Marcello Duarte, Cybersecurity Consultant

About

Marcello Duarte is a cybersecurity consultant at Radical Security. He works directly with organizations to find their weaknesses before attackers do, and to turn security requirements — whether driven by customers, regulators or insurers — into concrete, achievable plans.

His career spans both sides of the discipline: finding vulnerabilities as a researcher, and helping organizations fix them as a consultant. That combination shapes how he works — findings come with an attacker's understanding of how they'd actually be exploited, and recommendations come with a practitioner's understanding of what a real team can implement.

Vulnerability research

Before moving into consulting, Marcello worked in vulnerability research. His most notable published finding is CVE-2015-7392: a remote heap buffer overflow in the JSON parser of FreeSWITCH. He disclosed it on the Bugtraq mailing list in September 2015.

The finding was significant enough that Tenable's research team independently re-analyzed it and published their own advisory, TRA-2015-05 — showing the original patch was incomplete, documenting additional remote exploitation vectors (including an unauthenticated UDP path), and driving the complete fix in FreeSWITCH 1.4.26 and 1.6.5.

Consulting focus

Marcello's consulting work covers the full cycle of finding and fixing security weaknesses:

• Penetration testing — web applications, networks, APIs and mobile apps, tested the way an attacker would approach them.
• Vulnerability management — building programs that prioritize by real exploitability rather than raw CVSS scores.
• Secure code review — manual review that catches the business-logic and injection flaws scanners miss.
• Risk assessments — identifying what actually matters before money gets spent on controls.
• Virtual CISO — ongoing security leadership for organizations that aren't ready for a full-time hire.

Much of his work centers on compliance-driven security: helping clients meet frameworks such as PCI DSS, SOC 2, ISO 27001 and HIPAA without losing sight of the actual risks those frameworks are meant to address.

How he works

Marcello's approach is practical. Engagements start with a written scope and a fixed price, findings come with clear remediation steps rather than a wall of scanner output, and clients pay only once the work is complete — every engagement is backed by Radical Security's 100% money-back guarantee.

Most of his clients are long-term relationships: security and IT leaders who first worked with him at one company and brought him in again when they moved to the next. Radical Security doesn't cold call and doesn't ask for money up front — you can read the details on the How We Work page.

Writing and publications

Marcello is the author of the Radical Security blog, where he writes about vulnerability management, PCI DSS, compliance frameworks, secure code review and the practical steps organizations can take to strengthen their security posture. Selected pieces:

• CVE-2015-7392: The FreeSWITCH JSON Heap Overflow I Disclosed — the story of his vulnerability research and Tenable's follow-up.
• No Upfront Payment, No Cold Calls: How Radical Security Works — the business model behind his client relationships.
• Spotting Injection Vulnerabilities in Code Review — tracing sources to sinks, with real code examples.

Work with Marcello

To work with Marcello, email [email protected] and tell him what you need tested, assessed or fixed. Engagements start with a written scope, nothing is due until the work is done, and you won't be added to a call list.