aaron(7) - hacker, researcher, reverse engineer

aaron(7)
aaron(7)

NAME

aaron - hacker, researcher, reverse engineer

SYNOPSIS

aaron [--reverser]
aaron [--exploiter]
aaron [--presenter]
aaron [--educator]
aaron [--author]
aaron [--commentator]
aaron [--guest]

DESCRIPTION

Aaron Portnoy is a security researcher, reverse engineer, speaker, and educator.
This page serves as a minimalist reference to his work and interests.

OPTIONS

--reverser

Research interests lie in reverse engineering with a focus on deriving structure, semantics, and intent from opaque software systems. This includes analysis of binaries, firmware, and complex control flows across diverse architectures. Created the IDA Pro plugin toolbag to support these efforts, and regularly presents on reverse engineering methodologies and applied tooling. This work has yielded the discovery and disclosure of a large number of vulnerabilities in commercial software across a wide range of products and vendors.

--exploiter

Research and practical work in exploitation focuses on the development of reliable, high-impact techniques for vulnerability exploitation across diverse targets. Areas of emphasis include memory corruption, logic flaws, and the systematic bypassing of modern mitigations. Published in Phrack, and has authored or co-authored several high-profile exploits demonstrated at industry conferences and in real-world security assessments.

--presenter

Has delivered over 30 invited talks across global stages, including Black Hat, USENIX, Recon, Microsoft BlueHat, and the NSA Distinguished Speaker Series. Presentation topics have spanned reverse engineering methodologies, economic drivers of zero-day trade, large-scale vulnerability discovery, and exploit automation. Recognized by academic institutions such as NYU and Dartmouth for his contributions to offensive computing education. His work has also been featured on the cover of TIME Magazine and referenced in numerous university-level curricula.

--educator

Actively engaged in cybersecurity education across academic, government, and industry contexts. Designed and delivered lectures on reverse engineering and vulnerability analysis at Dartmouth College and Norwich University, and served as a guest speaker at institutions including NYU and the National Security Agency. Led technical trainings at global security conferences such as REcon and CanSecWest, including multi-day workshops on vulnerability discovery and exploitation. Instruction emphasizes practical methodology, foundational theory, and emerging offensive techniques relevant to both students and professionals.

--author

Has authored and co-authored technical work spanning vulnerability research, exploitation techniques, and AI security. Published in Phrack, IEEE Security & Privacy, and peer-reviewed academic proceedings including ACM FSE and USENIX WOOT. Additional applied research published through IBM X-Force and the Network Security journal.

--commentator

Regularly sought as a subject matter expert by major media outlets on topics spanning zero-day markets, AI security, and offensive research. Has been quoted or featured in TIME, Wired, Forbes, Reuters, the BBC, the Wall Street Journal, and Ars Technica, among others.

--guest

Appears as a guest on podcasts and interview series covering cybersecurity, AI risk, and the economics of vulnerability research. Topics range from the history of exploit development and Pwn2Own to the emerging threat landscape for AI-powered systems.

