{"id":2475,"date":"2026-10-23T06:01:18","date_gmt":"2026-10-23T06:01:18","guid":{"rendered":"https:\/\/smartcryptosecurity.com\/?p=2475"},"modified":"2026-10-23T06:01:18","modified_gmt":"2026-10-23T06:01:18","slug":"the-hacker-mindset-corey-thuen-on-the-ethics-of-the-evil-bit-and-the-future-of-security","status":"publish","type":"post","link":"https:\/\/smartcryptosecurity.com\/?p=2475","title":{"rendered":"The Hacker Mindset: Corey Thuen on the Ethics of the "Evil Bit" and the Future of Security"},"content":{"rendered":"

Corey Thuen operates at the intersection of curiosity and calculated subversion. As the founder and CEO of Gravwell, a data analytics firm that bridges the gap between massive datasets and vulnerability detection, Thuen has built a career on a philosophy that is as provocative as it is practical: doing the right thing by understanding how to do the wrong thing perfectly. To Thuen, a true hacker isn’t defined by malicious intent, but by a specific cognitive orientation\u2014a "hacker mindset" that sees the world not as it is presented, but as a series of systems waiting to be interrogated.<\/p>\n

The Search for the "Evil Bit"<\/h3>\n

When Thuen sits across from a job candidate for his technical team, he isn’t just looking for certifications or a pedigree in computer science. He is searching for what he calls the "evil bit." It is an intangible quality, a streak of adversarial thinking that allows an individual to look at a locked door and immediately begin visualizing the hinges. <\/p>\n

"Do they have that evil streak?" Thuen asks. "Do they have that adversarial mindset that can look at a product and seek out ways to exploit it? If they don’t have that evil bit, I don’t think we can teach it." While he concedes that some might argue such a trait can be cultivated, his experience suggests it is a foundational characteristic\u2014a binary state that is either present or absent. For Thuen, the "natural-born hacker" is not a romanticized label, but a functional reality.<\/p>\n

This terminology inevitably raises questions about morality. When asked to define the thin line between "evil" and "good" in the context of hacking, Thuen offers a pragmatic perspective. "Who defines morality?" he counters. "Who defines what is good and what is bad? The old-school hacking ethos, which still lingers, is that all information should be free. Other folks consider that a bad viewpoint."<\/p>\n

Thuen illustrates this by pointing to his own career, particularly his tenure working with the U.S. government. "I was recently working for the US government. We were evaluating the systems that go into power substations, part of the critical infrastructure. So, we were hacking these systems, but the goal was to improve security for everyone. We were using the evil streak for good. Hacking skills are a bit like guns. Neither are evil in themselves. They can be used for both good and bad purposes depending on the motives of the user."<\/p>\n

From Packard Bell to the Gibson<\/h3>\n

Thuen\u2019s trajectory into the world of cybersecurity was not the result of a planned career path or a family legacy in technology. Raised in a household without a tech-focused background, his early exposure was entirely self-driven. The catalyst was a simple, hand-me-down Packard Bell computer acquired during his high school years. Lacking guidance or resources, Thuen relied on pure, unfiltered curiosity. The first thing he did was read the DOS manual from cover to cover, a rite of passage that set the stage for a lifetime of technical exploration.<\/p>\n

Like many in his generation, his gateway was the world of video games. He quickly moved from playing games to deconstructing them, utilizing hex editors to manipulate save files. "Where are the bytes that control how many lives I\u2019ve got?" he would wonder. "Can I change them to give myself infinite lives?" <\/p>\n

This period of discovery was heavily influenced by the cultural zeitgeist of the mid-90s, specifically the film Hackers<\/em>. "It was like, Oh my gosh! I want to do that," he recalls. "I want to fly around in cyberspace and hack the Gibson. All these guys are so cool!" <\/p>\n

While the film provided the aesthetic, Thuen\u2019s actual practice was grounded in a genuine desire to understand how systems operated. Even in his youth, he steered clear of malicious activity. He was "messing around," not breaking laws. "Back then, it wasn’t crystal clear that we were doing anything wrong," he notes. "We didn’t realize we could get into trouble. It was simply, ‘If I dial this number, I get into this system. What is it? I don’t know, so I’ll poke around a bit.’" <\/p>\n

This curiosity extended to setting up his own databases to practice SQL injection, not to exploit others, but to understand the mechanics of the vulnerability. "I wasn’t much of a rule-breaker," he says, defining a personal boundary he refused to cross.<\/p>\n

