RemoteThreat Adds Three of Offensive Security's Most Respected Practitioners

OWASP Top 10 for LLM Applications founder Ads Dawson, Loki C2 creator Bobby Cooke, and former IBM X-Force Red adversary simulation leader Dave Cossa join soon after RemoteThreat expanded its executive team and weeks after it emerged from stealth with the O/C/O Platform

FULTON, Md., Nov. 12, 2026 /PRNewswire/ -- RemoteThreat, the AI-enabled offensive cyber operations company, today announced that Ads Dawson, Bobby Cooke, and Dave Cossa have joined the company as Founding AI Security Researcher, Head of Capability Research and Development, and Research Engineer, respectively. The three are among the most widely recognized practitioners in offensive security, with dozens of public tools and exploits, and research presented at Black Hat, DEF CON, OAIC, and RSA Conference. They join a team founded by Chris Thompson, the former head of IBM X-Force Red and Adversary Services, one of the most respected red teams in the world, and Shawn Jones, the former Head of Capability Research and Development for IBM X-Force Adversary Services, and an operator bench that already includes Dylan Tran, Dwight Hohnstein, and Chris Spehn, veterans of IBM X-Force Adversary Services, SpecterOps, Mandiant, and other leaders in the space.

The hires bring RemoteThreat's senior additions to five this month and follow the company's emergence from stealth with $7 million in pre-seed funding led by Osage University Partners and DataTribe. Dawson, Cooke, and Cossa will drive offensive capability development, AI-enabled research, and adversary tradecraft for the O/C/O Platform.

Red teams today assemble operations from a patchwork of commercial and open-source tools: one vendor's C2, another's loader, separate evasion pipelines, hand-built infrastructure, and scripts stitched together for every engagement. The O/C/O Platform replaces that patchwork with the first commercial, fully integrated, end-to-end platform for offensive cyber operations, bringing mission planning, native command-and-control, implants, initial-access frameworks, advanced capabilities, obfuscation pipelines, analysis engines, and AI-assisted operation into one operational picture. Built by operators who ran these engagements against the world's largest banks, critical infrastructure, and defense programs, the platform lets enterprise red teams emulate adversaries that are evolving faster than the tools built to model them, and lets U.S. government mission teams and vetted defense partners operate at mission speed.

"There is a short list of people in this industry whose work other operators actually run, study, and build on. Ads, Bobby, and Dave are on it, and each of them could have gone anywhere," said Chris Thompson, Co-Founder and CEO of RemoteThreat. "They chose a company that is weeks out of stealth because we showed them the O/C/O Platform and they recognized it as the thing this industry has been missing. Offensive operations have run on borrowed and bolted-together tooling for twenty years. We are ending that, and the best practitioners in the world want to be part of it. RemoteThreat is offensive by nature. That is why they are here."

Ads Dawson, Founding AI Security Researcher

Ads Dawson is an offensive security specialist with more than 13 years pushing the industry on automation and AI in offensive operations. He founded the OWASP Top 10 for LLM Applications, holds five CVEs, is the lead author for the StealthBench AI security benchmark, and has run AI red team operations for government, enterprise, and frontier model providers while at Dreadnode, BT6, and Cohere. His research has been presented at Black Hat, DEF CON, OAIC, and RSA Conference, and he currently sits at the top of HackerOne's 2026 leaderboard for the United States.

Prior to RemoteThreat, Dawson held AI security research roles at Dreadnode and Cohere, where he evaluated frontier AI systems, developed autonomous offensive capabilities, and conducted AI red team operations for government and enterprise organizations. His expertise spans AI security, machine learning, AI red teaming, web application security, black-box testing, and offensive capability development.

At RemoteThreat, Dawson leads AI security research for the O/C/O Platform. AI handles the scale. Operators keep the intent, critical decisions, and the governance of operations.

"Most of the industry is still debating whether AI will change offensive operations. The operators I respect are already using it, and the adversaries certainly are," said Dawson. "RemoteThreat is one of the few places where AI research sits inside a real offensive operations platform rather than next to it. That is the environment you need if you want to build capabilities that hold up against what is coming."

Bobby Cooke, Head of Capability Research and Development

Bobby Cooke is a seasoned red team operator specializing in command-and-control (C2), post-exploitation tooling, and initial access. He joins RemoteThreat from IBM X-Force Red, where he served as a Red Team Operator and Offensive Capabilities Developer on the Adversary Services team. Alongside Shawn Jones, he developed and managed the team's internal evasive C2 and developed initial access payloads supplied to the team through Chris Spehn's CICD pipeline. Before IBM, he was a red team operator at Trustwave Spiderlabs and held security roles at Humana and Privoro.

Throughout his red teaming career, Cooke, together with teammates such as Ellis Springe and Dwight Hohnstein, has tested the defenses of some of the world's most capable security teams at Fortune 500 companies with substantial security investments. These full-scope engagements have spanned open-source intelligence (OSINT), external attack surface reconnaissance and penetration, phishing, and internal objectives such as compromising mainframes, production cloud environments, and critical manufacturing systems. Together, they have achieved a high success rate in gaining initial access from the internet and accomplishing engagement objectives without detection or reliance on client-provisioned access.

Cooke's public open-source work is used by red teams around the world. He created Loki C2 with Dylan Tran, a C2 leveraging popular Electron applications to evade EDR and bypass application controls, BokuLoader, a widely adopted Cobalt Strike reflective loader, and TokenTactics with Steve Borosh, a widely adopted Microsoft device code phishing tool used for initial access. He has published many popular technical red team blogs, post-exploitation tools, exploits, and initial access payloads. His work has been featured in Hack the Box, DEFCON Red Team Village, Offensive Security Proving Grounds, Forbes, Cobalt Strike Community Kit, Sliver Armory, and in popular YouTube videos by John Hammond and Ippsec.

