To add some context to the discussion, OffSec was acquired by Leeds Equity Partners in October 2024.


NEW YORK, Oct. 15, 2024 /PRNewswire/ -- Leeds Equity Partners ("Leeds Equity") announced today that it has acquired OffSec (the "Company"), the leading provider of continuous cybersecurity workforce development training and professional education for cybersecurity practitioners from Spectrum Equity. Terms of the transaction were not disclosed.

OffSec has been setting the standard in cybersecurity training for over 15 years, offering practical, hands-on skills development through a proprietary learning platform that includes thousands of hours of content, more than 4,000 labs, and 12 industry-standard certifications. The Company's certifications are globally recognized by employers and cybersecurity practitioners for their rigor and relevance for the most critical cybersecurity roles.

The acquisition of OffSec builds upon Leeds Equity's deep experience and investment track record in vertical training and professional development, as well as IT certifications and cybersecurity data and technology solutions.

"The cybersecurity landscape is rapidly evolving, and our investment in OffSec reflects our belief that the future of cybersecurity protection depends on ongoing, practical education and preparedness within the workforce. We are proud to partner with the OffSec team as it equips individuals and organizations with the knowledge and skills to combat increasingly sophisticated cyber threats," said Jacques Galante, Partner of Leeds Equity.

"Leeds Equity has a longstanding track record of successfully partnering with providers of specialized training and education, including strong domain expertise within the cybersecurity sector," said Ning Wang, Chief Executive Officer of OffSec. "We are thrilled to have them as our partner during this next phase of growth as we continue to expand our enterprise customer relationships and invest in new content, technology, and education solutions for our global community of learners and practitioners."

"The talent shortage and widening skills gap within cybersecurity are among the most pressing issues facing global enterprises," said Kevin Malone, Managing Director of Leeds Equity. "We are excited to partner with Ning and the entire OffSec team as they address these urgent challenges, enabling professionals and enterprises to safeguard critical systems."

Reed Smith served as legal counsel to Leeds Equity Partners and J.P. Morgan served as financial advisor to OffSec.

About Leeds Equity Partners:

Leeds Equity is a New York-based private equity firm dedicated exclusively to partnering with management teams in the education, training, and information services industries (the "Knowledge Industries"). The firm was founded in 1993 and currently manages approximately $5 billion of capital across a broad spectrum of companies within the Knowledge Industries. Leeds Equity seeks to leverage its sector-focused expertise and market insights to create long-term value for its partner companies and investors. For additional information on Leeds Equity Partners, see http://www.leedsequity.com/.

About OffSec:

OffSec is the leading provider of continuous professional and workforce development, training, and education for cybersecurity practitioners empowering individuals and organizations to build cyber resilience and combat cyber threats. OffSec's distinct pedagogy and practical, hands-on learning help organizations fill the information security talent gap by training teams on today's most critical skills. OffSec also funds and maintains Kali Linux, the leading operating system for penetration testing, ethical hacking, and network security assessments. For more information, visit https://www.offsec.com/.

Emmanuel Phakula Mandala said:

@Chukwunwike_Ndukaji it has been finally resolved on your side?

Click to expand...

Yes it has. Got the email shortly before I posted the update. Check your company email, or your CIN account details to see if the email was updated

Chukwunwike_Ndukaji said:

Hey @Stephen Schneiter. Just saw the change effected. Thanks a bunch

Click to expand...

@Chukwunwike_Ndukaji it has been finally resolved on your side?

Chukwunwike_Ndukaji said:

Greetings @Stephen Schneiter. Great to see @Emmanuel Phakula Mandala account will be resolved soon. I would like also to follow up regarding my similar request to update my email for my CIN membership. Thanks.

Click to expand...

Hey @Stephen Schneiter. Just saw the change effected. Thanks a bunch

Tess Sluijter said:

Definitely look into using WireShark. In my workshop, I've used it to demonstrate both the TLS1.2 and TLS1.3 handshakes.

It's also a fun tool to perform debugging on intentionally broken TLS setups. That's what I've done for that workshop: create containerized mini applications which intentionally have a broken TLS-implementation for the students to debug.

