Scripts to Startup
From junior penetration tester to head of penetration testing and now co-founder of AppTest Direct.
Michael Jepson | Co-Founder, Technical Director & Lead Penetration Tester
Introduction
Back in October 2020, I wrote an article for TechVets titled Ships to Scripts, and it told the story of how I went from spending 17 years in the Royal Navy to pursuing a completely different career in cybersecurity.
At the time, I'd just landed my first job as a junior penetration tester. I'd spent countless evenings on Hack The Box, studying for certifications, breaking things in my home lab, figuring things out as I went.
I’d earned my CompTIA qualifications and CPSA, and still had plenty I wanted to learn and achieve. Next on the list was my CREST Registered Tester (CRT) exam, which I was busy preparing for and successfully passed. Fast-forward to today, and I've personally conducted hundreds of penetration tests, overseen hundreds more, progressed to Head of Penetration Testing. Along the way, I’ve earned some hard-won professional qualifications and, most excitingly, decided to start a business with my wife, Deborah.
A fair bit has happened since that first article, so I thought it was time to share what I’ve been up to.
From Junior Tester to Head of Penetration Testing
In September 2020, I started my first penetration testing role. After all the studying, labs and certifications, I was finally getting paid to do something I'd spent the previous 18 months trying to learn.
It didn’t take long to realise that hacking my way into vulnerable machines was only one part of being a penetration tester.
Working on real customer systems taught me that penetration testing was about much more than finding known vulnerabilities. It was about understanding how applications and infrastructure work, thinking creatively about how they could be attacked, and investigating weaknesses that aren't always immediately obvious. I quickly discovered that experience, curiosity and a willingness to dig deeper can make a significant difference to the results.
I learnt a huge amount in those early years, particularly from working alongside experienced testers and getting exposure to different technologies and environments.
In December 2020, I progressed from Junior Penetration Tester to Penetration Tester, and by April 2022, I'd moved into Penetration Testing Management.
My responsibilities continued to grow, from carrying out individual assessments to managing testers and leading full red team engagements. These were some of the most interesting assignments, involving everything from covertly placing a small network device inside a building during an authorised exercise to bypassing security controls and safely simulating ransomware attacks. In May 2026, I became Head of Penetration Testing.
Not bad considering that, back in 2019, a friend suggested I give cybersecurity a go because I was "good on computers". As I explained in the original article, that mostly meant I owned one!
I've been fortunate enough to work with some excellent people throughout my career, but I think the biggest change has been the way I approach penetration testing.
Learning to See the Bigger Picture
When I first started testing web applications, I’d work through each feature, checking for vulnerabilities and regularly referring to testing guides to make sure I hadn’t missed anything. That structure was invaluable, and it’s still an important part of how I test today. But after years of testing, you start to notice patterns and make connections more naturally.
These days, exploring an application can sometimes feel a bit like looking at the Matrix. Sadly, there’s no green code scrolling down the screen, just a much better understanding of how everything fits together and where things might go wrong.
I'm looking at user roles, API requests, authentication, authorisation, data flows and business processes, and piecing together how they all connect. What might the developers have taken for granted? And what happens if I try something they weren’t expecting?
A single request might look perfectly secure on its own. But what happens if you change the user role, manipulate an identifier or carry out actions in a different order?
Sometimes the vulnerability isn't in one function. It's in the relationship between several of them.
With experience, I’ve become much quicker at piecing that picture together. Things I once spent hours or even days trying to understand often start to make sense much earlier in a test. That doesn’t mean I have all the answers, or that every application is straightforward to test. Far from it! But over time, you get a better feel for where to look, what questions to ask and when something isn’t quite right.
I've tested applications that had already undergone penetration testing and still discovered serious security weaknesses, sometimes involving fundamental issues with access control or business logic.
That's not necessarily a reflection of the previous assessment. Applications change, scopes differ, and no penetration test can guarantee that every vulnerability will be found.
But those experiences have reinforced something I strongly believe: the quality of a penetration test depends on much more than the tools being used.
Automation is valuable, and I use it regularly. But understanding how an application works, investigating unusual behaviour and following potential attack paths requires experience, curiosity and technical judgement.
It's also what makes the job so enjoyable.
Exams, Setbacks and a Few Achievements
One thing that hasn't changed since my first article is my approach to learning. I still spend plenty of time researching vulnerabilities, building labs and trying things out for myself.
In June 2023, I sat my CREST Registered Tester (CRT) examination again, having originally passed it in December 2020.
What a difference a few years of practical experience makes!
The first time around, I'd spent countless evenings studying for an exam that felt like a major milestone. Returning with several years of hands-on testing behind me was a completely different experience. Things that once required hours of research had become part of my day-to-day work.
Of course, that doesn't mean every exam has gone smoothly.
In 2026, I decided to take on one of my biggest technical challenges yet: the Cyber Scheme Team Leader (CSTL) Web Application qualification.
Despite having years of professional penetration testing experience, I failed my first attempt.
I'll admit that was a difficult one to take. I'd been testing web applications professionally for years, but the assessment highlighted areas where I needed to improve.
So, I got back to studying.
I spent considerably more time working through practical challenges on PortSwigger's Web Security Academy, completed a dedicated training course and focused on improving the areas where I'd struggled.
The extra work paid off. In May 2026, I returned and passed.