PRESENTATIONS

[slides] The Emperor's New Guardrails (AI Accelerator Institute CISO Summit; New York, NY)
[slides] Offense and Defense in an Era of Systemic Asymmetry: Why the Old Model No Longer Holds (Keynote, Ekoparty; Miami, FL)
[slides] Probabilities, Vulnerabilities, and Psychometrics (Boston Security Meetup; Boston, MA)
[video] Log4j | CVE-2021-44228 Webinar (Randori & GreyNoise; Online)
[conf] Choose Your Own Adventure: A Career Guide to InfoSec (BSides Austin; Austin, TX)
Panel: Exodus and Fortiguard (Fortinet GPC Cruise; Haiti)
[press] The Economics of Vulnerabilities (Worcester Economic Club; Worcester, MA)
[slides] Bypassing All of the Things (Summercon; New York, NY)
[conf] Bypassing All of the Things (Nordic Security Conference; Reykjavik, Iceland)
[conf] The IDA Toolbag (Recon; Montreal, QC)
[conf] Toolbag (Nordic Security Conference; Reykjavik, Iceland; w/ Brandon Edwards)
[script] The Busticati 0xC Step Program to Program Recovery (Summercon; New York, NY)
[conf] I heard you like reversing (Hackito Ergo Sum; Paris, France)
[slides] Black Box Auditing Adobe Shockwave (CanSecWest; Vancouver, BC)
[slides] Black Box Auditing Adobe Shockwave (PacSec; Tokyo, Japan)
[press] The Economics of Vulnerabilities (Hack in the Box; Amsterdam, Netherlands)
[press] The Vulnerability Disclosure Debate Continues (RSA; San Francisco, CA)
[video] Experiments using IDA Pro as a data store (Ekoparty; Buenos Aires, Argentina)
[slides] [video] Reverse Engineering 101 (Guest Lecture, NYU Polytechnic; Brooklyn, NY)
[slides] Reversing Microsoft DirectShow (YSTS; São Paulo, Brazil)
[press] Exploiting Online Games (RSA; San Francisco, CA)
[slides] Reverse Engineering Dynamic Language Multiplayer Online Games (BA-Con; Buenos Aires, Argentina)
[slides] [video] Reverse Engineering Dynamic Languages (Recon; Montreal, QC)
[slides] Reverse Engineer's Cookbook (Toorcon; Seattle, WA)
[slides] Reverse Engineering Python Applications (USENIX Workshop on Offensive Computing; San Jose, CA)
[slides] [video] RPC Auditing Tools and Techniques (DeepSec; Vienna, Austria)
RPC Auditing Tools and Techniques (Toorcon; Seattle, WA)
[slides] Advanced Fuzzing with Sulley (Blackhat Japan; Tokyo, Japan)
[slides] Fuzzing Sucks! (Blackhat; Las Vegas, NV)
Fuzzing Sucks! (Microsoft Bluehat; Redmond, WA)
Exploitation: Past, Present, and Future (National Security Agency; Fort Meade, MD)

PUBLICATIONS

From Kill Chain to Kill Cycle (Mindgard, 2026)
When Configuration Becomes Code: The Hidden Execution Layer in AI Development Tools (Mindgard, 2026)
Forced Descent: Google Antigravity Persistent Code Execution Vulnerability (Mindgard, 2026)
The Missing First Step in AI Security Testing: Reconnaissance (Mindgard, 2026)
TheLibrarian.io's AI Security Is Checked Out, and Their Disclosure Response Is Overdue (Mindgard, 2025)
Zed IDE Vulnerabilities & Coordinated Disclosure (Mindgard, 2025)
Inside OpenAI Sora 2: Uncovering System Prompts Driving Multi-Modal LLMs (Mindgard, 2025)
From Prompt to Pwn: Cline Bot AI Coding Agent Vulnerabilities (Mindgard, 2025)
BinPool: A Dataset of Vulnerabilities for Binary Security Analysis (ACM FSE, 2025)
MSMQ QueueJumper (RCE Vulnerability): An In-Depth Technical Analysis (IBM X-Force)
Adobe Shockwave - A Case Study on Memory Disclosure (Phrack, Issue 69)
Pwn2Own Wrap Up and Analysis (Network Security, 2010)
Walking on Water: A Cheating Case Study (IEEE Security & Privacy, 2009)
Reverse Engineering Python Applications (USENIX WOOT, 2008)