Education and the "Uncle Sam" Pipeline<\/h3>\n

Thuen\u2019s formal education at the University of North Dakota provided a solid computer science foundation, though he felt the curriculum lacked a dedicated security focus. He credits the geography of the region\u2014noted for being exceptionally flat\u2014as a factor that made running cables for dial-up experiments surprisingly easy. <\/p>\n

\"Hacker<\/figure>\n

His master\u2019s degree at the University of Idaho brought him into the government\u2019s Scholarship for Service (SFS) program. This arrangement required him to work for the federal government post-graduation, a trade-off he viewed as a fair exchange for the investment in his education. When it came time to fulfill that obligation, his desire to remain outside of the traditional East Coast tech hubs led him to the Idaho National Laboratory (INL).<\/p>\n

The INL, a Department of Energy institution managed by the Battelle Energy Alliance (BEA), served as a crucible for Thuen\u2019s career. It was here that he met Kristopher Watts, his future co-founder at Gravwell. The environment at the lab, with its focus on critical infrastructure and Industrial Control Systems (ICS), proved to be the perfect sandbox for a hacker interested in how things actually worked.<\/p>\n

The Southfork Saga and the Perils of Perception<\/h3>\n

In 2013, Thuen left the INL to co-found Southfork Security alongside Kenneth Shaw. It was his first attempt at "hanging a shingle," but it was marred by a complex and contentious legal battle with his former employer. <\/p>\n

The conflict centered on an ICS security tool called Sophia, which Thuen and Shaw had helped develop at the INL. When the firm failed to win the commercialization bid for the software, Thuen opted to build an open-source alternative, which he called Visdom. The BEA alleged that Visdom was derived from proprietary INL code, leading to a lawsuit involving claims of copyright infringement and trade secret misappropriation.<\/p>\n

The legal proceedings were defined by a bias that Thuen still points to as a fundamental misunderstanding of the hacker community. Because he and his partners openly described themselves as "hackers," the court initially viewed them through a lens of suspicion, fearing they were malicious actors who might destroy evidence. Though the judge eventually softened his stance and rejected several of the BEA\u2019s requests for summary judgment, the financial strain of the litigation forced a private settlement. Thuen was compelled to surrender the Visdom software, and Southfork Security effectively dissolved. <\/p>\n

Building the Future at Gravwell<\/h3>\n

Following the fallout of Southfork, Thuen spent time at Digital Bond and IOActive, deepening his expertise in ICS and IoT security. It was during these years that he solidified his focus on the offensive side of vulnerability research. Finally, in 2017, he founded Gravwell.<\/p>\n

Nearly a decade later, Gravwell stands as a testament to his evolution from a researcher to an entrepreneur. The company provides a data analytics platform designed to help organizations make sense of security logs and machine data. Thuen\u2019s philosophy on defense remains rooted in his offensive background: "I believe that defense involves more than looking for how threat actor XYZ operates, it requires an understanding of the environment and maximizing the primary advantage that defense has\u2014this is your turf and no one knows it like you do."<\/p>\n

For Thuen, the challenge of ICS remains a primary motivator. Unlike the standardized nature of modern web-based IT, ICS requires deep, low-level protocol reverse engineering and an intimate understanding of embedded systems\u2014work that he finds inherently fascinating.<\/p>\n

Ultimately, Corey Thuen is a portrait of a professional who has balanced a "hacker mindset" with a career dedicated to securing the systems that power modern life. He remains driven by an overactive sense of justice and a playful sense of "spite." When someone claims a system is unhackable, it is a challenge he cannot resist. "If I\u2019m told this cannot be done when it absolutely can, then I\u2019ll do it for spite," he says. "Just because you say something doesn’t mean it\u2019s true." <\/p>\n

It is this combination of technical brilliance, a penchant for defying authority, and a commitment to building robust defenses that defines his career. While he has weathered controversy and navigated the complex intersection of government service and private enterprise, Thuen remains exactly what he set out to be: a hacker, finding the right way to do the wrong thing, all for the right result.<\/p>\n","protected":false},"excerpt":{"rendered":"

Corey Thuen operates at the intersection of curiosity and calculated subversion. As the founder and…<\/p>\n","protected":false},"author":16,"featured_media":2474,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[432],"tags":[434,1980,435,2008,1979,1632,151,433,1982,5,1981],"class_list":["post-2475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hardware-security","tag-chips","tag-corey","tag-devices","tag-ethics","tag-evil","tag-future","tag-hacker","tag-hardware","tag-mindset","tag-security","tag-thuen"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2475"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2475\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2474"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}