Rachel Tobac

Rachel Tobac is an ethical hacker and the co-founder and CEO of SocialProof Security. As CEO, Tobac leads a team specializing in social engineering, focusing on manipulating individuals rather than systems to gain access to sensitive data, accounts, and physical locations. Her work involves authorized penetration testing for organizations, followed by detailed debriefs to help clients strengthen their defenses against social engineering attacks. SocialProof Security partners with major organizations, including Google, Meta, X, PayPal, Lululemon, Uber, Prudential, SANS, NATO, the U.S. Air Force, and a range of legal, financial, medical, and technology clients to improve their cybersecurity posture.

Tobac entered the cybersecurity industry from a nontraditional background, having studied neuroscience and behaviorism and worked as a special needs educator before transitioning into security. Her expertise in neuroscience, behavioral psychology, improvisational comedy, and teaching has informed her approach to social engineering and cybersecurity awareness. Tobac gained recognition in the security community by placing second at DEF CON's Social Engineering Capture the Flag competition for three consecutive years, where she performed live social engineering demonstrations in front of large audiences. This visibility contributed to the founding and growth of SocialProof Security.

Tobac regularly conducts live hacking demonstrations to highlight the risks of exposed personal data and the tactics used by social engineers. Her demonstrations, always performed with consent, illustrate how attackers can exploit publicly available information to manipulate individuals and gain unauthorized access. Tobac was among the first to analyze and explain the Twitter hack, providing public recommendations to help organizations defend against similar attacks. Her work has been featured in The New York Times, 60 Minutes, Last Week Tonight with John Oliver, NPR, CNN, and NBC Nightly News with Lester Holt.

Tobac has served on the CISA Technical Advisory Council, contributing to national cybersecurity policy. She has provided insight into AI-driven threats, including voice cloning and deepfakes, and advises organizations on navigating evolving cybersecurity risks. Tobac is also the Chair of the Board for Women in Security and Privacy, a nonprofit dedicated to advancing women in the field. Her ability to communicate complex cybersecurity concepts to diverse audiences has made her a frequent speaker for corporate and government events, focusing on cybersecurity, social engineering, and information security awareness.