PRESS

The Real AI Security Risk Isn't Data Leakage—It's What Your Agents Can Do (Forbes)
AI Doctor's Assistant Swayed to Change Scrips, Researchers Find (The Register)
Exclusive: Researchers Trick a Bot That Prescribes Meds (Axios)
Google AI Coding Tool Antigravity Was Hacked A Day After Launch (Forbes)
Mindgard Finds Sora 2 Vulnerability Leaking Hidden System Prompt via Audio (Hackread)
Windows Admins Warned to Patch Critical MSMQ QueueJumper Bug (BleepingComputer)
IBM Acquires Offensive Security Startup Randori to Bolster Its Cybersecurity Toolkit (TechCrunch)
Hackers Are Actively Exploiting Big-IP Vulnerability with a 9.8 Severity Rating (Ars Technica)
Tech Giants Microsoft, Amazon and Others Warn of Widespread Software Flaw (WSJ, paywalled)
Firm Held Onto Palo Alto VPN Zero-Day for 11 Months (BankInfoSecurity)
Massive Zero-Day Hole Found in Palo Alto Security Appliances (Threatpost)
Aaron Portnoy – 'There's no silver bullet for ransomware or supply chain attacks' (The Daily Swig)
Crack'n'hack Stack Phrack's Back, Jack! (The Register)
Exploit Dealer: Snowden's Favourite OS Tails Has Zero-Day Vulnerabilities Lurking Inside (Forbes)
[video] The Cycle (MSNBC, July 10, 2014)
Zero-Day Flaws in Tails Aren't for Sale, Vulnerability Broker Says (InfoWorld)
Zero-day Broker Exploits Vulnerability in I2P to De-anonymize Tails Users (Computerworld)
World War Zero: How Hackers Fight to Steal Your Secrets (TIME)
Expert Walks Worcester Through the Economics of Internet Secrets (Worcester Business Journal)
Info security expert to address Worcester group (Worcester Business Journal)
The business of cyberwar (Thought Leader)
With Millions Paid in Hacker Bug Bounties, Is the Internet Any Safer? (Wired)
Portrait of a Full-Time Bug Hunter — Abdul-Aziz Hariri (Wired)
Power Station, Airport SCADA Defences 'Dead as a Dodo' (The Register)
Bored Researcher Easily Finds Two Dozen SCADA Security Holes (NBC News)
Researcher Finds Over 20 Vulnerabilities in SCADA Security Software (Computerworld)
Former Zero Day Initiative Researchers Form New Firm Exodus Intelligence (Threatpost)
Chrome Owned by Exploits in Hacker Contests, But Google's $1M Purse Still Safe (Wired)
Researchers Throw Down Vulnerability-Disclosure Gauntlet (Dark Reading)
Life as a Bug Hunter (BBC)
BlackBerry Cracked in Hacking Contest (Dark Reading)
iPhone Falls in Pwn2Own Hacking Contest (Reuters)
Are Vulnerability Disclosure Deadlines Justified? (Idaho National Laboratory, 2011)
More High-Severity Flaws Haunt Adobe Software (ZDNet)
Hacking Online Games: A Widespread Problem (CNET)
HP patches OpenView vulnerabilities (Reuters)

PODCASTS

Aaron Portnoy on Pwn2Own, the End of Easy Bugs, and AI-Fueled Offense (The Three Buddy Problem)
He Started Hacking at 15. Now He's Predicting the Biggest AI Security Breach of 2026. (Wake UP X Podcast)
Aaron Portnoy || From Pwn2Own to Pwning AI (Adventures of Alice and Bob Podcast)

