GB Gagan Bagh

Senior Penetration Tester · BreachLabz

I break vehicles, chargers and connected devices, before attackers do.

Offensive security across automotive and EV ecosystems: ECUs, in-vehicle networks, EV chargers, backends and wireless interfaces. Based in Bengaluru, India.

Get in touch See my work
candump can0 Gagan Bagh
  • Since 2021in offensive security
  • ISO/SAE 21434UN R155/156 · AIS 189
  • ScapyCon 2026EV charger hacking workshop

01 / About

Thinking like an attacker, building for defenders

I'm a Senior Penetration Tester at BreachLabz, where I lead offensive security engagements across automotive and EV ecosystems: ECUs, in-vehicle networks, EV chargers, backend systems and wireless interfaces, testing them the way real-world attackers would.

Alongside hands-on testing, I build in-house pentesting tools to automate workflows and set up our dedicated automotive pentest lab. My background in ISO/SAE 21434, UN R155, TARA, CSMS and fuzz testing, gained helping OEMs and suppliers, lets me turn findings into actionable security controls. I also founded AutoSecurityy, a non-profit community for sharing automotive cybersecurity research and knowledge.

  • Penetration Testing

    Vulnerability analysis and penetration testing of automotive systems.

  • EV Charger Hacking

    Pentesting EV chargers, charging protocols and backend systems.

  • IoT Hacking

    IoT security assessment at both system and component level.

  • ISO/SAE 21434

    Threat analysis and risk assessment, CSMS, review and gap analysis.

Attack surfaces I've worked on

  • Passenger & autonomous vehicles
  • Two-wheelers
  • ECUs & in-vehicle networks
  • EV chargers
  • Wireless & IoT devices
  • Cloud & backend systems
  • Robots & autonomous systems

02 / Experience

Where I've been testing

  1. 2026 — Present Current

    Senior Penetration Tester

    BreachLabz, Bengaluru

    Leading penetration testing engagements across automotive and EV ecosystems, including ECUs, in-vehicle networks, EV chargers, backend systems, and wireless interfaces, simulating real-world attacker capabilities. Designing and developing in-house pentesting tools to automate testing workflows across automotive, EV charger and IoT systems, and built our dedicated automotive pentest lab for end-to-end security testing under realistic attack conditions.

  2. 2025 — 2026

    Associate Consultant

    Yarix India Pvt. Ltd (Formerly CYRES Consulting)

    Joined the Automotive CS Engineering Team, I apply my expertise in Threat Analysis, Penetration Testing, and compliances to enhance CSMS, TARA, and CS Controls. I support gap analysis and work product development in line with ISO/SAE 21434, UNECE R155/156, and AIS 189, focusing on securing ECUs, passenger vehicles, and two-wheelers.

  3. 2024 — 2025

    Automotive Cybersecurity Team Lead

    HackersEra, India

    Leading team & contributing for penetration testing engagements and TARA aligned with UN R155 & ISO/SAE 21434 to identify and reduce security risks in the automotive systems. Worked on various passengers and autonomous vehicles.

  4. 2022 — 2024

    Security Consultant

    HackersEra, India

    Led ECUs penetration testing for over 5+ units and vehicle security assessments for over 6 connected cars. Additionally threat-modelling and security validation testing for ethernet-based ECUs.

  5. 2021 — 2022

    Security Analyst

    HackersEra, India

    Contributed in various penetration tests which includes IoT devices, networks, and managed defect analysis & vulnerabilities of connected cars.

03 / Talks, Workshops & Publications

Teaching people to break chargers

Gagan presenting at the EV Charger Hacking workshop, attendees working on laptops
Workshop room at ScapyCon 2026
ScapyCon banner: Learn. Craft. Connect.
Sep 15–16, 2026 · Regensburg, Germany Workshop

EV Charger Hacking Workshop

ScapyCon Automotive 2026 · with Benedikt Kopf

A four-hour hands-on workshop built around one question: what can you actually do to a charging station if you're standing next to it in the car park? Every attendee got a real OCPP 1.6 charge point and worked from the outside in, ending with a complete attack chain and a live charging session on a backend they controlled.

  • Curriculum covering BLE, Wi-Fi, NFC and OCPP exploitation
  • Built Pocket EVSE as the CTF target, flashed onto the ScapyCon badge on the day
  • Full attack chain, from BLE discovery to remote charging-session takeover on a live CMS
Event page Workshop recap
Gagan presenting on OCPP security to an audience at SAEINDIA PDP 2025
2025 · India Talk

Penetration Tester's Guide to OCPP

SAEINDIA PDP 2025

A technical session on attacking the Open Charge Point Protocol, demonstrated against a live EV charging point.

  • Practical penetration testing methods for OCPP, shown on a live charger
  • Threat modelling, exploitation techniques and mitigations for charge point systems
  • How proactive pentesting strengthens charging stations and the wider EV ecosystem

04 / Projects

Things I've built

Featured builds

  • In development

    CANfi

    Wireless CAN testing tool · since Oct 2026

    A custom ESP32-based CAN tool for automotive security research. Works wireless or wired: monitor traffic and run tests remotely from a web dashboard, or use it as a CAN-to-USB adapter.

    • Live CAN monitoring & filtering
    • Frame injection & replay
    • UDS diagnostics over ISO-TP
    • Trace logging & analysis
    • OBD-II & UDS test cases
    • SLCAN USB2CAN for SocketCAN
    • ESP32
    • CAN
    • UDS
    • SocketCAN
  • Completed

    Pocket EVSE

    OCPP 1.6 charge point in your pocket · 2026

    A fully functional OCPP 1.6 charging point running on an ESP32, built for EV charging security research, CTF demonstrations and conference demos. It was the target device every attendee hacked at the ScapyCon 2026 EV Charger Hacking workshop, flashed onto the conference badge too, with no expensive hardware or lab required.

    • Real OCPP 1.6J charge point
    • Runs on low-cost ESP32
    • Wireless attack surface
    • Battle-tested at ScapyCon 2026
    • ESP32
    • OCPP 1.6J
    • EVSE
    • Wi-Fi / BLE

Tools, research & resources

05 / Writing

Notes from the bench

Car Hackers Space Medium

06 / Recommendations

What colleagues say

I had the pleasure of interacting with Gagan in the past and can confidently recommend him as a skilled Automotive Cybersecurity Professional. He has a great approach to penetration testing of automotive IoT systems and threat analysis, showcasing his expertise. Additionally, his overall experience & leadership abilities make him a valuable asset to any team.
Rohit
via LinkedIn
Gagan is fantastic to work with, and has exceptional experience in cybersecurity field like Automotive, IoT & Networks Penetration Testing. He solve complex issues even when outside of his direct area of expertise. He is extremely enthusiastic about his work which is infectious. Energetic and broad-minded security professional — that's him! Definitely someone I'd want to have on my team.
Saloni
via LinkedIn

07 / Contact

Got a vehicle, ECU or charger that needs breaking?

For pentest engagements, research collaborations, workshops or talks, drop me an email or reach out on LinkedIn.

gaganbagh08@gmail.com LinkedIn