Revanth Kumar Lokku

I'm Rev, a computer-science-trained security engineer. My day job is adversarial security validation: emulating real attacker behavior against enterprise environments and finding out whether the controls actually stop it. My nights and weekends go into CyberDen, a segmented cyber range I designed, wired and rebuilt by hand, and into this site, which is where that work gets written down.

I'm less interested in operating security tools than in understanding the systems they protect: how the packets move, where the trust boundaries are, which component made the decision, and what an attacker actually sees.

I did my undergrad in Computer Science and Engineering at SRM Institute of Science and Technology (2021), then came to the US for an MS in Computer Science at UC Riverside (Dec 2022). Cybersecurity became my specialization along the way, but the CS foundation is what I keep returning to: operating systems, networking, compilers and distributed systems. Security failures happen across layers, so I want to be able to reason across all of them.

Before my current role I did R&D / Product Security at Alcon, working on medical-device software (SiMD/SaMD): threat modeling, SAST/DAST and product vulnerability analysis in a regulated environment.

Since 2023 I've worked in healthcare security engineering, centered on breach-and-attack simulation, penetration testing, Active Directory attack paths, and vulnerability validation. The question I get paid to answer is simple to say and hard to prove: if an attacker did this, would we notice, and would it work?

In August 2025 I put Proxmox on a dual-NIC mini PC, stood up a pfSense VM as a gateway, and built my first victim server. The plan was a small attack lab. It didn't stay small.

CyberDen grew into a multi-node environment: a Dell PowerEdge T320 core server, two mini-PC Proxmox nodes, a managed switch, pfSense at the edge, VyOS as the core router, and a segmentation plan modeled on real enterprise trust zones (SOC, AD, DevSecOps, vulnerable apps, AI, storage and more). It runs a SOC/CTI stack, a k3s DevSecOps platform, a vulnerable-application lab, and a GPU node for local AI.

Most of what I know about networking, I learned from breaking this network. The writeups on this site are mostly the story of those breaks.

In March 2025 I was reading about scalable AI architecture: hexagonal designs where the core business logic is decoupled from the services, adapters and frameworks around it. That raised a security question I couldn't let go of. What happens when AI is wired straight into the core logic and data, with nothing in between? A single compromised component becomes the whole system: no boundary to inspect, no record of what the AI touched, and no way to prove what it did.

That idea, that AI needs to be decoupled, bounded and accountable, became the name. The product thinking it started is still in development and stays private for now. The name is the mission statement.

I learn hands-on, foundation to mastery: learn the theory, build it, break it, observe it, repair it, document it, automate it. I don't stop at "which command works". I want to know why it works, which layer is responsible, and what failed.

This site tracks that in public. Each pillar (Security Engineering, Computer Science, AI Security, AI/ML, Beyond CS) has lanes, and every lane is meant to produce something you can inspect: a writeup, a repo, a lab, a diagram. The timer on the home page is my accountability clock.