CITATIONS

M. A. Özer and S. Dündar (2026). Evaluating LLM Performance on CWE Identification and CVSS Estimation. 2026 5th International Informatics and Software Engineering Conference (IISEC), Ankara, Turkiye, pp. 684-688, doi: 10.1109/IISEC69317.2026.11418496.
Capozzi, G., Giancaspro, A. P., Petroni, F., Querzoni, L., Di Luna, G. A. (2026). ReSIM: Re-ranking Binary Similarity Embeddings to Improve Function Search Performance. arXiv:2602.09548 [cs.CR].
Abdollahi, M., Zhang, R., Shiri Harzevili, N., Shin, J., Wang, S., Hemmati, H. (2025). Surveying the Benchmarking Landscape of Large Language Models in Code Intelligence. ACM Transactions on Software Engineering and Methodology, Article 85. doi: 10.1145/3800957.
Ismail, M., El-Rashidy, N., Nabil, M. (2022). Mobile Cloud Database Security: Problems and Solutions. Fusion: Practice and Applications, vol. 7, no. 1, pp. 15-29. doi: 10.54216/FPA.070102.
Regalado, D., Harper, A., Eagle, C., Harris, S., Ness, J., Spasojevic, B., Linn, R., Sims, S. (2018). Gray Hat Hacking: The Ethical Hacker's Handbook, Fifth Edition. McGraw Hill LLC.
Takanen, A., DeMott, J., Miller, C., Kettunen, A. (2018). Fuzzing for Software Security Testing and Quality Assurance. Artech House.
TIME Cybersecurity: Hacking, the Dark Web and You. (2018). Time Incorporated Books.
Regalado, D., Harris, S., Harper, A., Eagle, C., Ness, J., Spasojevic, B., Linn, R., Sims, S. (2015). Gray Hat Hacking: The Ethical Hacker's Handbook, Fourth Edition. McGraw-Hill Education.
Eilers, C. (2014). iOS Security: Sichere Apps für iPhone und iPad. entwickler.Press.
Kholia, D., Węgrzyn, P. (2013). Looking Inside the (Drop) Box. 7th USENIX Workshop on Offensive Technologies (WOOT). doi: 10.5555/2534748.2534760.
Miller, C., Dai Zovi, D. (2011). The Mac Hacker's Handbook. Wiley.
Mobile Application Security. (2010). McGraw-Hill Education (India) Pvt Limited.
Seitz, J. (2009). Gray Hat Python: Python Programming for Hackers and Reverse Engineers. No Starch Press.
Davis, S. B. (2008). Protecting Games: A Security Handbook for Game Developers and Publishers. Charles River Media/Course Technology.
Sutton, M., Greene, A., Amini, P. (2007). Fuzzing: Brute Force Vulnerability Discovery. Pearson Education.

