In 2009, Huzeyfe Onal helped another security practitioner begin a blog. It was a modest intervention in a profession accustomed to discussing rather less modest threats. Mert Sarica was starting a security blog; Onal supplied encouragement and direction. Years later, Sarica would credit that help as an important part of his writing career. A useful introduction had acquired a long afterlife.
By February 2023, Sarica was exploring consulting work in the United States. He spoke with Onal, now CEO and co-founder of SOCRadar. The conversation produced a more substantial arrangement: Sarica joined as Head of Strategy. Onal had once helped him find readers. This time, he helped him find his next working home.
The episode gives Onal’s career a human scale. Cybersecurity biographies tend to accumulate acronyms until they resemble a poorly chosen password. Here is something easier to remember: one practitioner encouraged another to explain his work, and the relationship kept developing.
A classroom with a pizza interval
Onal’s earlier public life included the ordinary machinery of a technical community: talks, articles, meetups and people asking how things actually worked. A 2010 announcement for his web application security session listed an admirably concrete agenda. There would be introductions, a pizza party from 7.15 to 7.30, then his talk from 7.35 until 9.
The subjects were less comforting than dinner. How do attackers take over web applications? How do defenders secure them? How do attackers get around the precautions? The evening’s intellectual arrangement gave both sides a turn. Anyone hoping that a security product might settle the matter permanently was in for a long dessert.
His technical background explains the emphasis on mechanisms. A 2014 conference biography listed Linux and UNIX work, network security, audits, forensics and penetration testing across employers including Ford, Avea, Vodafone and Turkcell. It dated his training and consultancy through Bilgi Güvenliği Akademisi to 2008. This was experience gathered around operating systems and networks, where an attractive explanation still has to survive contact with the machine.
That biography also credited him with more than 50 original Turkish technical documents and recognition from Sourcefire for work on Snort intrusion detection. Writing mattered alongside doing. A technical finding can solve one person’s problem; a clear account gives other practitioners a chance to use it.
In a 2010 interview, Onal traced his curiosity to wanting to understand the internet. He described discovering Linux during university and spoke with considerably more animation about networks than about football or politics. His advice to beginners was correspondingly practical: start with TCP/IP and Linux. Fashion could wait until the foundations were in place.
The expensive equipment problem
By 2013, he was publicly discussing a difficulty that survives every equipment refresh: the people needed to run complicated systems. In a filmed interview, he identified trained staff as a central shortfall for public institutions. Spending on security could not make that problem disappear. Someone still had to understand what the tools were doing.
In another interview that March, he drew a distinction among Turkish organizations. Banks, he said, had reached a strong level of security investment; smaller businesses lagged; public institutions occupied the middle. The observation matters to his later story because it placed uneven capability at the center of the discussion. The address on a company’s invoice does not tell an attacker how gently to behave.
Those conversations also show an educator working beyond the classroom. He was translating technical concerns into decisions that institutions could recognize: who can operate this, what does it protect, and where does the gap remain? The vocabulary of purchasing is often much tidier than the reality of defending a network.
A business built around the view outside
SOCRadar was founded in 2019 by Onal and Ahmet Kurukose, its CTO and co-founder. Their product brought several external security functions together: threat intelligence, visibility into exposed digital assets, and protection against digital risks. The organizing idea was to help organizations examine what could be discovered about them from outside.
That perspective creates a different set of questions from an inventory of equipment inside the office. Which internet-facing assets are visible? Where is a brand being imitated? What signs of trouble are circulating beyond a company’s own systems? The company’s extended threat-intelligence platform was designed to connect those views.
In 2023, Onal described the difficulty of persuading smaller businesses that threat intelligence was relevant to them. Free access became part of the response. Letting people try a service gave the explanation something tangible to stand on. There is a resemblance to his earlier teaching: make the first encounter useful enough that someone wants a second.
His partnership with Kurukose belongs at the center of that transition. An educator can explain a problem to a room. A software company has to keep delivering an answer after everyone has gone home. The work now involved a product, an engineering organization and customers whose questions would arrive on their own schedules.
The figures, with dates attached
In March 2023, SOCRadar announced $5 million in Series A funding from 212. The stated uses included building its US business, expanding international sales and marketing, and supporting research. At the time, its free edition was reported to be used by more than 6,000 companies across 150 countries. The free entry point was already reaching well beyond a local practitioner community.
The next announced round, in May 2024, was $25.2 million, led by PeakSpan Capital with participation from Oxx. SOCRadar said it had more than 25,000 freemium customers and over 600 active paid customers. Those are dated company figures, useful as a snapshot of the business at that moment.
Round sizes, not revenue or personal wealth.
The expansion plans included the United States and Europe, managed service providers, and further development of AI capabilities. The work of reaching customers continued into 2026, when SOCRadar introduced a redesigned reseller program and appointed Brian Costello to lead global partnerships. In August, the company announced its second consecutive Inc. 5000 appearance, at No. 542.
The chronology describes a changing executive job. Onal’s public work now includes distribution and partnerships as well as technical explanations. A product has to reach the organizations that might use it. The earlier concern about access has acquired commercial infrastructure, with rather more paperwork than a meetup invitation.
Give the machine a second reader
AI has become a conspicuous part of Onal’s recent work. In August 2025, he discussed SOCRadar’s agentic threat-intelligence approach: automated systems taking on stages of security work while analysts retained decisions. His description included one model generating material and another checking it, followed by review criteria developed with experienced analysts.
“Hallucinations aren’t rare; they’re predictable flaws.”
Huzeyfe Onal, August 2025
He gave phishing analysis as an example, describing a workflow that could compress an hour of switching between tools into about five minutes. That was his account of the system’s performance. The revealing detail is the attention to checking the result. Fast output creates its own work when a convincing mistake arrives dressed as a completed task.
His Black Hat speaker session, titled “Lessons Learned Building AI Agents for Cyber Defense,” covered prompt injection, hallucinations, MCP server security and the risks of excessive automation. The teaching subjects had changed since the web application evening. The interest in how a system can fail remained recognizable.
A smaller experiment at home
Onal’s personal experiments are sometimes less dramatic than the security industry’s preferred vocabulary. He described a growing collection of saved YouTube videos, close to a hundred, that he knew he would never finish watching. The internet had supplied an education and neglected to supply the spare evenings.
He built a workflow around transcripts, specific questions and shorter written explanations. Different prompts produced material suited to different perspectives, including founder, CEO and father. His account is appealingly practical: begin by deciding what you want to learn, then arrange the material around that purpose. A watch-later list is an optimistic object; it makes promises on somebody else’s calendar.
He has also described helping his son make games with AI. The emphasis was on letting the child experiment and enjoy the process, without pressure to produce something. Publishing those games was a proposed next step, a way to make the activity tangible. The episode adds a domestic setting to a familiar interest in helping someone begin.
In another reflection, Onal said he had started giving AI subscriptions to young people instead of the birthday books he once selected. Books still mattered to him; he wanted the gift to encourage questions and learning. It is an unusually specific detail in an executive story. The professional habit follows him into the choice of a present.
Return to the blog in 2009 and the connection becomes easier to see. Across writing, training, company-building and these newer experiments, Onal keeps making opportunities for people to try something with what they know. The ambition at SOCRadar is an earlier warning. The personal habit is an earlier invitation.