Click to expand...

Thank you so much for your suggestion! WireSharK looks like a great tool for demonstrating the process behind the TLS handshakes. I also find it entertaining to think about employing containerized mini applications for debugging purposes; that seems like a great way to practice. I will incorporate it.

Sad to hear. If Companies start to see the Certification Business as a Business Division (and not to support their Products), that as to make their own Revenue and be cost effective, that the quality of Courseware or the Certification starts to looks desecending..
We will have to see.
But for me, Courseware Quality decreased in a high degree in the last years. Compared to like ten or fifteen years ago..
Will be prices going up again for the Certs? Courseware will be increased?

What does this mean for CIN? Since that is no longer practically part of the CompTIA Main Business? What is left from CompTIA afterwards as Organization?
The Future will show.

How can I effectively demonstrate the entire SSL/TLS verification process in class, including checking the certificate’s revocation status?

Are there any additional tools or techniques you recommend for teaching about certificate verification and the role of CAs in ensuring secure communications?

Click to expand...

Definitely look into using WireShark. In my workshop, I've used it to demonstrate both the TLS1.2 and TLS1.3 handshakes.

It's also a fun tool to perform debugging on intentionally broken TLS setups. That's what I've done for that workshop: create containerized mini applications which intentionally have a broken TLS-implementation for the students to debug.

Greg Porter said:

a) Live Webinar
b) Training course

For the purpose of re-certification CE credits?

Thanks for your attention to this matter

Click to expand...

Neither. Like Rick said, they are Preparation Courses for Trainers, that want and Update / Intro about the Course Content and how it my be presented.
That may also depend on the TTT how deep it goes. But the TTT does not prepare so well for an Exam nor is a complete Course. So its Intent is for Trainers. Not students.

Tess Sluijter said:

It's a shame I made it as work-for-hire for a past client, because I once made a 3h workshop about understanding and troubleshooting TLS. It included everything you're asking for and more.

But... since it was work-for-hire, the IP lies with the customer. I'd have to completely recreate it, which I just don't have time for.

Click to expand...

Ooh I understand the situation. If you have any key points or topics you think would be valuable to include, I can start drafting something based on that. Your insights would be greatly appreciated.

Rick Butler said:

So, what's left of CompTIA? - That's what I'm kind of perplexed about.

Click to expand...

As @drushtx mentions over here -> Login to view embedded media
There's a whole lobbying part to CompTIA.

precious said:

Thanks for the suggestion @Eugene! I think creating a step-by-step guide or even recording a video on using the command prompt for OpenSSL and TLS certificate verification would be a great way to help everyone learn more effectively. It would cover verifying certificates, checking protocol versions, and ensuring secure connections. We could collaborate on this or You/I can put together a draft and we can refine it together. Let me know what you think!

Click to expand...

It's a shame I made it as work-for-hire for a past client, because I once made a 3h workshop about understanding and troubleshooting TLS. It included everything you're asking for and more.

But... since it was work-for-hire, the IP lies with the customer. I'd have to completely recreate it, which I just don't have time for.

It's literally a year later and finally it seems the CDN issues are gone. I can now properly browse CIN again without using a proxy.

Definitely keeping an eye on this thread.

I can also say that I'm just about done with CompTIA in general.

• Increasing costs over the years and subpar quality on some exams and learning materials is edging people closer to the thermocline of trust ( https://nitter.poast.org/garius/status/1588115310124539904 ). And some of the upcoming changes might push people over the edge.
  
  
• The value proposition of CompTIA certifications has generally been limited in the EU / Europe.
  
  
• Recent trends of hostility and cheating in online study groups, like /r/comptia and its associated Discord. The one gets more and more people willing to get a cert whatever-it-takes (so cheat), the latter I left after right-wing diatribe created a hostile learning environment for foreigners and minorities.

Now, I always say "be the change you want to see in this world" and I certainly am trying. But really, I can do only so much.

