YT YouTube2Text

YouTube2Text → Transcripts → Stop using TryHackMe.

Stop using TryHackMe. — Transcript

by Tyler Ramsbey - Hack Smarter · 5,614 words · 844 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00You need to stop using TryHackMe
0:01yesterday. And because yesterday has
0:03already passed, I would strongly
0:05encourage you by the end of this video,
0:07log into your TryHackMe account and
0:09delete your account. In this video, I'll
0:11explain to you why I feel so strongly
0:13about that. I'll share with you my
0:15experience with TryHackMe, the changes
0:17that they have made, the way they have
0:19treated their employees, and the new AI
0:21pen testing company that they have
0:23launched that is seemingly trying to
0:25replace the very people they've spent
0:26the past five plus years training. Now,
0:29for the TryHackMe legal team, let me be
0:31very clear. Everything I say in this
0:33video is my opinion. Everything I say in
0:36this video is my interpretation of the
0:39facts as I see them. In this video, I
0:41will share with you public information
0:43that anybody can look up, and so all of
0:46my opinions are based on that public
0:48information.
0:49That being said, let's go ahead and dive
0:51in into it, and I'll give you the TLDR.
0:53Today, and by today it's March 19th, I'm
0:56recording this video at about 10:00 at
0:58night because someone shared this in the
0:59Hack smarter Discord. But today, Ben
1:01Spring, the founder of TryHackMe, has
1:04announced a second company powered by
1:06TryHackMe called NoScope. He advertises
1:09this as a fully automated AI pen tester
1:12that helps replace the expensive
1:15human-led pen testing. I find it very
1:18confusing that TryHackMe is seemingly
1:21trying to replace the very people they
1:22have spent the past five plus years
1:24training. Now, in their wording, they do
1:26say, "We do not think that pen testers
1:28are going to be replaced, blah blah blah
1:29blah." But we're going to look at those
1:30claims, we're going to look at what they
1:32are doing, and I will have you make your
1:34own conclusion. Before we dive into that
1:37though, I want to share with you my
1:38background and my experience with
1:39TryHackMe. I am not some TryHackMe
1:42outsider from the outside just trying to
1:44throw stones. If you have followed me
1:45for any length of time, you know that
1:47TryHackMe has been core to my own
1:49journey and really core to my own
1:51identity. If you look through my YouTube
1:53video or my YouTube channel, I have made
1:55hundreds of videos completely free
1:58promoting TryHackMe, walking through
2:00TryHackMe labs. I've even submitted my
2:02own TryHackMe labs to the platform. Once
2:05again, completely free, never being
2:06paid. I also served formally on their QA
2:09team. So, this is a volunteer team with
2:11a small group of people. And on this QA
2:13team, we would QA upcoming releases,
2:15make sure they are ready for release. In
2:17addition to that, I have found multiple
2:19vulnerabilities on their platform, which
2:21I have responsibly disclosed to their
2:23team. So, in many ways, I am a TryHackMe
2:25insider. I think I'm about as TryHackMe
2:28insider as you can get without actually
2:30being an employee of TryHackMe. Heck, I
2:32even have an NDA signed with them from
2:34when I did QA work. So, everything I'm
2:36going to share in this video, none of it
2:37comes from like secret TryHackMe
2:39information I know about. All of it is
2:41from public channels that you can look
2:43up yourself. So, at the outset, once
2:45again, I want to emphasize I am not some
2:47TryHackMe hater. I feel like TryHackMe
2:50has lost its way not due to the
2:52employees at TryHackMe, but primarily
2:54due to the leadership of TryHackMe and
2:56their obsession with AI.
2:59Additionally, I want to let you know
3:01that I tried to resolve this privately
3:03when I was on the QA team. So, let me
3:04bring you back a little bit of time, and
3:07you can actually find this video on my
3:08YouTube channel if you dig a little
3:10deeper. But, a while ago, TryHackMe
3:13began developing an AI pen testing
3:16agent. And one of the concerns of me and
3:19many people in the community is whether
3:21or not TryHackMe user data was being
3:24used to develop this AI agent, including
3:26the rooms on TryHackMe that volunteers
3:28like me contributed not for the purpose
3:30of training an AI agent, but rather for
3:32the purpose of helping the next
3:34generation of learners learn about
3:36cybersecurity. I first raised these
3:38concerns in a private staff Discord
3:40channel that I had access to as a member
3:43of the QA team, as did a few other
3:45people who were mods or QA or staff. I
3:48don't actually know who they all were.