VULNERABILITIES

CVE-2026-41153: JetBrains Junie: command injection via malicious project file enabling unsafe command execution
CVE-2026-0612: The Librarian: information leakage via web_fetch tool in AI assistant
CVE-2026-0613: The Librarian: internal port scanning via AI assistant
CVE-2026-0615: The Librarian: unauthorized access to supervisord status page via AI assistant
CVE-2026-0616: The Librarian: unauthorized access to Adminer database interface via AI assistant
CVE-2025-68432: Zed IDE: arbitrary code execution via malicious LSP binary configuration in .zed/settings.json
CVE-2025-68433: Zed IDE: command injection via MCP configuration
Eclipse Theia MCP: MCP configuration vulnerability in Eclipse Theia IDE
Cline: DNS-based data exfiltration via prompt injection in source file docstrings, coercing reads of .env files and exfiltrating secrets via DNS queries
Cline: arbitrary code execution via prompt injection in .clinerules config file, bypassing user approval dialogs
Cline: TOCTOU race condition via sequential prompt injection enabling arbitrary code execution across separate interaction windows
Cline: model identity disclosure via error messages revealing underlying AI model
Aider: zero-click arbitrary command execution via malicious .aider.conf.yml loading an external command file with user prompts suppressed
CVE-2021-3064: Palo Alto GlobalProtect: stack-based buffer overflow enabling unauthenticated RCE in portal and gateway interfaces; Randori Attack Team
CVE-2017-13997: Schneider Electric InduSoft Web Studio / InTouch Machine Edition: missing authentication enabling arbitrary command execution, CVSS 9.8
CVE-2017-14024: Schneider Electric InduSoft Web Studio / InTouch Machine Edition: stack-based buffer overflow enabling RCE, CVSS 9.8
CVE-2017-8022: EMC NetWorker: buffer overflow in nsrd service enabling unauthenticated RCE
CVE-2013-0657: Schneider Electric IGSS: stack-based buffer overflow via TCP port 12397, CVSS 10.0
CVE-2013-0658: Schneider Electric Accutech Manager: heap-based buffer overflow in RFManagerService.exe, CVSS 10.0
CVE-2012-4704: 3S CODESYS Gateway-Server: array index error enabling RCE
CVE-2012-4705: 3S CODESYS Gateway-Server: directory traversal enabling arbitrary code execution
CVE-2012-4706: 3S CODESYS Gateway-Server: integer signedness error causing heap buffer overflow
CVE-2012-4707: 3S CODESYS Gateway-Server: out-of-bounds memory access enabling code injection
CVE-2012-4708: 3S CODESYS Gateway-Server: stack-based buffer overflow enabling RCE
CVE-2012-2288: EMC NetWorker: format string vulnerability in nsrd RPC service enabling RCE
CVE-2012-0121: HP Data Protector Express: unspecified vulnerability enabling RCE or DoS, CVSS 10.0
CVE-2012-0122: HP Data Protector Express: unspecified vulnerability enabling RCE or DoS, CVSS 10.0
CVE-2012-0123: HP Data Protector Express: unspecified vulnerability enabling RCE or DoS, CVSS 10.0
CVE-2012-0124: HP Data Protector Express: unspecified vulnerability enabling RCE or DoS, CVSS 10.0
Oracle CPU: multiple Oracle product vulnerabilities
CVE-2011-4185: Novell iPrint Client: ActiveX GetPrinterURLList2 stack-based buffer overflow enabling RCE
CVE-2012-0774: Adobe Reader X: True Type Font MINDEX table integer overflow enabling RCE
CVE-2012-1182: Samba: NDR PULL EVENTLOG heap overflow enabling RCE
CVE-2012-0549: Oracle AutoVue: ActiveX SetMarkupMode enabling RCE
TPTI-12-01: Oracle Java: True Type Font IDEF opcode parsing enabling RCE
CVE-2011-0335: Adobe Shockwave Player: memory buffer overflow enabling RCE
CVE-2011-0555: Adobe Shockwave Player: memory buffer overflow enabling RCE
CVE-2011-0556: Adobe Shockwave Player: memory buffer overflow enabling RCE
CVE-2011-0569: Adobe Shockwave Player: buffer overflow in Font Xtra.x32 enabling RCE
CVE-2011-2111: Adobe Shockwave Player: buffer overflow in IML32.dll enabling RCE
CVE-2011-2116: Adobe Shockwave Player: memory corruption enabling RCE
CVE-2011-0862: Oracle Java SE: ICC Profile rcs2 tag parsing enabling RCE
TPTI-11-13: McAfee SaaS: myCIOScn.dll scan method script injection enabling RCE
TPTI-11-15: Novell ZENWorks Software Packaging: ISGrid.Grid2.1 bstrSearchText parameter enabling RCE
CVE-2010-2866: Adobe Shockwave Player: integer signedness error in DIRAPI module enabling RCE
CVE-2010-2867: Adobe Shockwave Player: pointer offset vulnerability in DIRAPIX.dll enabling RCE
CVE-2010-2870: Adobe Shockwave Player: heap-based buffer overflow in DIRAPIX.dll enabling RCE
CVE-2010-2874: Adobe Shockwave Player: memory corruption via uninitialized pointer enabling RCE
CVE-2010-2877: Adobe Shockwave Player: improper input validation in Director movie parsing enabling RCE
CVE-2010-2878: Adobe Shockwave Player: improper input validation in DIRAPIX.dll enabling RCE
CVE-2010-2879: Adobe Shockwave Player: integer overflow in TextXtra.x32 enabling RCE
CVE-2010-4188: Adobe Shockwave Player: heap-based buffer overflow enabling RCE