At RemoteThreat, Cooke focuses on C2, post-exploitation tooling, and initial access for the O/C/O Platform, putting advanced evasive capabilities in the hands of red teamers to simulate the most sophisticated adversaries against modern defenses.

"Early in my career, I spent a lot of time developing commercial C2 modifications like BokuLoader, but EDR vendors eventually catch up and snipe everyone using them, so I started building my own C2s. I've used them exclusively for years to evade detection and hit objectives faster," said Cooke. "I'm all in on the RemoteThreat O/C/O platform. With AI advancing so quickly, red teamers need a new C2 and arsenal to keep pace with evolving defenses. We're building a next-generation platform that works both as a traditional C2 and as a system your AI agent can steer, with mutation build pipelines, new initial access payloads, expanded post-ex capabilities, and multiple implant options. Anyone who's red teamed knows how much time it takes to stand up infrastructure, redirectors, and custom tooling; we're solving that so operators can focus on operating. This is exactly the C2 I'd want on a real engagement, and that's why I'm stoked to be building it with this team."

Dave Cossa, Research Engineer

Dave Cossa is a red team operator and security researcher with more than a decade of professional offensive security experience spanning penetration testing, adversary simulation, and offensive capability development. Prior to joining RemoteThreat, he served as a Senior Managing Consultant on IBM X-Force Red's Adversary Simulation team, where his work combined leading complex multi-month red team assessments with offensive security research and tooling development. Previously, at RSM, he led teams of consultants, helped develop new offensive security service offerings, and delivered highly technical engagements.

Much of his research and development focuses on Microsoft technologies, particularly Active Directory and Azure. At X-Force Red, he applied this expertise to develop the core post-exploitation tooling used by the Adversary Simulation team. His publicly released work includes technical articles on Azure Arc, Microsoft Configuration Manager (SCCM), and .NET internals, as well as offensive security tools.

At RemoteThreat, Cossa applies his extensive experience in real-world adversary simulation and offensive tooling development to build innovative capabilities and help organizations better understand, emulate, and defend against modern adversaries.

"The opportunity to build new and better offensive capabilities is always exciting, but what really interests me is what becomes possible when you bring all of that tooling together and organize the information it collects around a shared data model," said Cossa . "Being able to use AI to correlate that information across disparate sources and stages of an engagement to identify connections that even experienced operators may miss opens up some really interesting possibilities."

Offensive by Nature

Dawson, Cooke, and Cossa join a team that was already best in class. RemoteThreat's existing operators and researchers include Dwight Hohnstein, Chris Spehn, and Dylan Tran, who came to the company from IBM X-Force Adversary Services, SpecterOps, Mandiant, and other leading offensive security organizations, and who bring years of experience running adversary simulation engagements and building the capabilities those engagements depend on.

RemoteThreat's founding premise is that the people best equipped to build offensive tooling are the ones who have run offensive operations, and that the best operators will choose the company that lets them do both. Every capability in the O/C/O Platform traces back to a requirement an operator hit on a live engagement, and the research team publishes, presents, and ships against real adversary tradecraft rather than compliance checklists. That is what "offensive by nature" means in practice, and it is why the company has drawn five senior hires from IBM X-Force Red, Bugcrowd, Dreadnode, and SOCRadar in its first weeks out of stealth.

"Offensive by nature is not a tagline for us. It describes who we hire and how we build," said Shawn Jones, Co-Founder and CTO of RemoteThreat. "Ads, Bobby, and Dave have each changed how this industry does offensive work, and they are here because they want to keep doing it at a level most companies cannot support. Give operators like that a platform built for the way they actually work, and you get a team that outpaces the adversary."

Thompson, Co-Founder and CEO, is the former head of IBM X-Force Adversary Services. Over 23 years he ran red team operations against defense contractors, nuclear power plants, critical industries, and many of the world's largest banks and financial services firms, and at X-Force he founded, grew, and led world-class teams of red team operators, offensive engineers, and security researchers. His background also includes contract Computer Network Exploitation (CNE) work for government defense partners. He serves on the Black Hat USA Review Board and founded Offensive AI Con (OAIC). Jones, Co-Founder and CTO, brings more than 20 years in offensive security and advanced capability development. As a member of IBM X-Force's Adversary Simulation team, he served as Head of Capability R&D and as a Red Team Operator, and he is the lead architect of the O/C/O Platform.

Since emerging from stealth, RemoteThreat has announced $7 million in pre-seed funding led by Osage University Partners and DataTribe, a strategic advisory partnership with The Nakasone Group, founded by retired four-star U.S. Army General Paul M. Nakasone, membership in USSOCOM's Special Operations Forces Rapid Acquisition Consortium for Emerging Requirements (SOF RACER), a capability integration partnership with Talon Defense, a strategic partnership with Hack the Box, and the October 22 appointments of Joe Castellanos as Vice President of Product and Taylor Pettis as Vice President of Marketing. The company continues to hire senior operators, researchers, and engineers across its offensive capability, platform, and go-to-market teams.

The O/C/O Platform is available now to qualified enterprise, U.S. government, and vetted defense industry customers. To request access, schedule a briefing, or explore open roles, visit remotethreat.com.

About RemoteThreat

RemoteThreat is the offensive cyber operations platform. Built by experienced offensive operators for internal red teams and defense industry partners, it combines deep capability, precise control, and human-machine operation at mission speed. RemoteThreat. The O/C/O Platform. Learn more at remotethreat.com.

SOURCE RemoteThreat