3:50And Ben instructed us to post publicly
3:53in the echo feedback channel on Discord.
3:55If you know that whole echo feedback
3:58craziness, you know what I'm talking
3:59about. Ben's response to our concerns
4:02that TryHackMe was using user data to
4:04develop an AI agent was say if you are
4:06upset with this, go ahead and delete
4:08your TryHackMe account. You can opt out
4:11by deleting your TryHackMe account. I
4:13felt that that response was not fair to
4:15the community that has supported him and
4:16supported TryHackMe for many, many years
4:19and the many volunteers who have given
4:20their time to help train the next
4:22generation of hackers and cybersecurity
4:25defenders. It was at that time that I
4:26made my initial video on is TryHackMe
4:30using your data to build an AI agent.
4:32So, if you want to hear more of that
4:34story, I would suggest watching that
4:35video. I share all of the Discord
4:38information. I walk you through all of
4:40it step-by-step.
4:41That was one thing. It wasn't
4:44terrible. I mean, it is TryHackMe.
4:46Technically, at the end of the day, they
4:47have permission to use their data
4:49however they want to use it. What made
4:52me significantly more upset is Ben
4:55posted this on LinkedIn.
4:57To be clear, I had to create a sock
4:59puppet account. I'm apparently William
5:01Menefee because Ben Spring blocked me on
5:03or on LinkedIn the last time I tried to
5:05call him out for some of these things.
5:07But here is what Ben said 2 months ago
5:08about hiring an AI pen testing someone
5:11to build this. I want to draw your
5:13attention to the last paragraph here. He
5:15said, "To address previous
5:16misinformation."
5:18Now, I was the primary person supposedly
5:20spreading this misinformation. I don't
5:22think there were too many other videos
5:24or commentary about the way TryHackMe
5:26was using user data.
5:28And so, I'm quite certain that was
5:29addressed at me and a few people in the
5:31community. He said, "To address previous
5:34misinformation, no THM data is being
5:37used to develop our agent." Well, our
5:40concerns about that came from a job
5:41description that was posted that
5:43literally says we have the world's
5:45largest proprietary data set and we are
5:47using it to build the next AI agent.
5:50But, he did say this, "No THM data is
5:52being used to develop our agent." So, if
5:54I would give Ben Spring the benefit of
5:56the doubt, maybe he changed his mind.
5:59And he thought, "Hey, it is not a good
6:00look for us to use TryHackMe data to
6:02build the separate company." Well, when
6:05I was looking at the separate company,
6:06here is what I came across. This is
6:08NoScope.
6:10Directly from their website, the data,
6:13"Millions of user journeys from
6:15TryHackMe, the world's largest security
6:17training platform, give our agent
6:19unmatched vulnerability context. So, I
6:22don't know what's going on here." Oh,
6:23let me jump out over here. I don't know
6:25what's going on here, but from what I
6:26can see, Ben is directly contradicting
6:29himself. For the lawyers and legal team
6:31who want to watch this, I'll be
6:32abundantly clear. That is my
6:34interpretation of what I am seeing
6:36before me. Ben said, "No THM data is
6:39being used to develop our agent." On the
6:41very website of his new AI agent, it
6:44says, "Millions of user journeys from
6:45TryHackMe, the world's largest
6:47cybersecurity platform, blah blah blah."
6:48It does say all data used with explicit
6:50user consent. I have an account on
6:53TryHackMe right now. It's going to be
6:54deleted, and I've also asked other
6:56people. I don't know of anyone who has
6:58given explicit user consent to use their
7:00data. I'm assuming what Ben is referring
7:03to is when you sign up for TryHackMe,
7:05you agree to the long user agreement,
7:07and hidden in that user agreement is
7:09you're agreeing that your data and your
7:11user journey can be used for a
7:13third-party AI agent. Honestly, I
7:15haven't dug into it, so you'd have to
7:16look through their user agreement to see
7:18if that's there, but I do think saying
7:20that it is explicit user consent is once
7:22again misleading, unless I missed a
7:24pop-up or some yes window when I was
7:27logging into the TryHackMe platform.
