Corey Thuen on Cybersecurity’s ‘Evil Bit’

Gravwell CEO Corey Thuen describes cybersecurity’s “evil bit” as the ability to examine a product and ask how it could be abused. He looks for that quality when hiring security researchers at Gravwell, the data analytics and vulnerability detection company he founded in 2017.

“Do they have that ‘evil streak’?” Thuen said. “Do they have that adversarial mindset that can look at a product and seek out ways to exploit it? If they don’t have that evil bit, I don’t think we can teach it.”

Thuen separates the mindset from a person’s motives. He compares hacking skills with guns, saying neither is inherently good or bad and that the result depends on how each is used. While working for the U.S. government, he evaluated systems used in power substations and other critical infrastructure.

“We were hacking these systems, but the goal was to improve security for everyone,” he said. “We were using the evil streak for good.”

Thuen became interested in computers in high school after an uncle gave his family an old Packard Bell. He read the DOS manual, experimented with video-game save files and used a hex editor to find data controlling features such as the number of lives available to a player. The 1995 film “Hackers” added to his interest in computer security.

He built test systems to study vulnerabilities such as SQL injection but did not search for outside systems to attack. He also recalled dialing into unfamiliar systems to see what they contained, without fully understanding the possible legal consequences.

Thuen earned a bachelor’s degree in computer science from the University of North Dakota and later completed a master’s degree at the University of Idaho through a government scholarship-for-service program. The program required him to work for the U.S. government after graduation.

He chose Idaho National Laboratory, where he worked on industrial control systems and met Kristopher Watts, who later became Gravwell’s chief technology officer. Thuen left the laboratory in 2013 and co-founded Southfork Security with Kenneth Shaw.

Southfork sought to commercialize Sophia, an industrial control systems security tool developed at the laboratory. After the company failed to win the bidding process, Thuen created Visdom, an open-source tool designed to address similar problems.

Battelle Energy Alliance, which manages Idaho National Laboratory for the U.S. Department of Energy, sued Thuen and Southfork. The company alleged copyright infringement, trade-secret misappropriation and breaches of employment agreements, claiming Visdom had been derived from proprietary laboratory code.

A court issued a temporary restraining order that allowed forensic experts to image Thuen’s computer drives and temporarily blocked the release of Visdom. The court later rejected Battelle’s request for a broader injunction and denied its request for summary judgment. The parties reached a private settlement before trial. Southfork surrendered Visdom and later dissolved.

Thuen worked at Digital Bond and IOActive before founding Gravwell in 2017. His research included industrial control systems, internet-connected devices, vehicle systems, embedded technology and previously unknown vulnerabilities. He also reverse-engineered communications protocols.

At Gravwell, he focuses on security logs, machine data and network data. He argues that defenders need to understand their own systems rather than rely only on descriptions of how specific threat groups operate.

Thuen also reacts strongly to claims that a system cannot be hacked. “The best way to get hackers to spend extra time and get good work out of them is to say, ‘This system is unhackable,’” he said. “If I’m told this cannot be done when it absolutely can, then I’ll do it for spite.”