CVE-2010-4189: Adobe Shockwave Player: memory buffer overflow enabling RCE
CVE-2010-3106: Novell iPrint Client: ActiveX control improper input validation enabling RCE
CVE-2010-3107: Novell iPrint Client: logic flaw in file deletion permissions
CVE-2010-4316: Novell iPrint Client: browser plugin Execute Request debug parameter RCE
CVE-2010-4317: Novell iPrint Client: browser plugin GetDriverFile uninitialized pointer RCE
CVE-2010-4319: Novell iPrint Client: remote arbitrary file deletion
CVE-2010-4385: RealNetworks RealPlayer: invalid frame dimensions in SIPR stream enabling RCE
CVE-2010-4390: RealNetworks RealPlayer: heap buffer overflow in MDPR chunk parsing enabling RCE; w/ Logan Brown
CVE-2010-4294: VMware Movie Decoder / Workstation / Player / Server: heap memory corruption enabling code injection
CVE-2010-0034: Microsoft Office PowerPoint Viewer: TextCharsAtom record code execution
CVE-2010-0898: Oracle Secure Backup: Scheduler Service RCE
TPTI-10-01: HP Data Protector Server Cell Manager: RCE
TPTI-10-03: Sophos Anti-Virus: SAVOnAccessFilter local privilege escalation
TPTI-10-05: Novell iPrint Client Browser Plugin: remote file deletion
TPTI-10-07: SAP Crystal Reports 2008: GIOP message size integer overflow enabling RCE
CVE-2009-3846: HP OpenView Network Node Manager: heap-based buffer overflow in ovlogin.exe, CVSS 10.0
CVE-2009-4176: HP OpenView Network Node Manager: heap-based buffer overflow in ovsessionmgr.exe, CVSS 10.0
CVE-2009-4177: HP OpenView Network Node Manager: buffer overflow in webappmon.exe CGI via Host header, CVSS 10.0
CVE-2009-4178: HP OpenView Network Node Manager: heap-based buffer overflow in OvWebHelp.exe via Topic parameter, CVSS 10.0
CVE-2009-4179: HP OpenView Network Node Manager: stack-based buffer overflow in ovalarm.exe via Accept-Language header, CVSS 10.0
CVE-2009-4180: HP OpenView Network Node Manager: stack-based buffer overflow in snmpviewer.exe via Host header, CVSS 10.0
CVE-2009-4181: HP OpenView Network Node Manager: heap-based buffer overflow in OvCgi/Toolbar.exe, CVSS 10.0
CVE-2009-1539: Microsoft DirectShow: size validation vulnerability in QuickTime media file parsing enabling RCE
CVE-2009-0909: VMware Workstation / Player / ACE / Server: heap-based buffer overflow in VNnc Codec enabling RCE
CVE-2009-0910: VMware Workstation / Player / ACE / Server: heap-based buffer overflow in VNnc Codec
CVE-2009-1544: Microsoft Windows Workstation Service: NetrGetJoinInformation heap corruption enabling RCE
CVE-2008-4030: Microsoft Office Word: resource management error in RTF file parsing enabling RCE
CVE-2008-4031: Microsoft Office Word: resource management error in RTF handling enabling RCE
CVE-2008-3479: Microsoft MSMQ: remote code execution via malformed RPC request; w/ Cody Pierce
CVE-2008-2468: LANDesk Management Suite: buffer overflow in QIP Server Service enabling RCE, CVSS 10.0
CVE-2008-0027: Cisco Unified CallManager: CTLProvider heap overflow enabling RCE
CVE-2008-0033: Apple QuickTime: IDSC atom memory corruption enabling RCE
CVE-2007-6242: Adobe Flash Player: improper input validation enabling code execution
CVE-2007-6026: Microsoft Office Access: stack-based buffer overflow in Jet Engine enabling RCE
CVE-2007-5082: CA BrightStor ARCserve Backup HSM: RCE vulnerability; w/ Sean Larsson
CVE-2007-5083: CA BrightStor ARCserve Backup HSM: DoS vulnerability; w/ Sean Larsson
CVE-2007-5084: CA BrightStor ARCserve Backup HSM: RCE vulnerability; w/ Sean Larsson
CVE-2007-5323: EMC Replistor: buffer overflow in server service enabling RCE, CVSS 10.0
CVE-2007-2417: Progress Software OpenEdge: heap-based buffer overflow in _mprosrv.exe, CVSS 10.0
CVE-2007-2280: HP OpenView Data Protector: stack-based buffer overflow in Omnilnet.exe on TCP port 5555
CVE-2007-2279: Symantec Storage Foundation for Windows: authentication bypass enabling arbitrary code execution
CVE-2007-1868: IBM Tivoli Provisioning Manager for OS Deployment: multiple stack overflows in HTTP service enabling RCE
CVE-2007-1862: Apache HTTP Server mod_mem_cache: information disclosure via improper memory handling returning previous request headers
CVE-2007-1676: HP OpenView Shared Trace Service: stack-based buffer overflows in ovtrcsvc.exe and OVTrace.exe via crafted requests to opcode handlers 0x1a and 0x0f
CVE-2007-1674: LANDesk Management Suite: stack-based buffer overflow in Alert Service, CVSS 10.0
CVE-2007-1070: Trend Micro ServerProtect: stack overflows in StCommon.dll and eng50.dll enabling RCE
CVE-2006-5820: America Online SuperBuddy: ActiveX control code execution
CVE-2007-0754: Apple QuickTime: STSD atom heap overflow enabling RCE
CVE-2007-3566: Borland InterBase: ibserver.exe create-request buffer overflow enabling RCE
CVE-2007-4827: Automated Solutions Modbus TCP Slave: ActiveX control heap corruption
CVE-2006-5782: HP OpenView Client Configuration Manager: device code execution vulnerability
CVE-2006-6334: Citrix Presentation Server Client: heap-based buffer overflow