7:30But, let's go ahead and talk about
7:31NoScope.
7:33This is Ben's post from today, 4 hours
7:36ago. Introducing NoScope, a new venture
7:39backed by TryHackMe. AI pen testing with
7:41deep web coverage, automatic
7:43remediation, unlimited retest, and
7:45results in hours, not days. We found
7:47major vulnerabilities, blah blah blah
7:49blah. You can also use No Scope
7:51alongside a pen testing team. Now, this
7:53would be the best way to use an AI
7:55agent. So, I do think AI has a place in
7:59pen testing, although I would suggest
8:01you have to be extremely careful.
8:03Anytime you are using AI in a pen test,
8:05you should be upfront with the client.
8:07It should be explicit written
8:08permission. I actually won two clients
8:11recently because they asked me, "Do you
8:13use AI in pen testing at Kairos Sec," my
8:15pen testing company that I run, and I
8:17explained to them that I do use some AI
8:19for a portion of the reporting process,
8:21but the actual testing is not done with
8:23AI. And the reason they asked that
8:25question is companies don't want you,
8:27for the most part, taking their
8:29sensitive data and passing it over to a
8:31third party. That said, I do think AI
8:34can be a tool that can augment pen
8:36testing, but I think the entire fully
8:39automated AI pen testing is not a pen
8:42test. It is simply a vulnerability scan
8:44with AI built into it. So, I have a
8:47strong disagreement with even the
8:48statement behind it. But, let's go on
8:50here.
8:51Human-led pen tests are expensive and
8:53cover a fraction of applications. No
8:56Scope goes deeper for significantly
8:58less. Pen testers aren't going away, but
9:01the way pen tests have done for the last
9:02decade has changed. This entire
9:04paragraph is contradiction after
9:06contradiction. So, this paragraph begins
9:08by like hating on human-led pen test and
9:11how No Scope is so much better than the
9:13human-led pen test, but don't worry, pen
9:15testers aren't going away. Let's save
9:17ourselves there. Here's the reality of
9:19what I see.
9:20TryHackMe has started a second company,
9:23rather Ben Spring, the founder of
9:24TryHackMe, has started a second company
9:26that is publicly backed by TryHackMe.
9:29This company is building an AI pen
9:31testing agent with one of the big
9:33purposes to replace human-led pen
9:36testing, the very people TryHackMe has
9:38been trying to upskill for the past 5
9:40plus years, releasing certifications on
9:42it and all of that nature.
9:44Well, let's go ahead and look at their
9:46website itself and get a feel for what
9:48is NoScope, what are their claims, what
9:51are factual, what is not factual.
9:54Scroll through here. We'll try to We'll
9:56try to hype through or we'll try to walk
9:58through the marketing hype. Don't take
10:00our word for it, see the proof. I won't
10:02take your word for it. I trust Trust me.
10:05All right, real coverage. Let's consider
10:07this claim. This covers more of your app
10:10than any human pen test across pages,
10:12inputs, and workflows. More coverage,
10:14more findings.
10:15Once again, I don't know about you, but
10:17that sure sounds like to me that one of
10:19your primary goals is to replace human
10:21pen testing with your AI automated pen
10:24test. Let me be very clear with you
10:26guys.
10:27Take a moment and look at the claims of
10:29people who claim that AI can automate
10:31pen testing.
10:33There might be some exceptions. I don't
10:34actually know of any, but almost every
10:37single person who claims that they have
10:38an automated AI pen testing agent or AI
10:42pen tester,
10:44they have zero pen testing experience
10:46ever in their career.