For context, CSTL Web Application is an expert-level practical assessment designed to simulate a real-world penetration test. It is also a recognised technical qualification for Principal and Chartered professional registration in Security Testing with the UK Cyber Security Council. It gives you an idea of the level of expertise being assessed.
Going from failing my first attempt to passing was one of the most rewarding achievements of my career.
Later that year, I achieved another milestone, being awarded the Principal Cyber Security Professional (PriCSP) professional title by the UK Cyber Security Council, specialising in Security Testing.
The biggest lesson? Experience doesn't mean you've finished learning.
Cybersecurity moves quickly. New technologies, vulnerabilities and attack techniques mean there's always something else to get your head around.
And that's a big part of why I still enjoy it.
So, Why Start AppTest Direct?
After progressing from junior tester to Head of Penetration Testing, I started thinking about what I wanted to do next.
I've been fortunate enough to build a career doing something I genuinely enjoy, working with some excellent people and gaining experience across a wide range of security assessments. But despite moving into management and leadership, I've never lost my passion for hands-on penetration testing.
And having the opportunity to build that business with Debs made the decision even more exciting.
Throughout my career, I've regularly identified High and Critical-risk vulnerabilities that, if exploited, could have resulted in significant financial, operational or reputational damage to the organisations involved.
Experiences like these have reinforced just how valuable a thorough penetration test can be. I want AppTest Direct to deliver that level of expertise and attention to detail, while making professional penetration testing more straightforward and accessible.
We're focusing on the areas we know best: web applications, APIs and external infrastructure. Our approach combines experienced, specialist-led testing with detailed manual investigation and appropriate automated tools.
I also know that most businesses have limited security budget and time. We wanted to make purchasing easier, so our core services can be ordered online, with clearly defined scope and upfront pricing.
Larger applications may still be suitable for our standard service, with testing focused on the highest-risk areas. And where customers need more comprehensive coverage or additional hands-on testing time, we're happy to discuss their requirements.
Of course, purchasing a test doesn't mean we immediately start attacking someone's systems! Every engagement still requires scope validation, appropriate authorisation and agreed testing arrangements before work begins.
Ultimately, we want to build a business we're proud of, doing work we enjoy, delivering genuine value to customers and maintaining the high standards we believe in.
Meet My Business Partner (and Wife!)
Of course, I wouldn’t be doing this alone. I co-founded AppTest Direct with my wife, Deborah-or Debs, as most people know her.
Debs spent more than 16 years in the Royal Navy, building experience in technical operations, leadership, management and project delivery. She’s also worked in consultancy, managing projects worth £100 million, so she’s no stranger to complex work, big responsibilities and keeping people pulling in the same direction.
She’s continued building on that experience, achieving the APM Project Management Qualification (PMQ), PRINCE2 Practitioner and a Level 5 Certificate in Management and Leadership. She’s currently working towards her BSc (Hons) in Leadership and Management.
We’ve actually worked together before, having served on ships together during our Royal Navy careers. We already know what it’s like to work alongside each other in a demanding environment, so this isn’t entirely new territory!
At AppTest Direct, I’ll lead the technical side, including penetration testing, methodology and technical delivery. As Co-Founder and Operations Director, Debs will lead operations, engagement coordination, customer communications and quality processes.
Her technical understanding and project management experience mean she can take the requirements of an engagement and turn them into a clear, organised plan. From the first enquiry through to final reporting, she’ll keep customers informed, engagements on track and standards high.
That matters because we want arranging a penetration test to feel straightforward. The quality of the testing is essential, and so is the experience customers have working with us.
I couldn’t ask for a better person to build the business with. Debs brings a huge amount of experience, determination and professionalism. She’s exceptionally organised and isn’t afraid to challenge me when she thinks something could be done better. Having worked with her before, I know how valuable that is-even if admitting she’s right doesn’t always come quite as quickly!
We’ve also got two young children keeping us busy, so between family life and launching AppTest Direct, life is busy!
But I’m really looking forward to building something together again. We bring different strengths, but share the same high standards and determination to make AppTest Direct a success.
What's Next?
We've established AppTest Direct to offer specialist-led web application, API and external infrastructure penetration testing, with a focus on quality, clear communication and genuine customer value.
Our goal isn't to become the biggest cybersecurity company. We want to build a business we're proud of, deliver excellent work and provide a service that customers are happy to recommend.
I want customers to feel confident that their systems are being assessed by people who understand the technologies they're testing, take the time to investigate potential weaknesses and care about the quality of the results.
Looking back at my original TechVets article, I'm incredibly grateful for the opportunities I've had, the people who've helped me and everything I've learnt along the way.
TechVets played a significant part in helping me make the transition from military life into cybersecurity. The employers, colleagues and customers I've worked with since have also helped shape the tester and leader I've become.
If there's one thing I'd say to anyone starting out, it's the same advice I gave back in 2020: if you enjoy it, give it your all.
You never know where it might lead.
For me, it's led to the next chapter: building AppTest Direct with Debs.
And I couldn't be more excited to see where we take it.
One Last Thing - Koldo
Those who read my original article might remember Koldo, our 78kg St Bernard, who featured at the end.
Sadly, we said goodbye to him in early 2026.
He was a huge part of our family and was there throughout my transition out of the Royal Navy, the late nights studying and the early years of my penetration testing career.
It wouldn't feel right to write a follow-up without mentioning him.
So, I'll finish this article the same way I finished the original, with a picture of Koldo.
