In this episode of Hack Dissection, Mike Lisi sits down with Spencer Alessi, senior penetration tester at SecureIT360 and host of the Cyber Threat Perspective podcast, to talk through the world of internal penetration testing, assume-breach assessments, and what it really takes to break into — and secure — modern networks.

Spencer shares how his background as a systems administrator shaped the way he approaches offensive security, why help desk and IT experience can be so valuable for aspiring pen testers, and how real-world environments often expose assumptions that organizations do not realize they are making. From passwords sitting in file shares to misconfigured Active Directory permissions, Spencer explains why testing an environment is often the only way to understand what can actually go wrong.

The conversation also explores practical training paths, certifications like PNPT and CRTO, the importance of knowing your tools, and how intuition develops through hands-on experience. Mike and Spencer dig into the role of AI in penetration testing, the value of open-source security tools, lessons from real engagements, and Spencer’s DEF CON Red Team Village lab built around kiosk breakouts and Active Directory attack paths.

Along the way, they also discuss burnout, responsible research, the importance of community, and why offensive security is about much more than running tools — it is about curiosity, troubleshooting, and understanding how systems fail in the real world.