10:48Talk to anyone who does manual
10:50expert-level pen testing or red teaming
10:53and they will tell you AI is not going
10:55to replace pen testing because by nature
10:58of doing a pen test, it requires a human
11:00context. You need to understand the
11:02context of vulnerabilities. You need to
11:04understand things like business logic
11:06flaws that AI is not skilled at doing
11:08yet. Maybe the day will come. I highly,
11:11highly doubt it. I think that part of AI
11:14is significantly overhyped when we look
11:16at the data. If you don't believe me, I
11:18would encourage you to reach out to
11:19anyone who does triage for bug bounty or
11:21CVEs and ask them how much of the
11:24automated AI pen testing they get, how
11:26much of it is
11:27total AI slop false positives. AI pen
11:30testing agents are not a net positive
11:34across the board when it comes to doing
11:36real security research. They have a
11:38massive weakness. Anyone who tries to
11:41tell you that an AI can do a full
11:43automated pen test on its own,
11:46I almost guarantee they have never once
11:48worked as a pen tester a day in their
11:50life, and that is true of Ben Spring. He
11:53has zero pen testing experience in his
11:55background unless I somehow missed it on
11:57his LinkedIn. The majority of what he's
11:59done is TryHackMe, which once again, I
12:00think the vision in the beginning was
12:02amazing. I think the platform was
12:03amazing. I think they have significantly
12:05lost their way, especially with the
12:07launch of No Scope. But Ben Spring has
12:10zero pen testing experience. Let's go
12:13ahead and dive into more of this.
12:17So, fix faster, save developers pen
12:19tester hours, auto fix or assign
12:21findings and automatic retest, blah blah
12:23blah blah. Get a full pen test done in
12:25hours, not weeks. Look, if you would
12:27just call this a vulnerability scan, I
12:28would agree with you. This is not a pen
12:31test by the very definition of what you
12:33are doing. Now, there has always been
12:36companies that will do a Nessus scan,
12:38brand it with their logo, and call it a
12:40pen test. I also think those companies
12:42are wrong. The automated AI pen testing
12:46companies are just the evolution of the
12:48Nessus companies. If you are worried
12:51about like, hey, should I even learn
12:53cybersecurity? Should I even learn pen
12:54testing? The answer is yes. There will
12:57always be a place for humans skilled in
13:01ethical hacking, humans skilled in
13:03cybersecurity. AI is not going to
13:06replace you. Do not believe the CEO
13:09madness and hype around AI. It is not
13:12true. Talk to anyone who is actually
13:14technical working in the field and hear
13:16what they have to say about the place of
13:18AI. All right, let's keep going.
13:21Why AI pen testing? More coverage,
13:24expert level capability, fast results at
13:26a fraction of the cost. Once again, Ben
13:29says in his original post, "We're not
13:30trying to replace pen testers." It sure
13:32sounds like you're trying to replace pen
13:34testers. We even have this, "Human pen
13:36test versus NoScope, limited coverage,
13:38expensive, limited retest, verbal
13:40remediation, pen testers on busy work."
13:42And then we have all of this. The only
13:44thing I agree with is the pen test force
13:46multiplier. I think if a pen tester uses
13:48AI, it can be a force multiplier. But
13:51based on everything set up on this
13:52website, this is not what NoScope and
13:55TryHackMe are aiming for. They are
13:56aiming, with the advent of NoScope, to
13:59replace human pen testers. At least,
14:02that is once again my interpretation of
14:04all the marketing hype on their website.
14:07The threat landscape has changed, blah
14:09blah blah blah. Web apps are being
14:10faster than ever. AI slop, just like
14:13your agent. Cyber attacks are an
14:14all-time high. How NoScope works,
14:16discovery, attack, validate, and fix.
14:19We get why you need a pen test, more
14:21than a checkbox, better security, blah
14:22blah blah blah.
14:24Let's see like who was on their team.
14:25Maybe they have Maybe they have some
14:28Actually, I think it's company. Maybe
14:29they have an expert-level pen tester
14:31helping develop this.
14:33The people behind NoScope.
14:37There is one person.
14:39Unless I'm missing them. So, let's dig
14:41into Ben's background and see if he is
14:42qualified to do this. Previously
14:45Previously at GCHQ. Now, I could be
14:48wrong at this. I think he was an intern
14:51there. I don't know if it will say on
14:53his LinkedIn, but I want to make sure
14:54any claim I make comes from public
14:56information so that I don't um get
14:59myself sued.
