About
I'm Joshua Lemon, an independent security practitioner. pentaROOT is my practice: one person, doing the work directly. I focus on vulnerability management, because that's where I've seen the widest gap between the work organizations pay for and the risk reduction they get.
Background
I've worked in security since 2016, starting across identity and access management, security testing and vulnerability management, after about ten years in systems administration, networking and desktop support. In that time I've led vulnerability management programs in large healthcare environments and worked with clients in medical devices, defense, government, financial services, insurance, manufacturing, retail, consumer goods, information technology, education technology and information security. I have run pentaROOT independently since 2018. Most of my current work is with enterprise vulnerability management teams.
Employers and clients aren't named here unless they've agreed to it in writing.
Credentials
- OSCP (Offensive Security Certified Professional): verify on Credly
- GPEN (GIAC Penetration Tester): verify on Credly
- CompTIA Security+
- Rapid7 InsightVM Certified Administrator and Nexpose Certified Administrator
- Tenable Nessus Certificate of Proficiency
Credential IDs for the others are available on request.
Education: MS in Computer Science; MBA in Digital Technology Management (Indiana University); BS in Psychology.
Why vulnerability management
Finding vulnerabilities got cheap. Deciding which ones matter, getting them fixed by the right owner, and proving it is still hard, and that's where most programs stall. The failures that worry me most aren't the critical findings; those get tickets and deadlines. They're the hosts that go quiet: a scan that couldn't log in, a device that fell out of inventory, a report that looks clean because nothing was looked at. An attacker doesn't care whether your scanner could log in.
My working rule is that missing evidence is not a clean result. I build the automation myself, and I'd rather report "not assessed" than show you a number I can't support.
I also think a program should outlast the consultant. Everything I build runs in your environment, under your accounts, with documentation your team can follow.
Publications
- Social engineering tactics, guest post on the LevelBlue (formerly AlienVault) blog.
Elsewhere
LinkedIn. I don't post a photo here; LinkedIn is the place to check who I am.