Raphael Benoit
Senior advisor · Cybersecurity, AI & automation
From Windows internals to computer vision and local LLMs, I design, build, and validate software tools end to end.
Worldwide on HackTheBox in 2023, a cyber training platform with over 4M members.
CTF team#1ADMinions in the worldwide HackTheBox team ranking in 2024, 2025 and 2026.
Cybersecurity CTF11thCyber Apocalypse 2025, an international HackTheBox competition — 8,130 teams.
Cybersecurity CTF17thCyber Apocalypse 2024, an international HackTheBox competition — 5,693 teams.
CGI Innovation 2025 — Greater Montréal BU ranking.
CGI Innovation 2025 — solution’s global ranking.
StayInTheBoxCorp, a reverse-engineering GamePwn challenge published on HackTheBox.
Publication reach~100kReads in one week for my reverse-engineering and Windows kernel research.
Blog
Windows security research, agentic pentesting notes, and VulnLab writeups.
Experience
Analysis, design, development, technical evidence and remediation guidance: I take ownership of the complete cycle.
CGI · Montréal
Offensive security, Active Directory hardening, Python automation and applied AI in regulated environments.
CGI · Montréal
IBM i/AS400 exfiltration-risk analysis, CyberArk/Power BI automation, SAST auto-remediation and penetration-test reporting tools.
Letico · Saint-Laurent
Led Python, industrial automation, IT integration and internal security projects from requirements through maintenance.
Computer vision, full-stack software, local LLMs, and industrial automation.
Data preparation, assisted annotation, reproducible versions and visual review.
Case studyBoxes, polygons and segmentation under occlusion in an anonymized demonstration.
Compare source and result
Full-stack product: async Quart, OAuth, Stripe, AWS and a published extension.
Case study
Server designed and assembled for LLMs, RAG, fine-tuning, vision and cybersecurity workloads.
View projectFile ingestion, contextual search and fully local operation.
Conversation and form inputs into a structured, reviewable report.
Search and synthesis in a specialized document collection.
Answers grounded in selected sources within a Web interface.
Timestamps and speaker separation in a complete workflow.
Sensors, SAP/ERP, CIP/Modbus, real-time events and anomaly detection.
Agentic pentesting, reverse engineering, and Windows kernel research.
A local agent selects bounded tasks, uses controlled tools, and preserves evidence for human review.
Read article
From binary functions and references to a behavior report that cites the underlying code.
Case study
Memory analysis, hooking, Windows drivers, WinDbg, page tables and detection surfaces.
Case study
A selection of the most representative demonstrations. Explore the 11-video catalog →
Desktop workspace for visual data, YOLO annotations and reproducible datasets.
Compact Ghidra exports and defensive analysis with multiple LLM backends.
Cybersecurity instruction datasets for LLM training and evaluation.
Backup-first recovery for Codex Desktop local state and SQLite metadata.
Windows x64 target for pointer chains and memory primitives.
Companion code for the external/internal memory analysis and hooking articles.
Lab tool for testing authorized KeePass v4 databases.
RID/SID enumeration of MSSQL users and groups in authorized environments.
For professional inquiries, reach me on LinkedIn. My code, rankings and demos are on GitHub, HackTheBox and YouTube.