15:01Oh, he actually doesn't have it on here.
15:03You'd have to do a little bit of
15:04digging.
15:05I want to be clear, I could be wrong
15:07here, but I believe if you study the
15:09origin story of TryHackMe, the two
15:12co-founders met when one of them, I
15:14think Ben, was an intern at British
15:16intelligence agency. So, I guess
15:18technically it's true he was there, and
15:20I could be wrong on this claim. but I'm
15:22almost certain he was an intern at that
15:24before building TryHackMe, the world's
15:26largest online cybersecurity training
15:28platform used by over 7 million users in
15:30a thousand plus organizations from
15:31government military to Fortune 500
15:33companies. So, kudos on that, but I just
15:36want to point out starting a platform
15:38such as TryHackMe and running an actual
15:41pen test company and knowing how to do
15:43pen testing are vastly different. So, it
15:46does say he's a co-founder, maybe
15:47there's another co-founder, but I don't
15:49literally see anyone here.
15:52Uh
15:52one of the big things that I do when I
15:54am meeting with a client is they want to
15:56know about my background. So, I explain
15:58to them that my years of experience
15:59doing pen testing, the certifications I
16:01have, the CVEs that I have discovered,
16:03the ways I work with vendors, etc.,
16:04etc., etc., and they often want to see
16:06that on the statement of work before
16:08they agree to a pen test. I don't know
16:10what Ben Spring's qualifications are for
16:13doing pen testing, and based on their
16:15company page, he's the only person at
16:17the company. It says our people, but
16:19there's just one people.
16:21Why AI pen testing? We just have more
16:23information on why NoScope is so much
16:25better than a human pen test. It's not
16:27true, just for what it's worth. Once
16:29again, I guess my interpretation, so I
16:31don't uh get myself sued.
16:34The data, once again, using TryHackMe
16:36user data right after Ben Spring
16:38explicitly said
16:40"No THM data is being used to develop
16:42our agent." This post is still live, you
16:44can look it up yourself. I am not making
16:45it up. Will he delete it? I have no
16:48idea.
16:49All right, now I want to show you one
16:50more thing. So, this is part of it. I
16:53feel like Ben Spring as the founder and
16:55leader of TryHackMe has betrayed the
16:58trust of the community.
16:59Hackers are very much concerned about
17:02how our data is being used, especially
17:04how it's being fed into third parties.
17:06Just because something is technically
17:08legal
17:09does not mean it is ethical.
17:12Let me say it again for the people in
17:13the back. Just because something is
17:15technically legal does not mean it is
17:18the ethical thing to do.
17:21And when you hold the trust of millions
17:24of hackers or future hackers, you need
17:26to understand that we are very much
17:29concerned about our data and we're very
17:31much concerned about AI. The reason I
17:33wanted to make this video is I have seen
17:34multiple people in my community who are
17:37like, "Hey, I was studying for
17:38cybersecurity, then I saw posts like
17:40this and now like, why should I even
17:42study? Are we cooked? Blah, blah, blah,
17:44blah." My encouragement to you who want
17:46to get into the field, yes, you should
17:47study. There will still be a place for
17:50you, especially when this AI hype bubble
17:53pops and we go back to being grounded in
17:56reality rather than a bunch of CEOs
17:58being obsessed with AI and how they can
17:59make more money with their automated AI
18:02silliness. So, please do not give up if
18:05you want to get into this field.
18:06Continue to learn, continue to study,
18:09continue to dig deeper, continue
18:11growing.
18:12But, let's also talk about the culture
18:15TryHackMe as a company. This is another
18:17reason that I would strongly encourage
18:19you not to support TryHackMe. We will
18:22also look at one of their main
18:23alternatives, which is Hack The Box,
18:25their main competitor, and we'll look at
18:27the difference between the two company
18:28cultures between TryHackMe and Hack The
18:31Box. I want to be very clear. I'm not
18:33affiliated with Hack The Box, I'm not an
18:35employee of them, I'm not on staff with
18:37them, I'm not even like a Hack The Box
18:38influencer. I have my own platform, Hack
18:40Smarter, but I am a huge fan of Hack The
18:42Box. I used to be a huge fan of
18:44TryHackMe. But, let's go ahead and look
18:46at real employee reviews and what
18:48employees on the inside of TryHackMe are
18:50saying about working at the company.
