There is a genre of person who is very good at breaking into things, and a much smaller genre of person who is very good at breaking into things and then telling you, politely, how they did it and how much you should pay to make it stop. Min Pyo Hong is the second kind. He spent roughly 25 years as a white-hat hacker, reached the finals of the DEFCON Capture the Flag competition - the closest thing hacking has to the Olympics - five years in a row, and previously built and sold a mobile security company called SHIFTWORKS. In late 2012 he started SEWORKS in Seoul, and in 2013 he moved it to San Francisco, on the reasonable theory that the customers were closer to Silicon Valley than to anywhere else.
The premise of SEWORKS is a little uncomfortable when you say it out loud, which is part of why it works. Security software is mostly sold as defense - firewalls, scanners, the digital equivalent of stronger locks. SEWORKS sells the opposite point of view. Its tagline is "see your software the way an attacker does," and the products are all attempts to answer the question a defender is least equipped to answer on their own: how would someone actually break this? It turns out that is a genuinely hard thing to know about your own code, because you built the code to work, not to fail, and the failure modes are exactly the parts you weren't thinking about.
"Pentoma delivers results of web penetration tests much faster than human pen testers."
- John S. Kim, CEO, Sendbird
The scaling problem, and the AI answer
Penetration testing has a structural flaw as a business: it does not scale. A good pen tester is a scarce, expensive human who is booked out for months, and every engagement starts more or less from scratch. If your security process depends on that person, what you have is not a moat but a queue. SEWORKS looked at the queue and did the sensible thing - it tried to automate the mechanical 80% of the work and reserve the humans for the interesting 20%. The result, launched at Mobile World Congress in 2018, is Pentoma, an AI-driven penetration-testing service running on the company's proprietary GAMAN engine. Pentoma pokes at web applications, APIs, source code, and now AI systems the way an attacker would, then has human experts validate what it finds so the report is something an auditor will actually accept.
This is the whole thesis of the modern AI wave compressed into one product. The frontier is not replacing human creativity; it is replacing the parts of expert work that were always mechanical and tedious. Finding an SQL injection vector for the ten-thousandth time is not creative. Deciding which of a hundred findings actually matters still is. SEWORKS drew the line there.
The rest of the arsenal
Pentoma is the headline act, but SEWORKS runs a small catalog. AppSolid, its older product, hardens mobile apps against reverse engineering and tampering - built on the honest and slightly grim assumption that your app is running on a phone the attacker fully controls. LeakJar answers a question almost no company can answer about itself: how many of your users are logging in with a password that has already leaked in some breach dump somewhere? Using k-anonymity, it screens credentials at sign-up, login, and reset without ever handling the raw passwords. And because security work eventually collides with compliance, SEWORKS became a Drata Authorized Reseller and now packages SOC 2 and ISO 27001 certification support, pairing automated evidence-gathering with real pen tests to compress the timeline to a few months.
None of this is magic, and SEWORKS mostly avoids pretending it is. What it sells is a point of view - that the best way to defend software is to first attack it honestly - packaged so that a company without a five-time DEFCON finalist on staff can rent one anyway. The advisory board, which includes a former CIA senior intelligence officer and the founder of ZecOps and Zimperium, is there for the same reason: when your product is offensive security, you want people who have done the hard version of the job.
