Marcin Motwicki
„Security is a process, not a one-off product.”
Day to day, I break security in a controlled way to help companies build stronger, attack-resistant systems. I have over 7 years of experience in the offensive security industry. In that time I have delivered more than 350 projects, from audits for small startups, through medical facilities, to the complex environments of large corporations. In over 70 of them I served as the technical lead.
What drives me is clarity. The art is not capturing the flag, writing an exploit or bragging about yet another CVE number. The real value lies in translating convoluted technical jargon into the language of business and risk management. I help managers and boards understand real threats and implement solutions that actually work.
Certifications
Areas of expertise
Career path
Getting started in Offensive Security
A fascination with reverse engineering and building aimbots / wallhacks for FPS games, first steps in memory analysis, function hooking and bypassing anti-cheat protections.
First encounters with cybersecurity
Attending meetups introducing students to the world of cybersecurity, organized by the John Paul II Catholic University of Lublin (KUL).
Courses, certificates and a first talk
Completing the first professional cybersecurity courses and trainings. Giving a talk at the Lublin University of Technology for World Password Day.
A career in Offensive Security
Joining Smarttech247 as a Junior Pentester. Delivering the first network and infrastructure audits.
OSCP certificate & first CVE
Independently running tests for global clients. Earning the elite OSCP certificate. Publishing a first CVE.
Network and web application expert
Earning OSWP and BSCP certifications. Starting independent research (bug hunting).
Team Lead, OSWE & 0-day discoveries
Promotion to team lead. Earning the advanced OSWE certificate. Reporting critical vulnerabilities in CVAT. Completing Sector7 and MalDev Academy courses.
ISO 27001 Auditor & IASE
Extending competencies with certified ISO 27001 auditing. Completing the IASE (iOS Application Security Engineer) course by Securing. Growing PWNONE as a brand.
Growing PWNONE
Delivering comprehensive security audits, industry talks (incl. LLM/AI security) and popularizing knowledge.
Published CVE
Independent software security research that resulted in official security bulletins.
PHP Object Injection in WordPress Cooked Pro (10,000+ active installs)
Reflected XSS in Computer Vision Annotation Tool (CVAT)
Double IDOR in CVAT webhooks, data theft and DoS risk
Broken Access Control (IDOR) in CVAT, ACL bypass via HTTP method change
Capture The Flag (CTF)
I regularly compete in CTF events, taking top places at Break the Syntax CTF, TyphoonCon and NahamCon, among others.
Industry talks
I speak at conferences and meetups, sharing knowledge about LLM/AI security and popularizing cybersecurity.
Articles Marcina
Practical knowledge from the front lines of offensive cybersecurity.
APT Emulation with MITRE ATT&CK: Choosing a Group, Techniques, and Metrics
How to build an APT emulation on MITRE ATT&CK v19: a group from CERT Polska and CSIRT GOV reports, techniques from its profile, TIBER-EU scenarios, and per-technique detection metrics.
How Much Does Red Teaming Cost and How Long Does TLPT Take in 2026?
What do red teaming and TLPT cost in Poland and abroad? Sourced, dated price ranges, public tenders, RTS 2025/1190 timelines and DORA Article 27 tester requirements.
How I Impersonated an Interia Administrator. An Analysis of an SPF Bypass / DMARC Misconfiguration
During routine research we came across a serious flaw in the SPF configuration of Interia.pl that made it possible to send forged emails bypassing sender verification.
How to Secure an API Against Attacks? A Practical Guide
In the age of microservices, the API is the backbone of modern software. Learn the key practices for protecting programming interfaces against attacks.
Anatomy of a Breach: A Ransomware Attack on the Polish Healthcare Sector
A detailed analysis of a real ransomware incident that paralyzed a hospital network. From the initial access vector to full remediation — step by step.
What Is NIS2 and What Your Company Must Do
What the NIS2 Directive is, how Poland’s amended KSC Act implements it and what it means for a company: obligations, incident reporting, deadlines and fines.
Let's talk about your security
Looking for an experienced pentester, an auditor, or someone who can explain clearly and simply where the critical flaws lurk in your environment? Write to me.