As AI-Assisted and AI-Powered cyber attacks come to be the norm, our public systems and infrastructures become more vulnerable. We spoke with Matei Josephs, Vulnerability Operations Lead at SUPER & Founder of HiveHack about his extensive research and collaboration with the Romanian Government on the recent cyberattacks that shook the country.
Alongside policymakers, CISOs, practitioners and aspiring professionals, Matei Josephs comes to DefCamp 2026 to share with the infosec community his firsthand experience with “Vulnerability Disclosure at a National Scale” in real-world case studies involving ANCPI and other critical structures, insisting on portraying what happens after reporting a vulnerability in the system.
We had many questions for our guest because of his all-round expertise, but we settled on asking about his motivation and journey working with Romanian institutions, about the elephant in the room, the cyberattack on ANCPI from July 2026, about genuine rules he believes citizens must follow in order to protect themselves in this new day and age, and at last, about the new generation of hackers and defenders he is currently nurturing and shaping and their “built-in” adaptations to AI.
Moreover, as a visiting lecturer in cybersecurity at the Constanta Maritime University as well as a devoted mentor for the HiveHack interns, his opinion and advice for the new generation regarding the rapid rise and integration of AI in daily cyber activities and systems is well informed and very valuable. Understanding the importance of practical experience and the security risks AI brings into the equation make a decisive difference between a practitioner and an aspiring one. He encourages his students to go for certificates and join as many CTF’s and cyber events as humanly possible.
On a similar note, 2026 marks the first year HiveHack is an official DefCamp supporter, bringing double the action to the Honeycomb village with two CTFs created entirely by the fresh talents he trained over the summer!
Given your extensive experience in the private sector as a Senior penetration tester and Security Researcher, what compelled you to start working with the Romanian Government on preventing and mitigating cyberattacks?
I have been responsibly disclosing vulnerabilities long before I was a “senior” in cybersecurity. Back when I was just a script kiddie I would still find issues and try to report them to institutions. DNSC (and previously CERT-RO) have been doing a good job with encouraging researchers to responsibly report vulnerabilities to them, so even without any financial incentive, I was always happy to try to help.
I know how overwhelmed institutions are when it comes to managing cybersecurity, but I also know that we have a huge pool of talented security researchers who have the same mindset as myself and are willing to help without any financial motivation.
How was your raw experience navigating a preventable national crisis such as the July 14, 2026 cyberattack on ANCPI, aside from the difficulties implied by the vulnerability disclosure process - which you will present this year at DefCamp 2026?
It was really exciting, but also frustrating and disappointing. There were several layers of failure there, but in my opinion, one of the biggest is that the initial access vector was responsibly disclosed in the past (more on that in the actual talk). However, it was great to see the cybersecurity community in Romania come together as a result of the incident. We noticed that other institutions started asking questions and became more interested in cybersecurity than before. Something like “awareness through incidents”.
Now that a few months passed, the chatter slowed down, so as a community we must keep the conversation open. One of the lessons we must take from this incident is that having the capability to discover vulnerabilities is not enough - those vulnerabilities must also get fixed.
After collaborating with national institutions and delving into the public systems vulnerabilities, what would you recommend every working class citizen to do or plan for in order to avoid being taken advantage of?
I think many people perceive a dichotomy between cyberspace and "real life". This is something I would like people outside of cyber to work on - understanding that cyberspace is part of "real life". Concretely, I'd tell people to follow DNSC on social media - they do a genuinely good job putting out content that's easy to understand without a technical background, and it keeps you exposed to what's actually happening rather than just the scary headlines.
Don't wait for something to happen to start applying cyber hygiene - the basics (strong unique passwords, 2FA, keeping software updated) should be habits, not reactions. And if you ever do come across a cybersecurity incident, issue, or attack - even something you're not sure about - report it to DNSC through PNRISC, that's exactly what it's there for.
Beyond that, just use common sense: verify who you're actually talking to before you click, pay, or share something. I'd call it being an "informed paranoid”: skeptical enough to pause and check, but not so anxious that you're afraid of technology.
As the proud owner of 12 reported CVEs and Red Teaming certificates such as OSCP, OSEP, OSWE, OSWP, CRTO with the newest addition being the OSAI, how do you think AI impacted the importance of certified training and experience? How would you advise young professionals to prepare for the transformation of cyberattacks, cybercrime and future cyber careers?
