About

I’m Noah Potti, a security engineer and co-founder of Adversis and Puck, consulting and building.

I’ve spent the last dozen years in offensive security, red teaming, and adversarial engineering. Most recently, I worked at Okta on proving out and extracting attacks across identity products and production infrastructure, and on purple-team exercises with detection engineering. I’ve also assessed AI systems handling sensitive and regulated data.

Before that, I helped build and operate red teams at Capital One, Symantec, and Gen Digital, and consulted at Bishop Fox.

My current work focuses on identity, tenant isolation, credentials, and AI agents, particularly understanding what an attacker can reach after the initial compromise.

I used to build in Go and Python, and recently I just tell the LLM that looks good in whatever language fits the project. My open-source work includes tailsnitch, agent-scrub, go-decrypt-jenkins, grpc-scan, and a Next.js server-action analyzer, along with contributions to Sliver, Metasploit, and Hashcat. I’ve also reported at least one CVE. The rest is on the tools page.

I’m a co-author of The Effective Red Team: Adversary Emulation Inside the Enterprise, published by No Starch Press, with Trevin Edgeworth and Jordan Potti.

OSCE, OSCP, GXPN, and others.

Contact

Email noah at this domain. Haikus get read first.

GitHub: @thesubtlety and @noahpotti. Also on LinkedIn.