HISTORY

Mindgard - Chief Product Officer

Leading product strategy and vision for Mindgard's AI security platform, driving the roadmap for automated red-teaming and adversarial AI testing solutions.

Mindgard - Head of Research & Innovation

Defining strategy and overseeing research efforts to build the world's most advanced automated red-teaming solution for AI systems.

Dartmouth College - Hacker Fellow

Appointed to advise the Institute for Security, Technology, and Society on offensive security strategy, AI safety, and public-interest technology. Provides guidance on cross-disciplinary research initiatives involving machine learning, secure systems, and vulnerability discovery.

Dartmouth College - Hacker-in-Residence

Bridges academia and industry through mentorship, research collaboration, and curriculum development. Designed and taught courses on reverse engineering and software exploitation, and advised the formation of a student-led cybersecurity group.

IBM - Program Director

Directed applied research within a global security software organization. Led development of novel exploitation tools, resulting in measurable improvements across product lines. Defined strategic direction for SaaS security offerings, aligning research efforts with enterprise-scale impact.

Randori - Director of R&D

Led research and development through the company’s hypergrowth phase, culminating in an acquisition by IBM. Directed zero-day vulnerability discovery efforts and introduced attack emulation frameworks that influenced industry understanding of Attack Surface Management.

Boldend - Director of Research

Directed internal research on offensive capabilities with an emphasis on wireless exploitation and threat prototyping. Bridged the gap between R&D and strategic planning by aligning low-level vulnerability research with product and client needs.

Raytheon - Sr. Principal Cyber Engineer

Served as senior technical lead within a cleared offensive programs division. Delivered zero-day tooling integrated into defense systems and introduced efficiency-focused exploitation methodologies that accelerated project timelines.

Exodus Intelligence - Co-Founder & CTO

Co-founded and scaled a commercial zero-day vulnerability intelligence provider. Delivered original research to elite clients including government and defense agencies, and led discovery efforts resulting in dozens of critical vulnerability disclosures.

Zero Day Initiative - Manager, Security Research

Led the world’s largest vendor-agnostic vulnerability acquisition program. Created and judged the Pwn2Own competition, influencing industry patch cycles and responsible disclosure policies adopted globally by major vendors.