If the public's perception is that CompTIA don't do much to protect their IP and the value of their certifications (by combating YouTube channels who knowingly share dumps), then what can we the individual trainers do? I know the exam fraud team are working hard, but the public perception is slowly becoming "everybody's cheating, so I'd better too!" or "this CompTIA stuff is way too expensive, I'd better cheat to pass the first time".

These investment firms sure jumped in at an interesting time, what with more students being disgruntled with the product.

If CompTIA want to prevent dropping off that thermocline of trust, they'd better act NOW. Because generally speaking there's no crawling back (seriously, read that rolled up Nitter/Twitter feed).

Gregory Childers said:

We may have to agree to disagree. I have more faith in a certification organization being run as a non-profit than as a for-profit entity.

For-profit organizations are more concerned about the bottom line than the mission. Non-profits are more concerned with the mission than the bottom line.

In my experience.

Click to expand...

I tend to agree with Greg here. CompTIA got its start as a neutral body, the Association of Better Computer Dealers, "a group of hardware and software vendors to encourage collaboration between vendors and their customers." Getting into certification in the early '90s, CompTIA's strength, I believe, is in its neutrality.

Neutrality gives CompTIA a good deal of ability to "say the quiet part out loud". When money comes into it, well...

The big question that we all are now going to ponder here is whether HIG/TB are going to maintain that level of industry neutrality upon which the industry relies to validate the skills of professionals in a trustworthy way.

Bradley Haynes said:

The item I noticed was that this acquisition will be run as a for profit entity. I feel this is good news for instructors and educators since an investment company sees opportunity with the CompTIA brand. The training industry is going through a big transformation, maybe more to follow?

Click to expand...

We may have to agree to disagree. I have more faith in a certification organization being run as a non-profit than as a for-profit entity.

For-profit organizations are more concerned about the bottom line than the mission. Non-profits are more concerned with the mission than the bottom line.

In my experience.

Greg Porter said:

Thanks. Save me having to redo things

Click to expand...

Glad I could assist.

BrianFord said:

What Rick said.

Click to expand...

That means, I get all your 'likes'.

/r

I started this Monday ritual a couple of years ago. If there is a Monday holiday, it shifts to Tuesday morning.

The first thing I do is check for any updates to the software I use on my business systems. That's Windows 10 and 11 Pro AND a list of applications that I rely on. I also check my cloud accounts at AWS, Google, and Azure (in that order). The next thing I do is look at the NVD dashboard at https://nvd.nist.gov/general/nvd-dashboard.

Some students have asked why I look at the NVD early in the week since the site reports the number of CVEs filed weekly. I'm focused on 'This Month,' 'Last Month,' and 'This Year' data. I view the daily or weekly data as insignificant because it fluctuates wildly. I also look at the 'Last 20 scored..' data to see if any of the software or solutions I use have recently posted or updated CVEs.

My next stop is the KEV Catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog . The Known Exploited Vulnerabilities Catalog is an intel data source that didn't make the Security+ SY0-701 objective cut (much to my disappointment). The KEV Catalog is an extremely valuable tool to identify what vulnerabilities threat actors are using now.

I maintain a list of software I use in a spreadsheet (with the Support URL and end date if the software is licensed) and keep telling myself that I should spend the time to automate this process. I haven't gotten around to that yet.

So, my long answer to Professor Chandler's question about the top cyber threats is 'the ones that can hurt me.'

The item I noticed was that this acquisition will be run as a for profit entity. I feel this is good news for instructors and educators since an investment company sees opportunity with the CompTIA brand. The training industry is going through a big transformation, maybe more to follow?

What Rick said.

Another low hanging fruit approach is creating interactive PowerPoint presentations in where students choose the correct options to move ahead. I've created some of these for lessons and have received positive feedback from my students. Just a thought and I want to add that I like to see teachers/instructors thinking of ways to create interactive lesson plans. This is a great way to teach students who learn by doing. Whatever you decide to do please share with us, thank you.

Thanks. Save me having to redo things

Trevor Chandler said:

Hey Mr. Butler, what did Lee ever do to you

Click to expand...

Not a thing! But Lee does like to frequent places like Defcon and Blackhat.

Meanwhile, I've acquired a Flipper Zero of my own...for...research purposes...