FAQ 2: Does a Background in Web2 Security Help in Web3 Security?

This is the second part of my FAQ series, where I tackle some of the most common questions I get. (Link to Part 1 in comments!)

Short Answer: Yes—but not in the way you might expect.

Here’s the deal: the testing strategies in Web2 security are very different from those in Web3. Let me break it down.

In Web2 security, you rarely have access to the source code of the application you're testing. Even if you do, it’s often hundreds of thousands of lines long—way too much to fully understand or grasp in its entirety.

A typical Web2 engagement looks like this:

- Reconnaissance/Discovery: You start by mapping out the attack surface—basically identifying all the possible points of entry.
- Testing & Probing: You then test different attack vectors, collecting data and observing how the application behaves under different circumstances.

Most of this is done without reading any code. Instead, you rely heavily on automated tools, reverse engineering, and behavioral analysis of your target. This is called black-box testing—you're working without full visibility into the system’s inner workings.

This process forces Web2 security researchers to develop critical reverse engineering skills and, more importantly, the attacker mindset.

So, what’s the advantage of a Web2 background in Web3 security?

It’s simple: You’ve already trained your mind to think like an attacker.

Explaining what the attacker mindset is—and making it easy to reproduce—can be challenging to convey through words alone. To address this, I’ve decided to share a personal story. I’ll delve into the details of how I first developed this mindset, the circumstances I was in, and the specific actions I took.

To keep today’s post concise, I’ll save the story and a detailed breakdown of the attacker mindset for next Sunday’s post. Stay tuned!