{"id":2416,"date":"2026-10-22T22:36:15","date_gmt":"2026-10-22T22:36:15","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=2416"},"modified":"2026-10-22T22:36:15","modified_gmt":"2026-10-22T22:36:15","slug":"the-hacker-mindset-corey-thuen-on-the-ethics-of-the-evil-bit-and-the-evolution-of-data-defense","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=2416","title":{"rendered":"The Hacker Mindset: Corey Thuen on the Ethics of the "Evil Bit" and the Evolution of Data Defense"},"content":{"rendered":"

In the high-stakes world of cybersecurity, where the line between protecting critical infrastructure and exploiting it is often razor-thin, Corey Thuen stands out as a bridge between two worlds. As the founder and CEO of Gravwell, a data analytics and vulnerability detection firm, Thuen has built his professional identity on a singular, unconventional philosophy: that the most effective way to secure a system is to possess the innate, adversarial drive of a hacker\u2014what he describes as the \u201cevil bit.\u201d<\/p>\n

For Thuen, a hacker is not defined by malice, but by a specific cognitive orientation\u2014a "hacker mindset" that is fundamentally focused on finding the right way to do the "wrong" things in order to achieve the "right" result. This perspective defines the culture at Gravwell, which combines the rigor of big data expertise with the subversive, inquisitive spirit of the hacking community.<\/p>\n

The Search for the "Evil Bit"<\/h3>\n

When recruiting for his team, Thuen looks for a specific, almost intangible quality. \u201cDo they have that \u2018evil streak\u2019?\u201d he asks. \u201cDo they have that adversarial mindset that can look at a product and seek out ways to exploit it? If they don\u2019t have that \u2018evil bit,\u2019 I don\u2019t think we can teach it.\u201d<\/p>\n

Thuen acknowledges that while some might argue such a trait can be developed, his own experience suggests it is a natural-born quality\u2014an inherent curiosity that compels an individual to deconstruct systems to see how they tick. However, he is quick to clarify that \u201cevil,\u201d in his vocabulary, is not a moral failing. It is a functional, tactical approach to problem-solving.<\/p>\n

\u201cWho defines morality? Who defines what is good and what is bad?\u201d Thuen muses, reflecting on the lingering ethos of early hacking culture, which often held that information should be free and accessible\u2014a view that remains controversial in some circles. For Thuen, the morality of hacking is defined entirely by intent and application. <\/p>\n

\u201cI was recently working for the US government, evaluating systems that go into power substations\u2014part of the critical infrastructure,\u201d he explains. \u201cWe were hacking these systems, but the goal was to improve security for everyone. We were using the evil streak for good. Hacking skills are a bit like guns. Neither are evil in themselves. They can be used for both good and bad purposes depending on the motives of the user.\u201d<\/p>\n

From Packard Bell to the Gibson<\/h3>\n

Thuen\u2019s fascination with technology began long before he was an industry leader. Growing up in a household with no particular background in technology, his curiosity was entirely self-directed. The turning point came in high school, when an uncle gifted him an old Packard Bell computer. Thuen immediately immersed himself in the technical foundations of his machine, reading the DOS manual from cover to cover.<\/p>\n

This curiosity naturally drifted toward the digital frontiers of the era: video games. Like many of his generation, he found his gateway into hacking through the manipulation of game save files. Using a hex editor to change his character\u2019s life count to infinity, he discovered the power of altering data to circumvent the rules set by developers. His desire to learn was further galvanized by the 1995 film Hackers<\/em>. \u201cIt was like, \u2018Oh my gosh! I want to do that,\u2019\u201d he recalls. \u201cI want to fly around in cyberspace and hack the Gibson.\u201d<\/p>\n

While he never engaged in malicious activity, his youthful exploration was driven by a pure, almost naive curiosity. He would frequently stumble upon systems by dialing into unknown networks, not to cause harm, but simply to satisfy his need to understand what lay behind the connection. He practiced SQL injection on databases he built himself, not to exploit external targets, but to master the mechanics of the vulnerability. It was a line he never crossed; he was, in his own words, \u201cnot much of a rule-breaker.\u201d<\/p>\n

Academic Foundations and Government Service<\/h3>\n

Thuen\u2019s path to professional security was paved through formal education at the University of North Dakota, where he earned a bachelor\u2019s degree in computer science. While he found the curriculum technically sound, he felt it lacked a specialized security focus. He credits the unique geography of North Dakota for aiding his early development; the flat landscape made running cables for his dial-up experiments a simple endeavor.<\/p>\n

\"Hacker<\/figure>\n

He later pursued a master\u2019s degree at the University of Idaho through a Scholarship for Service (SFS) program. This government-funded initiative came with a requirement: upon graduation, recipients were obligated to serve the public sector. For Thuen, this meant evaluating his options for government work. While many peers headed to the East Coast, Thuen, who hailed from a small town of roughly 7,000 people, found the prospect unappealing. He ultimately secured a role at the Idaho National Laboratory (INL), a move that would prove to be the most influential chapter of his career.<\/p>\n

