Work
The tools, platforms and security research I've built over 15+ years.
Sensor-led early exploitation intelligence: early warning when vulnerabilities move into active exploitation. Previdian uses proprietary sensors and private honeypots to observe exploitation attempts, corroborated with vendor advisories and public evidence so teams can act with confidence.
The WordPress vulnerability scanner and database. Built from a side project in 2011 into a profitable business cataloguing tens of thousands of WordPress core, plugin and theme vulnerabilities. Acquired by Automattic in 2021.
The Damn Vulnerable Web Application - one of the world's most widely used security training platforms, used by students and professionals to learn and teach web application security in a safe, legal environment.
A selection of notable security disclosures credited to me. WPScan's database catalogues many thousands more across the WordPress ecosystem.
Affected a plugin with 1M+ installs; discovered and disclosed by Ryan Dewhurst.
Reported and disclosed by Ryan Dewhurst.
Co-credited with Tom Mackenzie (original finder); Ryan Dewhurst credited for PoC creation and analysis.
The main focus right now is Previdian - early warning when vulnerabilities move into active exploitation.