18:53Okay, here I am on the TryHackMe
18:55Glassdoor page and you can scroll
18:58through here and see all the reviews if
18:59you want. Now, this one's massive. This
19:00is the one I really want to dig into
19:02though cuz I think it gives a lot of
19:03detail. I don't know if I can close it
19:05if I go down to the bottom, whatever.
19:07You can scroll through here and see the
19:08different reviews about TryHackMe, but
19:11this one, from what I know in my
19:13experience at TryHackMe is spot-on. So,
19:15I want to break this down. I have no
19:16idea who wrote this review, but it seems
19:19that they really did work at TryHackMe.
19:21So, let's dig into this and talk a
19:23little bit about what it says.
19:25So, he says or she says, I don't want to
19:27assume their gender, "If you breathe AI
19:29and love burnout, apply.
19:31If you hope for any respect, changing
19:33appreciation, avoid like the plague. So,
19:36pros, fully online, the people you work
19:38with are amazing.
19:40Let's talk about the cons.
19:42Well, the people you work with, they are
19:43exceptional, etc., etc., etc.
19:46Um they're exceptional, overworked, and
19:49routinely pushed far beyond anything
19:51that could be considered reasonable or
19:52sustainable. And TryHackMe doesn't hide
19:54it. Ben Spring actually brags about this
19:56and we can even pull up that article as
19:58well. This is rewarded with hostile
20:00messaging from senior leadership,
20:02complete silence from an absent
20:03co-founder, and the farcical experience
20:06of discovering major company decisions
20:07via LinkedIn post rather than internal
20:10communication. Workload increases are
20:12constant, support is nonexistent. Anyone
20:14who signals they want boundaries,
20:16balance, or a life outside of work is
20:17quietly managed out. To be very clear, I
20:20am friends with many current and former
20:23TryHackMe employees.
20:25This seems to be accurate based on my
20:28conversation with friends, but those are
20:31just conversations, so take it as you
20:33will.
20:35Uh let's see, leadership urgently needs
20:37to stop avoiding difficult
20:38conversations. Decisions made at the top
20:40are actively damaging morale, delivery
20:42quality, and long-term viability. The
20:45impact is already visible as attention
20:46drifts toward unrelated ventures, aka No
20:49Scope, while the core business
20:51deteriorates under the weight of
20:52internal dysfunction.
20:54There's a lot here.
20:55>> [laughter]
20:55>> We can dig into that. HR deserves
20:58particular scrutiny. Basic, legally
21:00required documentation requested by HMRC
21:03took over 2 months to provide, while
21:05HMRC contacted me daily. This is not
21:07even a count for severe payroll and tax
21:09errors that resulted in UK employees
21:11suddenly being asked to pay thousands in
21:13unexpected taxes due to internal
21:15accounting mistakes. This is not a
21:16process issue, it is operational
21:19negligence. Anyone inclined to dispute
21:21this publicly is welcome to try. Every
21:23example above is directly observable and
21:25verifiable. This is not emotional
21:28exaggeration, it is a factual account of
21:30daily reality.
21:32Let's see. What makes this especially
21:33painful is that it didn't used to be
21:35this way. I was here for years. I
21:37believed in the mission. I gave far more
21:39than was ever required. Watching
21:41leadership and HR systematically choose
21:43self-preservation over accountability
21:45while the culture collapses in plain
21:47sight is deeply upsetting and entirely
21:50avoidable.
21:51As far as advice to management, you
21:53likely won't read this and if you do, it
21:55will be dismissed in the same way every
21:56other piece of feedback has been
21:57acknowledged, archived, and ignored.
21:59Still, for the record, I want to be very
22:01clear. I have never been on TryHackMe
22:02staff, but this is exactly how I felt
22:04when I brought up my concerns TryHackMe
22:06user data being used in the AI agent. It
22:09was acknowledged and then discarded and
22:11then publicly called misinformation only
22:13to be boasted about on their new AI
22:15agent that they're using TryHackMe data.
