Penetration tester with hands-on frontier AI experience, and a builder of my own tools.
I'm Aaron Moorcroft, known online as CyberZombi3. Away from the keyboard I'm a dad of two, and that always comes first. Professionally, I'm a security researcher and penetration tester. My day-to-day headspace is offensive security: enumeration, exploitation, and working out how an attacker would actually get in. Everything else on this site grows out of that. I build my own recon tooling because I've felt the pain of doing it by hand, and I build AI agents because I want them handling the repetitive parts of a pentest, not because I set out to be a software engineer. To be upfront about it: most of what you'll find here was built with AI coding tools. I come up with the idea, design it, steer it, test it and decide what it should do next, and the AI writes most of the code.
Outside of hands-on pentesting work, I like understanding systems all the way down to the metal, which is why I've also vibe coded an operating system from scratch with AI, and why I run my own home SOC lab to see attacks from the defender's side as well as the attacker's.
Part of my work sits where penetration testing meets frontier AI. On that side I use the newest models in real offensive security work, with harnesses built around them: scope enforced in code before the model gets control, findings verified with command output rather than taken on trust, and a human approving every command it wants to run.
Part of that is hands-on work with non-public and pre-release models, including OpenAI's Daybreak Red. The others I can't name here. Working with models before they are released shows you quickly where they are genuinely capable on an engagement, where their claims need checking, and what guardrails have to be in place before one goes anywhere near a real network.
A few of my projects are AI tools in their own right: APT Pro, an AI pentesting platform that verifies every finding with evidence; my pentest harnesses, which turn a written methodology into executable skills for an agent; and CDMF, a detect-and-mitigate loop with an agent attacking its own fixes. Most of the rest, from CyberOS to the games, have nothing to do with AI models at all.
Penetration testing & offensive security. Hands-on enumeration, exploitation, and reporting, sharpened through structured training and a lot of lab boxes. The same instincts that drive that work are what led me to build my own recon tooling instead of relying purely on off-the-shelf scripts.
AI agents for security work. I'm far more interested in agents that take real, verifiable actions than in chatbots. My AI Pentest Agent plans and runs its own enumeration against a target; JARVIS is a fully local voice assistant that controls my Mac directly with no cloud round-trip; and Agent Commerce is a multi-agent pipeline where nine separate agents hand work off to each other to take a product from an idea to a finished listing. Local models (Ollama/Gemma, DeepSeek, Whisper) by default, with Claude as an optional upgrade where quality matters more than running fully offline.
Blue team / detection engineering. A self-hosted SOC lab combining a SIEM, IDS, honeypot, and threat-intel stack to practice detection and incident response from the defender's side.
Systems projects. Low-level work including a custom x86 operating system built from scratch with AI: bootloader, protected mode, a window manager, and networking.
iOS apps & games. Built with AI, usually with a cyberpunk aesthetic and a lot of attention paid to feel and feedback (haptics, sound, animation).
I've been a professional Penetration Tester at Vodafone Group UK since 2022, scoping and running infrastructure and web application tests, delivering the findings and CVSS scoring back to the business, and coordinating third-party pentest suppliers alongside the secure-by-design team.
Before that, I spent five years as a Cyber Security Operational Analyst at ReAssure, working blue team and purple team: building out SIEM capability with Splunk, running vulnerability management with Nessus, building a detection framework against the MITRE ATT&CK model, and running purple team exercises alongside an external pentest partner. And before that, over a decade in IT infrastructure and 3rd-line engineering across Windows Server, VDI, messaging and service desk, which is exactly the hands-on systems background that still shows up in projects like CyberOS and the SOC Lab today.
Alongside those, I've worked through a long list of additional offensive security training: SANS 560 & 504, OffSec's PEN-200 and WEB-200, Mandiant's Creative Red Teaming and Windows Enterprise Incident Response courses, TCM Security's Practical Ethical Hacker and OSINT Fundamentals, and VHL's Virtual Hacking Labs. I'm currently working towards Zeropoint Security's RTO.
This site is where I write up the projects I build, how they work, and what I learned putting them together. It's updated whenever something new is worth sharing.
Best way to reach me is email, whether it is about AI penetration testing, building pentest tooling, or one of the projects here. Links to my other profiles are below and in the footer.