Community Contributions

Kubernetes SIG Security contributor and CNCF SIG Security member, with security reviews in Kubernetes' early years. Certified Kubernetes Security Specialist (CKS) and Administrator (CKA).

Security research on video and audio: the W8MEJ YouTube channel, Complex Systems Live on Twitch, and the Zero Noise Collective podcast.

Vetted member of Project Glasswing and the Anthropic Cyber Verification Program, involved since each launched in April 2026.

Run two public security-metrics labs: IntelMetrics, which continuously ingests global threat feeds (including MISP) into metrics and attribution insights, and VulnMetrics, which parses and prioritizes the NVD to measure the gap between disclosure and patch.

OWASP CFP and CFW review board; Kubernetes SIG Security and CNCF SIG Security; Cloud Security Alliance steering committee; contributor to the White House Executive Order on AI and NSTIC; co-author of the TAME/AARM agent-security governance frameworks; InfraGard; DoD satellite communications.

148 posts since 2011, including four research series: Autonomous AI SOC (8 episodes, 2025), Morphogenetic SOC (9, 2026), Project Butterfly of Damocles (10, 2026), and Beyond Verifiable Reward (12, 2026).

Participant in the DARPA AI Cyber Challenge (AIxCC), which asked teams to build AI systems that find and fix vulnerabilities in open-source software.

White House Letter of Recognition; US Senate, US House, and Michigan State Senate resolutions; commendations from four military branches; wreath bearer at the Tomb of the Unknown Soldier; Black Badge.

A security roadmap for startups, organized by funding stage, drawn from being the first security hire at NetSuite, Plastiq, and SeedFi.

Two open-source research prototypes. zk-Autograd proves each optimizer step of PyTorch training with EZKL (Halo2) zk-SNARK proofs generated inside AWS Nitro Enclaves or OCI Confidential VMs. Mimir lets mutually distrustful parties run transformer inference together using SPDZ-style multi-party computation behind attested enclaves.

Open-source toolkit (12 repositories): YubiKey PIV and FIDO2 credentials backing HashiCorp Vault SSH certificates and dynamic database credentials, FROST threshold-signed API keys with OPA, Terraform state protection, and credential rotation across AWS, OCI, GCP, and Azure.

Talks and lectures since 2002, including DEF CON 22 and 23, Chaos Communication Camp, ToorCon, DerbyCon, GrrCON, ROOTCON, BSides, Stanford, JavaOne, and ISC2, where he is listed as a Top Rated Speaker.

Finalist (2016) with Team CodeJitsu and its bot Galactica, which placed 2nd in proven vulnerabilities. Role: technical strategist, supplying formal analysis for the hybrid symbolic-execution and greybox-fuzzing engine and game-theoretic strategy for exploit-versus-patch scoring. CGC was the first all-machine hacking tournament: autonomous systems found, exploited, and patched vulnerabilities without human help.