22:17That royally pisses me off and that's
22:19honestly the big reason I got fired up
22:22and made this video.
22:24I used to love this company. I stayed
22:26for years because I believed in it. The
22:28people here work harder than anywhere
22:29else, etc., etc., etc.
22:31You know how to read, so I'll let you
22:33read this yourself. I will kind of
22:34scroll through here because if you don't
22:36have a Glassdoor account, I don't think
22:38you can actually see like Glassdoor
22:40stuff. So, I'll scroll through here and
22:43you can check out all of these yourself.
22:49I'll explain this one.
22:51Feel free to pause my video if you want
22:53to read any of these.
22:55Just scrolling through. I mean, we can
22:57go to the second page if we want, but I
22:58think you guys get the gist
23:01of what I'm trying to show from the
23:03TryHackMe culture.
23:05Let's compare them to their alternative
23:07or their competitor.
23:09Maybe this is just an issue at all big
23:11companies that make pen testing stuff.
23:14So, how about Hack The Box? What are the
23:17reviews like for Hack The Box?
23:20All right, here we are at Hack The Box
23:21reviews. 4.6 97% approve of the CEO.
23:26And note that strong learning
23:28environment, great culture, supportive
23:30people over at first the real
23:31environment to grow. Great co-workers
23:33and supportive professional environment.
23:35The greatest tech company in Greece. I
23:37mean, if you care about how CEOs and
23:40leadership treat employees, that in and
23:42of itself should give you strong enough
23:44encouragement to leave TryHackMe for
23:46another platform. There are so many
23:48other better platforms out there besides
23:50TryHackMe that will help you grow and
23:52break into the field of cybersecurity.
23:55Now,
23:56we know that Glassdoor could just be a
23:58disgruntled employee being mad about
24:00something in their culture. But, I want
24:02to be up front with you. What we are
24:03reading about on Glassdoor is something
24:05that Ben Spring not only advertised, but
24:08is very public with if you want to work
24:10at TryHackMe. Let's pull up the blog
24:12that Ben wrote about before you work at
24:15TryHackMe, read this blog. And honestly,
24:18it's an answer to what we saw on
24:20Glassdoor. We see all those results of
24:22Glassdoor come directly from the toxic
24:25work environment that is going on at
24:27TryHackMe as result of the leadership.
24:29Let's look at this together. Now, I do
24:31want to give some kudos to TryHackMe
24:32about being very up front about this,
24:35but I think this type of work culture is
24:38unhealthy, it is toxic, it is bad for
24:40your family, it is bad for you as an
24:42individual, but let's dive into this.
24:45Working at TryHackMe isn't for everyone.
24:46I would argue it's not for anyone.
24:48TryHackMe isn't your typical workplace.
24:50I think we got that from Glassdoor.
24:52We're intense, ambitious, and built for
24:54people who thrive on challenges. I want
24:56candidates to read this and say either
24:58TryHackMe isn't for me or this sounds
25:00exactly like the environment I want to
25:01operate in. Blah, blah, blah, let's dive
25:04into I mean, once again, guys, you can
25:07read this. You know how to read this.
25:09Let me scroll through here.
25:11A few things I want to stand out to you.
25:13As a fully remote company, we rely on
25:15clear communication and expect people to
25:16be present on Slack sometimes after
25:19hours. From my conversations with the
25:21people, it's almost always after hours
25:23you need to be available, otherwise you
25:25will be chewed out. Once again, not my
25:27experience, based on conversations,
25:29based on looking at Glassdoor, and based
25:31on Ben's post right here. Additionally,
25:34TryHackMe does not pay super well. You
25:36can look at public salary information
25:38about it.
25:39I totally get that when you're a
25:41founder, I get being present. I'm the
25:43founder of two companies. But, here's
25:44the thing, when my company succeed, I'm
25:47rewarded directly. When you are a
25:48salaried employee and you're paid the
25:50same for 40 hours compared to 70 hours,
25:53forcing your employees to work 70 hours
25:55and just calling it ownership is BS and
25:58bad leadership, in my opinion.
