The "Evil Bit": Corey Thuen and the Mindset of a Modern Security Architect

In the high-stakes world of cybersecurity, there is a recurring debate over what truly defines a hacker. Is it a set of technical skills, a career path, or something more fundamental? For Corey Thuen, founder and CEO of Gravwell, the answer lies in a specific, almost intangible quality he calls "the evil bit." It is a mindset characterized by a relentless, adversarial curiosity—a drive to look at a system not just for how it works, but for how it might be subverted to achieve a particular result.

Thuen’s company, Gravwell, operates with a unique internal culture that bridges the gap between big data engineering and offensive security. By cultivating a team that blends data analytics experts with seasoned hackers, Thuen is attempting to solve the complex challenges of modern vulnerability detection. When hiring for the "hacker" side of his team, Thuen looks for that specific spark. "Do they have that ‘evil streak’?" he asks. "Do they have that adversarial mindset that can look at a product and seek out ways to exploit it? If they don’t have that evil bit, I don’t think we can teach it." While he concedes that some might develop these traits through rigorous training, his experience suggests it is a natural, inherent quality.

Defining the Hacker Ethos

The term "evil" in this context is frequently misunderstood. To Thuen, it does not imply a lack of morality; rather, it is a toolset, much like a firearm, whose ultimate impact depends entirely on the hands that wield it. He points to his own work with the U.S. government, where he was tasked with evaluating the security of power substations and critical infrastructure. In that environment, the "evil streak" was channeled toward protecting the public, using offensive techniques to harden defenses against potential adversaries.

"Who defines morality?" Thuen asks. "Who defines what is good and what is bad? The old school hacking ethos, which still lingers, is that all information should be free. Other folks consider that a bad viewpoint." For Thuen, the distinction between a malicious actor and a security researcher is defined by intent and the application of those skills, not the skills themselves.

From Childhood Curiosity to Professional Pursuit

Thuen’s journey into the world of technology began long before it was a professional necessity. Raised in a household without a tech background, his first real brush with computing came in high school when an uncle gifted him an aging Packard Bell computer. With no guidance or resources, he turned to the only manual he had: the DOS instruction guide. He read it cover to cover, teaching himself the fundamentals of how machines process commands.

Like many in his generation, his interest was galvanized by video games. He quickly moved from playing to tinkering, using hex editors to manipulate save files to grant himself infinite lives. This early experimentation was followed by the cultural phenomenon of the 1995 film Hackers. The depiction of "flying through cyberspace" and challenging institutional security resonated deeply with him.

However, despite his youthful enthusiasm, Thuen never veered into malicious territory. His exploration was driven by a genuine, naive curiosity. "Back then, it wasn’t crystal clear that we were doing anything wrong," he recalls. "We didn’t realize we could get into trouble. It was simply, ‘If I dial this number, I get into this system. What is it? I don’t know, so I’ll poke around a bit.’" This was the era of discovery, not exploitation. He would go as far as setting up his own test databases to understand vulnerabilities like SQL injection, but he maintained a self-imposed boundary: he was a builder and a learner, not a rule-breaker.

Academic Foundations and the Government Path

Thuen pursued this passion formally, earning a bachelor’s degree in computer science from the University of North Dakota. While the program provided a strong technical foundation, he found it lacking in dedicated security coursework. He credits the geographic isolation of North Dakota—and the ease of running cables across its flat landscape—as an unconventional contributor to his early skill development.

He later moved to the University of Idaho for a master’s degree, joining a Scholarship for Service (SFS) program. This government-funded initiative required a commitment to work for federal institutions upon graduation, a path that ultimately led him to the Idaho National Laboratory (INL). At the time, INL was, and remains, a globally recognized authority on the protection of Industrial Control Systems (ICS) and Operational Technology (OT). It was here that Thuen truly honed his craft, working alongside Kristopher Watts, who would eventually become his co-founder at Gravwell.

The Southfork Security Saga

In 2013, Thuen and Kenneth Shaw left INL to launch Southfork Security, a venture born from the desire to bring advanced security testing to the private sector. It was here that Thuen’s professional life became complicated. During his time at INL, he and Shaw had worked on an ICS cybersecurity tool known as "Sophia." When Southfork sought to commercialize similar technology, they found themselves in a difficult legal position.

After their bid to commercialize Sophia was rejected, Thuen began developing an open-source alternative called Visdom. The ensuing conflict with the Battelle Energy Alliance (BEA)—the private entity managing INL—led to a lawsuit alleging copyright infringement and trade secret misappropriation.

The case, which involved the forensic imaging of Thuen’s computers, was heavily influenced by the court’s initial perception of hackers. Prosecutors painted Thuen as a malicious actor, citing his own descriptions of his work—"We hack things and make tools"—as evidence of criminal intent. Although the case saw shifts in judicial favor, with some of the BEA’s requests for injunctions denied, the financial toll of the litigation eventually forced a settlement. Southfork was dissolved, and the Visdom project was surrendered. It remains a defining moment in Thuen’s career, illustrating the friction that can occur when the "hacker mindset" meets traditional institutional and legal structures.

Building Gravwell and the Philosophy of Defense

Following his time at Southfork, Thuen spent years as a researcher and consultant at Digital Bond and IOActive, deepening his expertise in ICS, IoT, and 0-day vulnerability research. In 2017, he founded Gravwell, where he remains CEO today.

Gravwell is designed as a data analytics platform that helps organizations make sense of complex security logs and network data. Thuen’s philosophy is that true defense is not merely about tracking the signatures of known threats, but about a deep, intimate understanding of one’s own environment. "You’re doing protocol reverse engineering, including some custom protocols that you must dissect and do low-level network binary type things," he notes. "All that was super interesting. General IT systems have kind of coalesced around certain technologies—everything is web now, for example. So, ICS stuff is challenging and quite interesting."

Thuen’s approach to leadership is heavily influenced by his "overactive sense of justice and an overactive sense of spite." He uses this to drive his team, often framing challenges around the idea that something is "unhackable." In the world of hackers, such a claim is an invitation, not a deterrent. By challenging his team to prove the impossible, he taps into the very curiosity that once led him to explore the limits of his first Packard Bell.

Nearly a decade after founding Gravwell, Thuen continues to balance the two sides of his personality: the hacker who wants to break things to understand them, and the entrepreneur who builds tools to defend them. He remains a complex figure, one who operates with a sense of humor and a pragmatic view of the industry, forever searching for that "evil bit" in the next generation of security professionals. For Thuen, the work is never just about the code; it is about the mindset required to navigate a world that is increasingly defined by the very systems he spent his life learning to take apart.