nullsector/miguel-zabala es en

visitor@nullsector:~$ whoami

Miguel Zabala

Founder & CEO @Xpectra.ai · Offensive Security Engineer · OSCE³

11 years breaking systems before someone without permission does. Today I run Xpectra.ai, where AI agents do the mechanical work of a pentest and experts validate every finding.

→ let's talk meet xpectra linkedin ↗ youtube ↗
years in security
11years in security
certifications
7certifications
CVEs rebuilt
4CVEs rebuilt
countries
3countries
01

Xpectra.ai

founder & ceo · since 2024

The depth of a pentest, at the speed of a scanner.

Six AI agents trained on offensive methodology and supervised by experts find, exploit and validate a company's weaknesses in hours. All processing is local: client data never reaches third-party APIs.

organizations served
24organizations served
countries: MX · CO · CL · ES
4countries: MX · CO · CL · ES
validated vulnerabilities
1,543validated vulnerabilities
visit xpectra.ai ↗ the lab behind it

Figures published by xpectra.ai.

xpectra — run6 agents + 1 human

$ xpectra run --target app.client.com

  1. [coordinator]plan and rules of engagementok
  2. [architect]attack surface and stackok
  3. [pentester]controlled exploitationok
  4. [analyst]false positives removedok
  5. [reporting]technical report es / enok
  6. [executive]business impactok
  7. [expert]OSCE³ human reviewok

✓ validated findings · in hours, not weeks

02

Experience

cat experience.log
  1. 2024 — present Founder & CEO @ Xpectra.ai ↗ founder Pentesting with AI agents supervised by experts: the depth of a pentest at the speed of a scanner. LATAM · ES
  2. 2023 — present Penetration Tester @ Aiuken Cybersecurity Infrastructure and web application pentesting, red teaming and custom exploits. Remote · CO
  3. 2022 Security Consultant @ CSIS Security Group A/S Offensive security consulting and research on emerging threats. Copenhagen · DK
  4. 2019 — 2021 Penetration Tester @ Mnemo Advanced penetration testing, threat simulation and red team exercises. Madrid · ES
  5. 2018 — 2019 Ethical Hacker @ Entelgy Web application security, code review and technical reporting. Bogotá · CO
  6. 2017 — 2018 Ethical Hacker @ Newnet S.A. Vulnerability assessment and intrusion testing. Bogotá · CO
  7. 2015 — 2017 CISO @ Colombian Outsourcing Solutions Risk management, IT audit, incident response and team training. Bogotá · CO

certifications

  • OSCE³ OSWE + OSED + OSEP
  • OSEP OffSec Experienced Penetration Tester
  • OSWE OffSec Web Expert
  • OSED OffSec Exploit Developer
  • OSCP OffSec Certified Professional
  • OSWP OffSec Wireless Professional
  • CEHv9 Certified Ethical Hacker v9
03

Research

ls -l ./lab

Autonomous Research Lab: AI agents rebuild real CVEs in an isolated lab. It is the open testbed for what later ships in Xpectra.

004 GitLab CE/EE unauthenticated file read in the commits API CVSS 10.0 CVE-2026-85706 ▶ 4:18 003 PaperCut NG/MF from an authentication bypass to loading any class you name CVSS 9.4 CVE-2026-82078 ▶ 2:12 002 Gitea diffpatch code execution from an account without administrator privileges CVSS 9.8 CVE-2026-60004 ▶ 2:11 001 Zimbra command injection in the zimbra-snmp SNMP notification CVSS 8.9 CVE-2026-73570 dossier

in-house tools

RGS · Report Generative Security Tool Audit reports written by an LLM that runs on your own machine. NVIDIA mention iPhish Agent Authorized phishing simulations with an agent that never leaves the local machine. 2026-07 WP2Shell Checker WordPress version read against CVE-2026-60137 and CVE-2026-63030. 2026-07 Pentest-MCP Pentesting tools exposed to an LLM over MCP and REST, each one in its own container. 2025-11

the whole lab →

04

Contact

~/contactreply < 24 business hours · es / en

you@nullsector:~$ mail miguel

[email protected]

Collaborations, talks, press or research: write to me.

Need a pentest or a vulnerability assessment? Request it at Xpectra.ai ↗

send an email xpectra.ai ↗ linkedin ↗