Corey Thuen is a hacker by nature, defined not by the tools he uses, but by a distinct psychological framework. It is a mindset focused on the "right way to do wrong things" to achieve the ultimate goal of security. As the founder and CEO of Gravwell, Thuen leads a firm that occupies a unique niche in the cybersecurity landscape, blending the technical rigor of big data analytics with the unconventional, adversarial intuition of the hacker community.
When Thuen evaluates candidates for the offensive-security side of his team, he looks for a specific, almost intangible quality he calls the "evil bit." It is a shorthand for that innate adversarial streak—the ability to look at a robust, complex product and instinctively hunt for the structural weaknesses that others miss. Thuen is skeptical about the ability to teach this trait. While he concedes that some may be able to cultivate it through years of exposure, his experience suggests that the "evil bit" is often a fundamental characteristic. It is either present, or it is not. To describe Thuen as a "natural-born hacker" is not just a biographical detail; it is the most accurate summary of his professional identity.
However, in an industry where the term "hacker" is still often burdened with negative connotations, the word "evil" warrants clarification. When asked if this indicates a lack of morality, Thuen pushes back, questioning the objective definition of the term itself. He points to the lingering influence of the old-school hacking ethos—the belief that information should be free—which some view as a noble pursuit and others as a dangerous violation of boundaries.
For Thuen, the morality of hacking is entirely contextual. "I was recently working for the US government, evaluating systems that go into power substations, which are part of our critical infrastructure," he explains. "We were hacking these systems, but the goal was to improve security for everyone. We were using the ‘evil streak’ for good." He draws a parallel between hacking skills and firearms: neither is inherently evil; the morality lies solely in the hands and the motives of the user.
A Childhood of Curiosity
Thuen’s trajectory into the world of bits and bytes began long before it was a viable career path. He recalls knowing he was a hacker from a very young age, driven by an insatiable need to understand the underlying mechanics of computers. Growing up in a household with no particular background in technology, his primary resource was his own curiosity. That changed in high school when his uncle provided the family with an aging Packard Bell computer. Thuen’s first act was to read the DOS manual from cover to cover, a rite of passage that laid the foundation for his technical literacy.
His interest soon migrated to the world of video games—a common gateway for many of today’s security professionals. With access to game save files and a hex editor, he began experimenting. "Where are the bytes that control how many lives I’ve got? Can I change them to give myself infinite lives?" he recalls. The cultural influence of the 1995 film Hackers further fueled his imagination, sparking a desire to navigate cyberspace and challenge digital systems.
Despite these youthful experiments, Thuen never veered into the territory of malicious or illegal activity. He describes his early hacking as a product of genuine, unfiltered curiosity rather than an intent to do harm. "Back then, it wasn’t crystal clear that we were doing anything wrong," he says. "We didn’t realize we could get into trouble. It was simply, ‘If I dial this number, I get into this system. What is it? I don’t know, so I’ll poke around a bit.’" He would create isolated environments to test vulnerabilities, such as setting up a database specifically to understand SQL injection, but he strictly avoided the line of targeting external systems. He was a curious experimenter, not a rule-breaker.
From Academic Foundations to the Idaho National Laboratory
Thuen’s formal education at the University of North Dakota provided him with a solid grounding in computer science. He notes, perhaps with a hint of humor, that the geography of the region—notably flat—made it easier to run cables, facilitating his early exploration of dial-up networking. While the curriculum was technically sound, he felt it lacked a dedicated security focus. He later pursued a master’s degree in computer science at the University of Idaho, participating in a Scholarship for Service (SFS) program. This government-funded initiative required a commitment to work for federal agencies post-graduation, a trade-off that would eventually lead him to the Idaho National Laboratory (INL).
INL is a powerhouse in the Department of Energy’s research portfolio, serving as a globally recognized authority on the protection of Industrial Control Systems (ICS) and Operational Technology (OT). Managed by the private Battelle Energy Alliance (BEA), the laboratory offered Thuen a professional environment that matched his technical interests. It was there that he met his future co-founder at Gravwell, Kristopher Watts. Thuen credits his tenure at INL with "kicking the doors open" for his deep dive into the inner workings of complex computing environments.
The Southfork Security Saga
Thuen remained at INL until 2013, when he and Kenneth Shaw left to co-found Southfork Security. It was an ambitious move, born of a desire to apply their specialized skills to the private sector. However, the launch of Southfork triggered a complex legal conflict involving their former work at the laboratory.
While at INL, Thuen and Shaw had been instrumental in developing an ICS cybersecurity tool called "Sophia." When they moved to the private sector, they hoped to participate in the commercialization process of that technology. When it became clear that their new firm would not win the bid, Thuen began developing an open-source alternative called "Visdom."
The situation spiraled into a contentious legal battle, with BEA suing Thuen and Southfork for copyright infringement and trade secret misappropriation, alleging that Visdom was derived from proprietary INL code. The litigation was aggressive; BEA secured an ex parte temporary restraining order, and at one point, the court’s perception of Thuen as a self-described "hacker" arguably colored the proceedings. Though the judge eventually rejected BEA’s request for summary judgment and the case showed signs of shifting in Thuen’s favor, the financial toll of the litigation proved unsustainable. The parties eventually reached a private settlement, resulting in the surrender of Visdom and the dissolution of Southfork Security.
A Shift Toward Gravwell and Offensive Security
Following the closure of Southfork, Thuen moved to Digital Bond in 2014, focusing on IoT and ICS security, before joining IOActive as a senior consultant in 2015. IOActive was a natural environment for his mindset; the firm’s culture embraced the idea of "pirates working on the right way to do wrong."
In 2017, Thuen founded Gravwell. Nearly a decade later, the company has evolved into a robust data analytics platform designed for security logs, machine data, and network traffic. Thuen’s philosophy on defense remains rooted in his offensive background. He argues that effective defense is not merely about tracking known threat actors, but about deep environmental awareness. "This is your turf and no one knows it like you do," he maintains.
His focus on ICS remains a defining feature of his work. Unlike the standardized nature of modern web-based IT, ICS requires complex protocol reverse engineering and a deep understanding of low-level network binaries. It is a challenging, niche field that continues to fascinate him, along with the related study of embedded systems in automotive research.
Throughout his career, Thuen has displayed a consistent, if complex, character. He possesses the hacker’s instinct for breaking things, yet he is balanced by an entrepreneurial drive to build solutions. He speaks of an "overactive sense of justice" and an "overactive sense of spite"—a psychological motivator where being told something is "unhackable" acts as a direct challenge. It is this combination of technical expertise, a relentless drive to solve the "impossible," and a healthy sense of skepticism that continues to define Corey Thuen’s contributions to the security industry.