26:01Let's see, founder mode. Both founders
26:03built the original products and remain
26:04deeply involved in every detail. You'll
26:06notice almost every single Glassdoor
26:08reviews mentions micromanagement from
26:11the founders. From extremely small
26:12design choices or wording and content to
26:14big strategic decisions. This means
26:16you're interact with us, blah, blah,
26:18blah. Execution over strategy. Here is
26:20this. So, intensity. Traditional
26:22company, steady pace. TryHackMe, fast
26:24pace, high energy. Blah, blah, blah, you
26:26can you can read through all of this
26:27yourself. I just want to point out to
26:29you when you look at Glassdoor and when
26:31you look at what is publicly said about
26:34TryHackMe's culture from the leadership,
26:36all the Glassdoor reviews sort of match
26:39up into what TryHackMe is saying. I
26:41mean, we have this one. Toxic culture
26:43disguised as TryHackMe isn't for
26:45everyone. I did not plan this to be the
26:46next one, but you will notice here.
26:49Founder led means micromanaged. You'll
26:51notice quickly the company struggles to
26:52retain staff, etc., etc., etc. So, let's
26:56go ahead and recap. Here is why you
26:59should stop using TryHackMe.
27:01Number one, I believe TryHackMe has lost
27:04their way due to the leadership. They
27:06have spent the past 5 plus years
27:08training people for careers in
27:09cybersecurity and they just launched an
27:11AI automated pentest agent that, at
27:14least based on the marketing language,
27:16is seeking to replace the very people
27:18they are trying to chain train and be
27:20certified. Number two, based on public
27:22posts on Glassdoor, TryHackMe has a very
27:25unhealthy culture in the way they treat
27:27employees. Number three, leadership from
27:29the top, Ben Spring himself said on
27:31LinkedIn that any conversation about
27:34using TryHackMe data for their AI agent
27:36is misinformation. On their AI agent's
27:39website, they brag and boast about how
27:41they use TryHackMe data to build the AI
27:44agent. Those are just a few of the
27:46things. I would love to hear your
27:47thoughts. Am I off base here? Like
27:50honestly, if I'm off base, please tell
27:52me.
27:53I hope that if my organization
27:55HackSmarter ever comes to a place where
27:57I treat the community like this, someone
28:00on YouTube, some influencer, will have
28:02the courage and the boldness to call me
28:04out. And I really do hope I listen. So
28:07Ben, I know you're not going to listen
28:09to me. You I tried to talk to you
28:11privately. You told me to talk publicly,
28:13then you blocked me on LinkedIn. You
28:15clearly don't want to have a
28:16conversation with me, so now I'm
28:18resorting to making this video and
28:20sharing my thoughts here. For my friends
28:22at TryHackMe who still work at
28:23TryHackMe, I hope that somehow, someway,
28:26you have the influence to be the change
28:27that needs to be done at TryHackMe. I
28:29think TryHackMe started on an amazing
28:32mission. I think in the beginning it was
28:33an amazing company, but I thoroughly
28:35believe TryHackMe has lost its way due
28:39to the leadership at the top. So, I hope
28:41my friends who are employees, you guys
28:42are amazing people. I hope that you can
28:44be the change in TryHackMe. For the
28:46former employees of TryHackMe, I've
28:49talked to you. I know many of you have
28:50been hurt deeply by your time at
28:52TryHackMe. I hope that you can find
28:53healing, and I hope you know that not
28:55all companies are like that. Hack The
28:57Box is a great example of a company in a
28:59similar field, but has a heavy focus on
29:01their employees. I'm a firm believer
29:03that the better you treat your
29:05employees, the better you treat your
29:07community, the better it will be
29:08reflected in your culture, and
29:10eventually [clears throat] in your
29:11revenue.
29:12So, I don't know about you guys. Let me
29:14know your thoughts if I'm way off base,
29:16if you agree with me, if you just want
29:18to like make a video about Tyler and how
29:21I am a sellout, you can do that as well.
29:23But hey, thank you for watching. Would
29:24love to hear your thoughts, and I will
29:26catch you in the next one.

About this transcript

This page contains the full transcript of Stop using TryHackMe. by Tyler Ramsbey - Hack Smarter, generated from the public captions YouTube serves with the video. The transcript has 5,614 words across 844 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.