"A hacker, in its truest sense, is a researcher who is profoundly dedicated to and specialized in a specific field." This is a statement Alan Lee repeatedly emphasized during his speech, and it is a belief he has spent his entire career putting into practice.

Alan Lee, an alumnus of the Department of Computer Science and Engineering (Class of 2000), currently serves as the Manager of the IT Security Department in the Information Technology Division at MediaTek. From his early days of intense offensive and defensive battles on the DEFCON competition floor to strategic corporate cybersecurity deployments—and now standing at the forefront of the AI wave—he has always been the one leading the charge.

The true turning point in his journey came when he passed the entrance exam for the Graduate Institute of Computer Science and Information Engineering at National Chiao Tung University (NCTU) and entered the Distributed Systems and Network Security (DSNS) Lab. Faced with two vastly different paths—network security or online gaming—he chose the former without a second thought. "I viewed network security as a distinct profession. To me, it was far more challenging than writing game code," Lee recalls. During his years at NCTU, he not only built a solid foundation in cybersecurity theory but also developed a "hacker mindset"—a burning desire to see through and completely dissect things. This mindset became the fundamental capability that allowed him to peel back the layers of any problem and find breakthroughs, whether in competitions or dealing with corporate threats.

After graduating from NCTU, Lee spent over a decade deep-rooted in the telecommunications industry while actively participating in Taiwan's cybersecurity community. In 2005, he co-founded the Taiwan Hackers Association (HITCON). However, what truly propelled him onto the international stage was the period he spent leading the HITCON CTF team to compete in DEFCON.

DEFCON CTF is widely recognized as the world's most grueling hacker competition. The finals utilize an attack-and-defense format where each team is assigned a server loaded with vulnerabilities. Teams must simultaneously patch their own security flaws, write exploits to breach rival hosts, and steal "flags." With each round lasting a mere five minutes, speed and precision dictate everything. In 2014, Lee led the HITCON team through 72 hours of non-stop, sleepless warfare, ultimately securing the World First Runner-Up (2nd place) for Taiwan—a result that sent shockwaves through the global cybersecurity community. The team proved this was no fluke by taking 2nd place again in 2017 and 2019, standing at the pinnacle of the DEFCON world three separate times.

This era of intense competition gave him a profound appreciation for the power of collaboration and division of labor. The team was structured into three indispensable units: the Exploit Group, responsible for core offensive actions; the Traffic Group, tasked with monitoring traffic and capturing opponents' payloads for replay attacks; and the Infra Group, dedicated to developing automated attack and monitoring tools. Lee also shared a legendary anecdote that is still talked about today: during one competition, the American team PPP intentionally hid a backdoor inside a patch they released, baiting other teams into applying it so they could wipe them out in one fell swoop. This highlights the psychological warfare and layers of deception present at the highest levels of competition. Compared to the South Korean team, which enjoyed full state backing, government resources, and dedicated training facilities, the Taiwanese team relied entirely on pure technical prowess and sheer grit. "No matter how good we are, we can only compete on the front lines for a few years. Doing a good job with passing the torch is the real key to building sustainable cybersecurity strength," Lee emphasized, noting this as his most crucial message for the next generation.

Reflecting on the evolution of cybersecurity technology in Taiwan, Lee outlined this history from his perspective as a firsthand witness. As early as 2016, DARPA hosted the Cyber Grand Challenge (CGC), tasking teams with developing Cyber Reasoning Systems capable of autonomous reasoning and decision-making—finding bugs, patching them, and launching counter-attacks without any human intervention. At the time, the technology relied primarily on symbolic execution combined with fuzzing. While machines could detect crashes and generate exploits at millisecond speeds, they were practically powerless against logic flaws that required an understanding of the "developer's intent." The consensus back then was clear: "Leave the simple things to machines, and the complex things to humans."

However, with the dawn of the Large Language Model (LLM) era, this boundary is rapidly dissolving. Lee pointed to the results of the 2025 DARPA AIxCC (AI Cyber Challenge) Finals as an example: AI systems unearthed 18 zero-day vulnerabilities in real-world open-source projects within just 45 minutes, with an automated patching cost of only $152 USD per fix. This staggering efficiency sent shockwaves through the market, causing traditional cybersecurity giants to see their stock prices plummet overnight, signaling the end of the "labor-intensive cybersecurity" era.

Looking back, automated vulnerability discovery techniques such as fuzzing and symbolic execution could perform exhaustive searches through algebraic solving and brute force. However, they were often restricted by path explosion and remained powerless against complex vulnerabilities that required semantic comprehension. Today, Large Language Models (LLMs), with their powerful global reasoning and deep code comprehension, have successfully crossed this threshold, vastly enhancing vulnerability discovery capabilities. Faced with such disruptive AI technology, humans must quickly learn to leverage AI Agents to augment their own capabilities. If vulnerability researchers continue to bound their value to replicating existing, machine-identifiable vulnerability patterns, they will inevitably be replaced by highly efficient and low-cost AI. Conversely, if humans focus their energy on exploring the unknown, challenging limits, and driving cross-disciplinary innovation, human intuition and creativity will remain irreplaceable—no matter how powerful the models become.

Faced with this paradigm shift, Lee’s advice to his juniors is clear and direct: Do not fear being replaced; instead, learn to transform. He pointed out that future cybersecurity talent needs to evolve from "solo-fighting hackers" into "cybersecurity commanders leading countless AI Agents." This means that understanding vulnerability principles and attack-defense logic is no longer enough; professionals must master how to design robust execution environments for AI—including sandbox isolation, privilege control, self-validation loops, and human-in-the-loop approval gates for high-risk actions. The model's intelligence sets the ceiling, but the stability of the engineering system is the foundation; you cannot have one without the other.

He also emphasized that the attack-and-defense intuition honed in CTF competitions has far from gone out of style in this new era; rather, it provides the most precious nourishment for designing AI Harnesses. Those who know how to rapidly analyze traffic and reverse-engineer the root causes of vulnerabilities under the pressure of a live match are precisely the ones best equipped to judge whether an AI's output is trustworthy, and when human intervention is critically required. The intuition forged on the competition floor will become an irreplaceable core competency in the AI era. He concluded with a touch of self-deprecating humor, noting that as he mentioned earlier, no matter how good they were, they could only fight for a few years in the past. But now with AI, us old-timers can keep fighting for a few more years.

"Warriors grow old, but the hacker spirit never dies. " Emerging from NCTU’s DSNS Lab, Alan Lee’s 30-year journey in cybersecurity shows us that while tools and methodologies change, what remains constant is an insatiable curiosity for the unknown, a relentless obsession with details, and an indomitable attitude. In the roaring tide of AI, the hacker spirit has not been rendered obsolete; instead, it has found an even grander stage to conquer.