Ben Spring

TryHackMe Co-founder ($30M+ ARR). User retention is everything.

[Ben Spring @springjben]

"Who TryHackMe is" (https://t.co/jMm73cpQ0M).

We have quite an intense culture, it's not for everyone - but it means everyone here is so talented and hard working.

This video from our TA team captures just how impressive our people are. When I look back at what we've built and achieved this year, no company our size comes close.

If you clock watch at work, don't love Mondays, and finish at 5 on the dot, you're in the wrong job. If what you watch excites you, we're hiring (link in comments).

[TryHackMe @tryhackme]

🚨 The AI1 Certification is live and with a special 30% off launch offer you don't want to miss 😉
Attack the system. Build the defence. Prove the skill.

Earn the credential built for the next era of cyber security ⚡
Get certified in AI security with TryHackMe ▶️ https://t.co/PELNwEvTEY

[TryHackMe @tryhackme]

Now that we know the crazy places you saved your streak...Whats the crazy reason you lost it??
Top 3 best excuses gets 5 streak freezes...

[Garry Tan @garrytan]

Be your self, not someone you were assigned to be!

Bezos won on time horizon, not AWS or 1-Click.

If your bets have to work in 3 years, you compete with everyone. Every smart, funded team is chasing the same 3-year problems. Short horizon, crowded field.

Stretch to 7 and the field collapses. Investors want returns, employees want vesting, founders want proof. Almost nobody can sit in a bet that doesn't pay for most of a decade. The patience is the moat, and it costs you, that's why it works.

But you can't fake a 7-year horizon on a problem you don't actually care about. Pick the users and the problem Moloch assigned you, the safe ones, the fundable ones, and you'll bail the first hard year. Pick the ones that are actually yours and you'll still be there when everyone else has quit.

So the real prerequisite isn't discipline. It's knowing yourself well enough to choose a problem and a set of people you care about that you'll serve them for decades.

[Ben Spring @springjben]

Our AI pentesting solution (NoScope) has found so many vulnerabilities like this. If companies don't move to continuous pentesting or get an AI pentest, they're asking to get breached.

[NoScope @trynoscope]

For 4 years, any person on the internet could pull private container images from 30,000+ Gitea deployments.

No account. No password. No credentials of any kind.

NoScope discovered it. CVE-2026-27771. Here's the full story. 🧵

[Ben Spring @springjben]

@0xTib3rius Beast mode activated.

[Ben Spring @springjben]

100% - "over learning". You can only learn so much from books and podcasts - the most in depth (and memorable) learning comes from first-hand experiences. Also, I've found a lot of the time what I learn is different from reality or overly simplified; it can't be universally applied.

[Ben Spring @springjben]

@readswithravi I prefer a physical book - currently reading "The book of Elon"

[Ben Spring @springjben]

@KaiXCreator Wanting to get a job in cyber security https://t.co/KvklN065no

[Ben Spring @springjben]

@IvanLandabaso I didn't realise Replit was so small a few years ago (30 people). They rode the AI dev so well. So many of the hyper-growth companies in the early AI wave are in the developer landscape - Cursor, Lovable, Claude.

[Ben Spring @springjben]

@yacineMTB "if you live each day as if it was your last someday you'll most certainly be right" ~ Steve Jobs

[Ben Spring @springjben]

@michlimlim @RattrayAlex Great article. Having a reMarkable (Paper Pro Move) has been a huge unlock for me.

[Ben Spring @springjben]

@DanielLockyer Agreed - been enjoying listening about Rockerfeller https://t.co/H1kw3YpxIa

The Founders podcast by @davidsenra are my favourite. The story telling is unmatched.

[X Freeze @XFreeze]

First, make it exist, then you can polish it later

[TryHackMe @tryhackme]

When the Jr Penetration Tester path gets a major upgrade and your inner pentester starts doing cartwheels. Go check it out ➡️ https://t.co/ah2Af8PiaA

[Keval @KevalJagani1]

@trynoscope has been finding some unbelievable vulnerabilities lately:

- Manipulate trading data on popular crypto trading site
- Pre-auth RCE on OSS with >400k installs (found via black box, not white)
- Managed to get e-commerce application to leak admin Stripe API keys

Will release more once these are patched, and we have permission to disclose.

Our agents architecture is really unique - teams will be really surprised when they get access; we do free trials, so reach out if you're interested.

[Ben Spring @springjben]

@Kabir4charya Great take - and I largely agree. Focus should be on learning, and community.

[NoScope @trynoscope]

For anyone using Vercel, a few important steps to take after today’s incident:

1. Rotate your secrets
2. Move away from long-lived credentials
3. Review audit logs for any unusual access

We’re offering a free pentest for Vercel users. Reach out to get started.

[Ben Spring @springjben]

@ryancarson What about in 5 years time?

[Ben Spring @springjben]

You joke, but most capable security agents would beat a team of humans (for now.. until the tools pentesters use catchup - this includes claude code which will get highly capable soon).

Happy to put NoScope (our agent) against a team of capable pentesters for £10k. Happy to discuss terms?

[Ben Spring @springjben]

As a 19 year old with $0, I built TryHackMe to >$30M ARR with 7 million users. I share key lessons & the original story with Vlad Kachur - topics & learnings:
📈 How we grew to 5.5M users with no marketing team

🎨 50k+ signups via AI/LLMs, growth loops & running 1000s of experiments

🏆 Our performance-first culture, stack ranking 150 staff, & how we hire

💸 TryHackMe origin story (being sued, almost going bankrupt)

❌ Being unapologetically unconventional (operating unlike any other company, we have no company-wide calls & what you learn from business books is nonsense)

Watch it here https://t.co/bqEScPEP27 - thanks Vlad for having me!

If you did watch & have questions, please throw them into the comments.