  Offensive security-tests are a common way to pro-actively discover potential
vulnerabilities. They are performed by specialists, often called
penetration-testers or white-hat hackers. The chronic lack of available
white-hat hackers prevents sufficient security test coverage of software.
Research into automation tries to alleviate this problem by improving the
efficiency of security testing. To achieve this, researchers and tool builders
need a solid understanding of how hackers work, their assumptions, and pain
points.
  In this paper, we present a first data-driven exploratory qualitative study
of twelve security professionals, their work and problems occurring therein. We
perform a thematic analysis to gain insights into the execution of security
assignments, hackers' thought processes and encountered challenges.
  This analysis allows us to conclude with recommendations for researchers and
tool builders to increase the efficiency of their automation and identify novel
areas for research.
