In the high-stakes world of cybersecurity, where the line between protecting critical infrastructure and exploiting it is often razor-thin, Corey Thuen stands out as a bridge between two worlds. As the founder and CEO of Gravwell, a data analytics and vulnerability detection firm, Thuen has built his professional identity on a singular, unconventional philosophy: that the most effective way to secure a system is to possess the innate, adversarial drive of a hacker—what he describes as the “evil bit.”
For Thuen, a hacker is not defined by malice, but by a specific cognitive orientation—a "hacker mindset" that is fundamentally focused on finding the right way to do the "wrong" things in order to achieve the "right" result. This perspective defines the culture at Gravwell, which combines the rigor of big data expertise with the subversive, inquisitive spirit of the hacking community.
The Search for the "Evil Bit"
When recruiting for his team, Thuen looks for a specific, almost intangible quality. “Do they have that ‘evil streak’?” he asks. “Do they have that adversarial mindset that can look at a product and seek out ways to exploit it? If they don’t have that ‘evil bit,’ I don’t think we can teach it.”
Thuen acknowledges that while some might argue such a trait can be developed, his own experience suggests it is a natural-born quality—an inherent curiosity that compels an individual to deconstruct systems to see how they tick. However, he is quick to clarify that “evil,” in his vocabulary, is not a moral failing. It is a functional, tactical approach to problem-solving.
“Who defines morality? Who defines what is good and what is bad?” Thuen muses, reflecting on the lingering ethos of early hacking culture, which often held that information should be free and accessible—a view that remains controversial in some circles. For Thuen, the morality of hacking is defined entirely by intent and application.
“I was recently working for the US government, evaluating systems that go into power substations—part of the critical infrastructure,” he explains. “We were hacking these systems, but the goal was to improve security for everyone. We were using the evil streak for good. Hacking skills are a bit like guns. Neither are evil in themselves. They can be used for both good and bad purposes depending on the motives of the user.”
From Packard Bell to the Gibson
Thuen’s fascination with technology began long before he was an industry leader. Growing up in a household with no particular background in technology, his curiosity was entirely self-directed. The turning point came in high school, when an uncle gifted him an old Packard Bell computer. Thuen immediately immersed himself in the technical foundations of his machine, reading the DOS manual from cover to cover.
This curiosity naturally drifted toward the digital frontiers of the era: video games. Like many of his generation, he found his gateway into hacking through the manipulation of game save files. Using a hex editor to change his character’s life count to infinity, he discovered the power of altering data to circumvent the rules set by developers. His desire to learn was further galvanized by the 1995 film Hackers. “It was like, ‘Oh my gosh! I want to do that,’” he recalls. “I want to fly around in cyberspace and hack the Gibson.”
While he never engaged in malicious activity, his youthful exploration was driven by a pure, almost naive curiosity. He would frequently stumble upon systems by dialing into unknown networks, not to cause harm, but simply to satisfy his need to understand what lay behind the connection. He practiced SQL injection on databases he built himself, not to exploit external targets, but to master the mechanics of the vulnerability. It was a line he never crossed; he was, in his own words, “not much of a rule-breaker.”
Academic Foundations and Government Service
Thuen’s path to professional security was paved through formal education at the University of North Dakota, where he earned a bachelor’s degree in computer science. While he found the curriculum technically sound, he felt it lacked a specialized security focus. He credits the unique geography of North Dakota for aiding his early development; the flat landscape made running cables for his dial-up experiments a simple endeavor.
He later pursued a master’s degree at the University of Idaho through a Scholarship for Service (SFS) program. This government-funded initiative came with a requirement: upon graduation, recipients were obligated to serve the public sector. For Thuen, this meant evaluating his options for government work. While many peers headed to the East Coast, Thuen, who hailed from a small town of roughly 7,000 people, found the prospect unappealing. He ultimately secured a role at the Idaho National Laboratory (INL), a move that would prove to be the most influential chapter of his career.
Managed by the Battelle Energy Alliance (BEA), the INL is a global powerhouse in nuclear energy research and a leader in protecting industrial control systems (ICS) and operational technology (OT). It was here that Thuen met Kristopher Watts, his future co-founder at Gravwell. Working at the INL “kicked the doors open” for his career, providing a high-stakes environment where he could refine his skills in ICS cybersecurity.
The Southfork Saga and the Lessons of Adversity
In 2013, Thuen left the INL to co-found Southfork Security alongside Kenneth Shaw. It was his first attempt to “hang a shingle” in the private sector, but the endeavor quickly devolved into a complex legal battle. Thuen and Shaw had worked on an ICS cybersecurity tool called “Sophia” during their tenure at the INL. When they attempted to commercialize their own expertise, they found themselves locked in a bidding process for the software they helped build.
When they didn’t win the bid, Thuen began developing an open-source alternative called “Visdom.” The resulting lawsuit from the BEA, which alleged copyright infringement and trade secret misappropriation, became a cautionary tale about the stigma surrounding the term “hacker.”
During the legal proceedings, the BEA used Thuen’s own descriptions of his work—such as “we hack things and make tools”—to paint him as a malicious actor who might destroy evidence. Though the court eventually rejected several of the BEA’s requests for injunctions and summary judgments, the financial strain of the legal battle forced a private settlement. Thuen was forced to surrender Visdom and dissolve Southfork, an experience that left a lasting impact on his view of the industry and the judicial system’s struggle to understand the nuances of the cybersecurity profession.
Defining Defense through Data
Following the dissolution of Southfork, Thuen moved to Digital Bond and later IOActive, where he continued his focus on ICS, IoT security, and vulnerability research. In 2017, he launched Gravwell, a platform designed to provide deep analytics for security logs and network data.
Thuen’s philosophy at Gravwell remains rooted in the idea that defense requires more than just chasing threats; it requires a deep, intimate understanding of one’s own environment. “I believe that defense involves more than looking for how threat actor XYZ operates,” he says. “It requires an understanding of the environment and maximizing the primary advantage that defense has—this is your turf and no one knows it like you do.”
His work remains centered on ICS, a field he finds uniquely challenging because it lacks the uniformity of general IT systems. “You’re doing protocol reverse engineering, including some custom protocols that you must dissect and do low-level network binary type things,” he explains. “All that was super interesting.”
A Complex Legacy
Corey Thuen remains a complex, often contradictory figure. He possesses the rebellious, non-conformist spirit of a classic hacker, yet he is a builder of enterprise-grade defenses. He speaks of “spite” as a professional driver—a desire to prove wrong those who claim a system is “unhackable”—but frames it as a constructive force that pushes his team to achieve the impossible.
Nearly a decade after founding Gravwell, Thuen continues to operate with a mixture of humor, technical grit, and an unwavering belief in his own methodology. He is a man who has navigated the messy intersections of academia, government research, private industry, and litigation, always maintaining that the “evil bit” is not a sign of moral corruption, but a necessary tool for those tasked with securing the world’s most critical systems. In the end, Thuen’s journey is defined not by the systems he might have broken, but by the ones he has fought so hard to defend.
