Founded ForAllSecure with David Brumley and Thanassis Avgerinos, participating in almost every role along the way. During this time, ForAllSecure grew from one employee to over 30, zero dollars in revenue to seven figures in annually recurring revenue.Led the team building Mayhem, one of the first generation of autonomous computer security bots that finds, exploits and fixes vulnerabilities without human intervention. Mayhem won the $2M first prize at the DARPA Cyber Grand Challenge in 2016. Mayhem was displayed at the Smithsonian National Museum of American History.Led a cross-functional team in creating our second product: Mayhem for API, a point-and-shoot fuzzer for web APIs using OpenAPI specifications for input generation. Fuzzer and backend was written in Rust and hosted on GCP (Cloud SQL, Cloud Run, PubSub). Deployed using terraform. Built a SaaS subscription model with a free trial on top of Stripe. Collaborated with GitHub to add Mayhem for API as one of the few GitHub Code Scanning applications that GitHub customers can use to secure their APIs in CI.Built a large-scale distributed fuzzing infrastructure to productize fuzzing. The infra ran on GKE, deployed with helm. The system ingests software to test as docker containers and runs them with runc for dynamic analysis (QEMU, ASAN, valgrind) to find bugs.Bootstrapped an SRE culture & built observability in our systems using fluentd for shipping logs to ElasicSearch, using Prometheus & Alertmanager to collect metrics and alerting, and using Sentry for error monitoring.Built an online CTF platform. Built and ran picoCTF's infrastructure and frontend for 18,000 high school students. API was in Flask, hosted on AWS Elastic Beanstalk. Repeatedly ran online & live CTFs for the US military academies & DoD.

Created Veritesting, which combines static and dynamic symbolic execution to tackle the path explosion problem. Veritesting finds twice as many bugs, explores orders of magnitude more paths, and achieves higher code coverage than dynamic symbolic execution.Found 13,875 bugs in Debian packages at a compute cost of $0.28 per bug. Reported 1,200 bugs back to Debian, 400+ of which were fixed.