From Breaking In to Shutting Hackers Out: The Two Lives of Tal Kollander
Tal Kollander spent years on the offensive side of hacking before switching to defence. His story shows how the two worlds actually think about each other.
Key points
- Tal Kollander built his career in two phases: first as an offensive hacker, then as a cybersecurity defender.
- Most security professionals enter defence directly, without hands-on attacking experience.
- Defenders who have crossed over from offensive work tend to understand attacker thinking in ways that pure defenders do not.
- Kollander's story, first covered by SecurityWeek, sits inside a broader industry conversation about recruiting and retaining security talent.
Who is Tal Kollander?
Tal Kollander is a cybersecurity professional whose career splits into two chapters: years spent finding and exploiting weaknesses in systems, followed by years spent stopping others from doing the same.
Those chapters aren't as contradictory as they sound. Offensive security, the practice of attacking systems with permission to find flaws before criminals do, is a formal discipline. The difference between that work and actual crime is, in most cases, a signed contract and a defined target. Kollander worked on both sides of that line.
We covered a similar arc on 30 June 2026 in "From Modded Game Controllers to IBM X-Force Red: The Chris Thompson Arc", where a teenage hardware tinkerer grew up to run one of the most recognisable offensive-security brands in enterprise tech.
Why does crossing over matter?
Defenders with genuine attacking experience are rare, and they think differently. A defender who has never attacked a system learns from playbooks and vendor alerts. One who has actually exploited weaknesses knows which paths an attacker is most likely to take through a network.
That gap has real consequences. Post-breach investigations frequently surface the same finding: defences were built by people who had never seriously tried to break them. Kollander's career is a case study in what the industry keeps saying it wants more of.
Should you worry about who's defending your data?
For most people the relevance is indirect. You're not hiring a penetration tester yourself. But the organisations holding your financial records or medical history are, or should be. Whether the people defending those systems have actually tried to break them is a fair question to put to any organisation you trust with sensitive data.
For students or career-changers, Kollander's trajectory points to something concrete: ethical hacking skills, earned through accredited training or recognised certifications, are a credible route into well-paid defensive work. Employers respect candidates who can show they understand how attacks actually work, not just how to configure a firewall.
Security isn't solved by buying better software. It needs people who understand both sides, and there are never quite enough of them.
