ashifly

CyberSecurity is everything. Hustler. she/her. eJPTv2 & CRTP✨nerd-ultapromax. BlackHat Europe Arsenal.

[ashifly @ashifly_]

I had the honor of speaking at the Kubernetes Village on Container Security in @seasides_conf . I have consolidated the first part of attack map in the below article.

https://t.co/GNH3olZliz

Stay tuned for more!

[Kunal Shah @kunalb11]

It’s been a minute.

2015–2018
- Exited FreeCharge. Spent time learning and investing.
- Pondered about: Why can't trust be rewarded? Started with $1M of personal capital.
- Launched CRED to reward people for paying credit card bills on time.

2019–2025
- Built a system run by a team that values ownership, judgment, and craft.
- Grew from 0 to 17M members by aligning incentives with behaviour.
- Built several products during COVID lockdowns.
- Raised $900M+ from global investors. Did 4 ESOP buybacks.
- Made Indiranagar and IPL ads slightly more interesting.
- Received a full stack of regulatory licences.
- Lost 35 kilos.
- Scaled from 0 to ~$325M ( ~₹3,200 crore) in annual revenue across payments, lending, insurance, commerce, wealth, and credit cards.
2026
- First profitable quarter (yet occasionally asked what our business model is)
- Raised another $900M from Meta in primary and secondary capital.
- Announcing our 5th ESOP buyback.

Today

CRED is ready for its next phase. I am stepping back and @miten steps in as interim CEO, partnered with an incredibly talented team. He has been heading strategy and finance and suffering me since 2020. I’m stepping away from the operating role and will continue as a shareholder. My commitment doesn’t change. Just the role.

Extremely grateful to our members, partners, regulators, and investors who made this possible. And to our board, Shailendra, Micky, Saurabh for their extraordinary conviction.

Team CRED, I’ll still expect you to be a 10x version of yourselves.

As for me, I’ll be joining Meta to lead WhatsApp globally.

Meta comes in as a minority investor in CRED. No access to member data.

While it’s come very far, the delta between WhatsApp today and its full potential is massive. I look forward to working with Mark, Chris, and the leadership across Meta for the next step in WhatsApp’s journey. Will, thank you for scaling something the world relies on quietly, and for making this transition smooth.

Onwards.

[ashifly @ashifly_]

“Cyber Security” is all about thinking.
No matter how hard you study for 3 months or 3 years - if you can’t think like an attacker - you don’t stand a chance in this industry.

[ashifly @ashifly_]

how crazy it that every year when re-run through what you learnt years back, you understand it one layer deeper and better, and able to map it in your mind with what you experienced.

[ashifly @ashifly_]

The fact that i bought my first antivirus software back in 2019, without giving a thought about what it actually does in-depth destroyed me. cause if i would have studied about it at that time, i would be somewhere else today :)

[ashifly @ashifly_]

learnt something today and executed it in real world environment
i am happy

[Lsec @lsecqt]

Did you know that you can invoke VBA macros directly from PowerShell? Mind blowing right?
Shout out to this blogpost: https://t.co/EEABlcgz5I

[ashifly @ashifly_]

has anyone tried hacking passkeys yet?
just wondering ;)

[ashifly @ashifly_]

What's up @AppSecEngineer ?

[ashifly @ashifly_]

Tickets book karlo warna tumhei bhi aisey aana pdhega 😅

SEASIDES IS HAPPENING!!!!
@seasides_conf

20-22 Feb 2025
ICG GOA
https://t.co/w9RYwrtF7b

[ashifly @ashifly_]

@cybercrat0712 Nope. Check dm

[ashifly @ashifly_]

#30Days30Vulns
Day 02 : CSRF!

[ashifly @ashifly_]

@cybercrat0712 Definitely I will. And Thank you so much :)

[ashifly @ashifly_]

@Avishkar_03 sure, will share.

[ashifly @ashifly_]

Security is one of the hard career paths.
You gotta think twice before opting in because, here, even the professional with a decade of experience is a beginner. Stop getting fascinated by bug bounty stuff. It's just a tiny part of the entire domain.

But the community here is ♡

[ashifly @ashifly_]

@cybercrat0712 life has lately been so much occupied with corporate mazdoori. 🥲

[ashifly @ashifly_]

1. https://t.co/CwR4UFzNvK
@rana__khalil Best person to learn from.

2. Portswigger Labs

3. https://t.co/ZkZKtNhQh3

[ashifly @ashifly_]

#30Days30Vulns
Day 01 : CORS!

[ashifly @ashifly_]

@Manas1137 yes, i will :)

[ashifly @ashifly_]

Was I too direct? I want to know how much time of learning, researching it takes to end up reaching that stage where you are called to teach thousands in big security events. What is your thought process? Like chaining concepts? Going in real depth of technicalities?

[ashifly @ashifly_]

Hey Security Researchers, I have a genuine question.
What is the pathway to present on Bsides or NullCon?
Like how many hours, what mentality, and what thought process?

Because I wanna be there someday. :)

[ashifly @ashifly_]

Thank you so much y'all ❤️ Will post a tweet with the learning, the resources, everything, at the end of the day.

[ashifly @ashifly_]

Should we start a 30 day 30 vulnerabilities learning challenge in depth? motivate me y'all😭