We only accept clients via referral. As a highly sought-after software and cyber defense firm, we maintain strict limits on new engagements. Inquiries without a valid referral may not receive a response.

Security Leadership

Security Leadership & Offensive Operations

CYBERCAT

At CyberCat, enterprise application security, vulnerability research, and adversarial testing operate under strict separation of duties between security governance and offensive security operations.

Ege Yol

Co-Founder & Head of Application Security (CISO)

Ege Yol leads corporate security architecture, secure software development lifecycle (SSDLC) governance, and vulnerability management at CYBERCAT. Having started his journey in software development, reverse engineering, and penetration testing at the age of 14, he brings over 7 years of deep hands-on experience in securing cloud-native platforms, distributed microservices, and multi-tenant APIs. As Head of Application Security, he defines internal Rules of Engagement (RoE), authorizes security assessments, and oversees enterprise risk remediation across all proprietary and client systems.

Necmi Öksüz

Co-Founder & Offensive Security Lead

Necmi Öksüz leads the dedicated CyberCat Offensive Security & Red Team Function. Specializing in adversarial simulation, manual source-code auditing, and advanced web/API exploitation, he directs all internal penetration testing engagements and continuous vulnerability research. Under his leadership, the Red Team systematically evaluates proprietary platforms and authorized environments against OWASP WSTG, OWASP API Top 10, and MITRE ATT&CK frameworks prior to production release.

Internal Rules of Engagement (RoE) & Governance

All offensive security testing conducted by the CyberCat Offensive Security & Red Team operates under formal written authorization. Prior to any testing activity, a documented scope, target asset inventory, and designated testing window must be formally signed off by both the Head of Application Security (Ege Yol) and the respective System/Asset Owner. Findings are tracked through verified remediation and post-patch retesting before release sign-off.