researchers in India, according to Fred Wolens, a spokesman for Facebook.

Facebook Fixes Webcam Vulnerability Reported by XySec Labs

Founder | AI x Security | Co-Founder, Appknox

𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘀𝗵𝗼𝘂𝗹𝗱 𝗯𝗲 𝗶𝗻𝘃𝗶𝘀𝗶𝗯𝗹𝗲. 
The worst thing a startup can do is make security important. Not ignore it. The opposite. 

If security is "important" at your company, something has gone wrong. It means you're relying on people to remember it. Fight for it in sprint planning. Anything that depends on humans remembering to care is already failing.

Think about gravity. It's the most important force acting on a building. But nobody inside the building thinks about gravity. The architect did. The engineer did. They designed the structure so everyone else can forget it exists.

That's what good security looks like.

The startups that get this wrong treat security like a feature. They put it on the roadmap. They have a Jira epic called "Harden Auth" that's been in the backlog since Series A.

This is security as a thing you do.

What you want is security as a thing you've already done.

A junior dev at a startup I know tried to query the database directly. He wrote 𝘥𝘣.𝘦𝘹𝘦𝘤𝘶𝘵𝘦("𝘚𝘌𝘓𝘌𝘊𝘛 * 𝘍𝘙𝘖𝘔 𝘶𝘴𝘦𝘳𝘴 𝘞𝘏𝘌𝘙𝘌 𝘪𝘥 = " + 𝘱𝘢𝘳𝘢𝘮𝘴[:𝘪𝘥]). The framework rejected it. Not because of a code review. Not because of a policy doc from onboarding. ActiveRecord wouldn't let him interpolate raw input into a query. He had to use 𝘜𝘴𝘦𝘳.𝘧𝘪𝘯𝘥(𝘱𝘢𝘳𝘢𝘮𝘴[:𝘪𝘥]) or explicitly call 𝘶𝘯𝘴𝘢𝘧𝘦_𝘳𝘢𝘸 and leave a comment explaining why.

Security doing its job. Making the wrong thing harder than the right thing.

Here's the paradox most founders miss.

The less your team talks about security, the better your security probably is. If it's in every standup, it's a problem. If nobody mentions it, the systems are handling it.

You might spend more, not less. But you spend it once at the infrastructure level instead of forever at the human level.

taplio

👨‍💻Subho Halder's Linkedin Analytics

👨‍💻Subho Halder

Performance Score👨‍💻Subho Halder's LinkedIn Performance

👨‍💻Subho Halder's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}👨‍💻Subho Halder's Linkedin Analytics

👨‍💻Subho Halder

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}👨‍💻Subho Halder's LinkedIn Performance

👨‍💻Subho Halder's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

👨‍💻Subho Halder's Linkedin Analytics

Performance Score👨‍💻Subho Halder's LinkedIn Performance

👨‍💻Subho Halder's Best Posts (last 30 days)