Managed by the Battelle Energy Alliance (BEA), the INL is a global powerhouse in nuclear energy research and a leader in protecting industrial control systems (ICS) and operational technology (OT). It was here that Thuen met Kristopher Watts, his future co-founder at Gravwell. Working at the INL \u201ckicked the doors open\u201d for his career, providing a high-stakes environment where he could refine his skills in ICS cybersecurity.<\/p>\n

The Southfork Saga and the Lessons of Adversity<\/h3>\n

In 2013, Thuen left the INL to co-found Southfork Security alongside Kenneth Shaw. It was his first attempt to \u201chang a shingle\u201d in the private sector, but the endeavor quickly devolved into a complex legal battle. Thuen and Shaw had worked on an ICS cybersecurity tool called \u201cSophia\u201d during their tenure at the INL. When they attempted to commercialize their own expertise, they found themselves locked in a bidding process for the software they helped build. <\/p>\n

When they didn\u2019t win the bid, Thuen began developing an open-source alternative called \u201cVisdom.\u201d The resulting lawsuit from the BEA, which alleged copyright infringement and trade secret misappropriation, became a cautionary tale about the stigma surrounding the term \u201chacker.\u201d <\/p>\n

During the legal proceedings, the BEA used Thuen\u2019s own descriptions of his work\u2014such as \u201cwe hack things and make tools\u201d\u2014to paint him as a malicious actor who might destroy evidence. Though the court eventually rejected several of the BEA\u2019s requests for injunctions and summary judgments, the financial strain of the legal battle forced a private settlement. Thuen was forced to surrender Visdom and dissolve Southfork, an experience that left a lasting impact on his view of the industry and the judicial system\u2019s struggle to understand the nuances of the cybersecurity profession.<\/p>\n

Defining Defense through Data<\/h3>\n

Following the dissolution of Southfork, Thuen moved to Digital Bond and later IOActive, where he continued his focus on ICS, IoT security, and vulnerability research. In 2017, he launched Gravwell, a platform designed to provide deep analytics for security logs and network data. <\/p>\n

Thuen\u2019s philosophy at Gravwell remains rooted in the idea that defense requires more than just chasing threats; it requires a deep, intimate understanding of one\u2019s own environment. \u201cI believe that defense involves more than looking for how threat actor XYZ operates,\u201d he says. \u201cIt requires an understanding of the environment and maximizing the primary advantage that defense has\u2014this is your turf and no one knows it like you do.\u201d<\/p>\n

His work remains centered on ICS, a field he finds uniquely challenging because it lacks the uniformity of general IT systems. \u201cYou\u2019re doing protocol reverse engineering, including some custom protocols that you must dissect and do low-level network binary type things,\u201d he explains. \u201cAll that was super interesting.\u201d<\/p>\n

A Complex Legacy<\/h3>\n

Corey Thuen remains a complex, often contradictory figure. He possesses the rebellious, non-conformist spirit of a classic hacker, yet he is a builder of enterprise-grade defenses. He speaks of \u201cspite\u201d as a professional driver\u2014a desire to prove wrong those who claim a system is \u201cunhackable\u201d\u2014but frames it as a constructive force that pushes his team to achieve the impossible. <\/p>\n

Nearly a decade after founding Gravwell, Thuen continues to operate with a mixture of humor, technical grit, and an unwavering belief in his own methodology. He is a man who has navigated the messy intersections of academia, government research, private industry, and litigation, always maintaining that the \u201cevil bit\u201d is not a sign of moral corruption, but a necessary tool for those tasked with securing the world\u2019s most critical systems. In the end, Thuen\u2019s journey is defined not by the systems he might have broken, but by the ones he has fought so hard to defend.<\/p>\n","protected":false},"excerpt":{"rendered":"

In the high-stakes world of cybersecurity, where the line between protecting critical infrastructure and exploiting it is often razor-thin, Corey Thuen stands out as a bridge between two worlds. As the founder and CEO of Gravwell, a data analytics and vulnerability detection firm, Thuen has built his professional identity on a singular, unconventional philosophy: that<\/p>\n","protected":false},"author":9,"featured_media":2415,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[373],"tags":[374,2019,206,146,2021,2022,1633,151,144,2018,5,2020,202],"class_list":["post-2416","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bug-bounty-vulnerabilities","tag-bug-bounty","tag-corey","tag-data","tag-defense","tag-ethics","tag-evil","tag-evolution","tag-hacker","tag-hacking","tag-mindset","tag-security","tag-thuen","tag-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2416"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2416\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2415"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}