OffSec

OffSec, formally known as Offensive Security, is an American information-security organization focused on practical cybersecurity education, professional certifications, penetration testing, and digital-forensics expertise. It is best known for the Offensive Security Certified Professional (OSCP), a hands-on certification that requires candidates to compromise systems in a controlled examination environment and submit a technical report. The assessment model helped distinguish OffSec from many certification providers that rely primarily on multiple-choice examinations. The organization traces its origins to the mid-2000s, when security practitioner Mati Aharoni began developing training materials, tools, and Linux-based security environments with his wife, Iris Aharoni. Offensive Security LLC was formed in 2008. Its early work was closely associated with BackTrack Linux, an open-source distribution assembled for penetration testing and security assessment. BackTrack succeeded earlier projects including Whoppix, IWHAX, and Auditor, and became widely used by security professionals and learners. The company later developed Kali Linux as BackTrack's successor. Kali is a Debian-based distribution containing a large collection of tools for penetration testing, digital forensics, vulnerability research, wireless assessment, and related security work. OffSec has also supported Kali NetHunter, an Android and ARM-oriented security platform. Alongside operating-system projects, OffSec has helped maintain security knowledge resources. The Exploit Database, commonly known as Exploit-DB, archives publicly documented software vulnerabilities, exploit code, and proof-of-concept material for research and authorized testing. The company has also hosted the Google Hacking Database, a collection of search queries used by security practitioners to identify exposed information, and supported Metasploit Unleashed, an educational project associated with Hackers for Charity. These projects broadened OffSec's role beyond course delivery and contributed to its visibility in the open-source and offensive-security communities. The company's commercial offering includes online and instructor-led training, subscription-based access to learning materials, examination attempts, and certifications covering penetration testing, exploit development, advanced web application security, and security operations. Its flagship credentials include OSCP, Offensive Security Experienced Professional (OSEP), and other specialist certifications. OffSec has delivered training at industry events such as Black Hat and has provided education or security-related services to technology companies, financial institutions, consulting firms, and United States government and defense-related organizations. Publicly identified customers and users of its training have included Cisco, Wells Fargo, and Booz Allen Hamilton. In September 2019, OffSec received its first reported venture-capital investment from Spectrum Equity. Around the same period, Ning Wang became chief executive officer, replacing Joe Steinbach, who had led the business for approximately four years. The investment and leadership change reflected the expansion of cybersecurity training into a larger commercial education market. OffSec remains associated with a deliberately practical, lab-driven approach: learners are expected to investigate systems, write scripts, exploit weaknesses in authorized environments, and document their findings. Its reputation is therefore tied both to the difficulty of its examinations and to the continuing relevance of its open-source tools and training ecosystem.

OffSec developed from the practical security-training and open-source work of Mati Aharoni and Iris Aharoni in the mid-2000s. The business was formally organized as Offensive Security LLC in 2008. Its early identity was shaped by the BackTrack Linux project, an open-source penetration-testing distribution that brought together tools and workflows for security assessment. BackTrack itself followed a lineage of projects known as Whoppix, IWHAX, and Auditor. With assistance, coordination, and funding from Offensive Security, contributors built a distribution that became widely used by security professionals and security learners. The organization combined software projects with professional instruction. Rather than treating cybersecurity education as purely theoretical, its courses emphasized working directly against lab systems, researching vulnerabilities, using command-line tools, and producing reports. This approach culminated in certifications such as OSCP, whose examination requires candidates to conduct practical attacks against a controlled network and document their results. The examination's difficulty and hands-on format gave the credential a distinctive reputation in the information-security employment market, although public commentary has also emphasized that employers should verify candidates' actual capabilities rather than rely on a certificate alone. OffSec later replaced BackTrack with Kali Linux, a Debian-based distribution designed for penetration testing, digital forensics, vulnerability research, and related security activities. Kali grew into one of the organization's most visible public projects and included hundreds of security utilities. OffSec also supported Kali NetHunter, an Android and ARM-focused platform, and published Kali Linux Revealed as an educational resource. These projects made the company's work accessible beyond paid course customers and reinforced its connection with the wider open-source security community. Other projects expanded OffSec's information resources. Exploit Database, or Exploit-DB, provides an archive of publicly disclosed vulnerabilities, exploit code, and proof-of-concept examples intended for research and authorized security testing. The organization also hosted the Google Hacking Database, which catalogs search queries useful for finding inadvertently exposed information. Metasploit Unleashed was created as an educational initiative associated with Hackers for Charity and introduced learners to the Metasploit framework and penetration-testing concepts. OffSec's customer and institutional reach expanded as its training programs became established. Publicly cited customers have included Cisco, Wells Fargo, Booz Allen Hamilton, and United States government agencies with defense-related responsibilities. The company has also delivered sessions at the Black Hat security conference. Its instructors and security professionals have participated in technical writing, course development, and industry education, including work associated with chief strategy officer Jim O'Gorman. A major corporate transition occurred in September 2019, when Spectrum Equity made the company's first reported venture-capital investment. Around the same time, Ning Wang replaced Joe Steinbach as chief executive officer; Steinbach had led the company for roughly four years. The investment and leadership change reflected OffSec's evolution from a specialist security-training operation into a more scalable international education and certification business. Its enduring identity remains anchored in practical offensive-security skills, open-source tools, and assessments intended to measure applied ability.