I am a firm believer that AI will not replace skilled cybersecurity professionals too soon, but instead skilled professionals using AI will replace the ones who are not using AI. In terms of using AI for security, we can scale a lot quicker than before - from autonomous testing to SOC automation, I’ve seen some great use cases for it. On the flip side, AI systems can introduce several security risks which we should be aware of as security professionals.
Cybersecurity is highly dynamic, so staying up to date through various courses is always good, but nothing beats practical experience. I would encourage all people starting out in cybersecurity to stay curious. Curiosity is one of the most important skills in this field and with new attack vectors appearing every day, people who are not committed to continuous learning are left behind quite quickly.
Being the co-founder of HiveHack and having encountered the new generation of hackers and defenders through your internships and involvement in the cyber community, how would you describe them? The media often portrays them as lazy, unwilling to work or disconnected from the real world. What are their strong suits in your professional opinion?
I’m absolutely impressed by the next generation of cybersecurity professionals. I think many people at DefCamp will be impressed by our interns, seeing them at the Honeycomb competition which they fully organized. I don’t think most youngsters are unwilling to work or disconnected from the world, I think that the world has changed and we will have a lot to learn from them. They come with energy, enthusiasm, and it is our responsibility as their seniors to feed that energy and guide them to use it in the right direction.
I am also a visiting lecturer in cybersecurity at the Constanta Maritime University so I see a lot of young cybersecurity prospects. What I found with most of them is that they do not necessarily need to be taught or lectured, but rather mentored since they already have access to a plethora of information. I noticed many students thrive and blossom when they are encouraged and motivated. I honestly think that their strong suit is their enthusiasm and their ability to adapt to the modern world.
Before we see you at DefCamp 2026, what’s one message you’d like to share with this year’s attendees? Is there a mindset, skill, or challenge you hope they’ll bring with them to the conference?
People always bring great energy to DefCamp so I'm hoping to see this again this year! I'd encourage everyone to make the best out of the conference by talking to as many participants as possible - some of the best insights I've gotten from this conference came from random hallway conversations, not presentations.
Don't just watch from the sidelines either - get into the contests, stop by the booths, put your hands on the challenges, that's where the real learning happens.
And if there's one thing I'd want people to leave with: we're always stronger as a hive than alone, so find your swarm and build together.
Even though the incident in July was a serious national matter, it served as a powerful catalyst for collaboration. The entire cybersecurity community united to resolve the immediate crisis and volunteered their expertise to build long-term resilience. The silver lining of this event was the profound sense of urgency it created across other essential state structures. It successfully redirected national focus toward what matters most: prevention, robust cybersecurity, and strict cyber hygiene. This is a critical opportunity to ensure our structures, digital systems, and procedures are modernized and fully prepared to face emerging threats.
As Matei will follow up with an in depth presentation on the systems they fought against during his presentation at DefCamp 2026, he hopes we will keep the momentum of this going and involve as many decision makers into these discussions in order to fix our vulnerabilities. This can’t happen again, but it might if we are not careful.
The same principle applies to the everyday person. Prevention starts with the “boring” 2 factor authentication, the system updates and the common sense precautions we all must take.
Last, but not least: in the last few years, AI reinvented the way we live, the way we code and the way we hack. In response to a fast changing work environment the sensible thing to do is change along with it. Learning to use AI as a tool while simultaneously being conscious of it’s limits, it’s impact and it’s security risks is the key to a future career in cybersecurity regardless of your current level of expertise. Its a new mandatory skill you have to practice even as a skilled professional.
In other words, the secret to becoming a successful expert in this field is to be curious, involved and present
“Don’t just watch from the sidelines” is the message Matei Josephs has for the new generation rising. When coming to DefCamp this year don’t be shy, just “ get into the contests, stop by the booths, put your hands on the challenges, that’s where the real learning happens”
The future of cybersecurity starts @ DefCamp 2026!
Meet the interview author:
My name is Dana Pavel. I am a second year cyber security engineering student involved in the national and international infosec community. I enjoy volunteering my time for meaningful projects (like this one) and always pushing the boundaries of my capabilities. I am passionate about security research and I keep chipping away at it one paper, one presentation and one project at a time 🙂