1. 2019Spectrum Equity investment and leadership transition

   Spectrum Equity supplied the company's first reported venture-capital investment, while Ning Wang replaced Joe Steinbach as chief executive officer.

   Source
2. 2013Kali Linux succeeds BackTrack

   OffSec introduced Kali Linux as the successor to BackTrack, providing a Debian-based platform for penetration testing and digital forensics.

   Source
3. 2008Offensive Security LLC formed

   The organization was formally established as Offensive Security LLC.

   Source
4. 2006Business origins

   Mati Aharoni and Iris Aharoni began the work that developed into Offensive Security, initially combining security practice, training, and open-source projects.

   Source

Practical, lab-intensive cybersecurity education and certification for penetration testers and other security practitioners.

• OSCPProfessional certification

  The Offensive Security Certified Professional is OffSec's best-known credential. It assesses applied penetration-testing ability through a controlled practical examination rather than relying solely on conventional question-based testing. Candidates work through a test network, identify weaknesses, obtain authorized access, and prepare a technical report explaining their methodology and evidence.

• OSEPAdvanced professional certification

  The Offensive Security Experienced Professional is an advanced OffSec certification associated with adversary simulation, penetration testing, and post-compromise techniques. It extends the organization's practical examination model for practitioners seeking deeper offensive-security skills.

• OffSec Training LibraryOnline cybersecurity education

  The OffSec Training Library provides online access to cybersecurity courses, practical laboratory environments, learning materials, and certification preparation. Its subject areas include penetration testing, exploit development, web security, and related offensive-security disciplines.

• Kali LinuxSecurity-focused Linux distribution2013

  Kali Linux is a Debian-based open-source distribution designed for penetration testing, digital forensics, vulnerability research, wireless assessment, and security education. It succeeded BackTrack and bundles a broad collection of security tools, making it one of OffSec's most visible contributions to the security community.

• Kali NetHunterMobile security platform

  Kali NetHunter extends the Kali Linux security-tool ecosystem to supported Android and ARM-based devices. It is intended for mobile penetration testing, security experimentation, and authorized assessment work.

• Exploit DatabaseVulnerability and exploit archive

  Exploit Database, commonly called Exploit-DB, is an archive of publicly documented vulnerabilities, exploit code, and proof-of-concept material. It is used by security researchers and penetration testers to study weaknesses and validate authorized assessments.

• BackTrack LinuxOpen-source security distribution

  BackTrack was an open-source Linux distribution assembled for penetration testing and security assessment. It was developed with support from Offensive Security and became a widely recognized platform among security practitioners before being succeeded by Kali Linux.

• Metasploit UnleashedSecurity education project

  Metasploit Unleashed is an educational project associated with Offensive Security and Hackers for Charity. It teaches concepts and workflows related to the Metasploit framework and was designed to help people learn penetration testing.

• Google Hacking DatabaseSecurity information database

  The Google Hacking Database catalogs search queries that security professionals can use to identify potentially exposed information on websites and applications. The project originated with Johnny Long and was later hosted by Offensive Security.

• Black Hat training sessions

  Global cybersecurity community

  OffSec has provided training sessions at the annual Black Hat hacker and information-security conference, using the event to present practical security education to an international professional audience.

  Outcome. The sessions increased the organization's visibility among security practitioners and conference participants.

  Source
• Hackers for Charity educational initiatives

  Global

  OffSec supported educational projects connected with Hackers for Charity, including Metasploit Unleashed and hosting of the Google Hacking Database.

  Outcome. The initiatives extended access to security knowledge and practical learning resources outside the company's paid certification programs.

  Source

• 2019Accept first reported venture-capital investmentM&A

  OffSec was expanding its international training and certification business and sought outside capital for that growth.

  What changed. Spectrum Equity made the company's first reported venture-capital investment.

  Aftermath. The investment coincided with a leadership transition and marked a new phase of corporate scaling.

  Source
• 2019Appoint Ning Wang as chief executive officerOther

  The appointment occurred alongside the company's first reported venture-capital investment and followed Joe Steinbach's period as chief executive.

  What changed. Ning Wang replaced Joe Steinbach as chief executive officer.

  Aftermath. The change accompanied OffSec's development into a larger international cybersecurity-training organization.

  Source
• 2013Replace BackTrack with Kali LinuxGeneration change

  BackTrack had become a prominent security-focused Linux distribution, but the organization sought a successor with a revised Debian-based foundation and a continuing focus on penetration testing and digital forensics.

  What changed. OffSec launched Kali Linux as the next generation of its security distribution and continued developing related projects such as Kali NetHunter.

  Aftermath. Kali Linux became the organization's most prominent open-source software project and a widely used platform in security education and professional testing.

  Source

• 2019Debate over OSCP examination cheatingControversy

  Security-industry commentary discussed accusations that some OSCP candidates had cheated or improperly shared examination information. The controversy also raised questions about how employers should evaluate certifications. OffSec responded to the concerns, while commentators emphasized that practical ability should be validated independently.

  Source

• 2019OffSec receives first venture-capital investment from Spectrum Equity

  Offensive Security reportedly accepted its first venture-capital investment from Spectrum Equity, marking a significant financing event in the organization's expansion.

  M&AOther
  Source
• 2019Ning Wang becomes chief executive officer

  Ning Wang replaced Joe Steinbach as chief executive officer during the organization's period of commercial expansion.

  Leadership change
  Source

1. Offensive Security
2. What is Kali Linux?
3. The OSCP certification is hard—but is it worth it?
4. OffSec official website