She Convinced the Pentagon to Let Hackers In. Legally. With Katie Moussouris

Why It Matters

Moussouris’s model of legally sanctioned hacker collaboration shows that responsible disclosure can enhance national defense and corporate security, while her equity advocacy pushes the industry toward greater diversity.

Key Takeaways

• Katie Moussouris pioneered vulnerability research and bug bounty programs.
• She convinced the Pentagon to legally host hacker penetration testing.
• Her work shaped Microsoft’s vulnerability response after the 2008 DNS flaw.
• She advocates pay equity and funds gender‑focused cybersecurity research.
• Early hacker culture emphasized curiosity, not profit, influencing modern disclosure norms.

Summary

The podcast spotlights Katie Moussouris, a former teenage hacker who rose to become a leading figure in vulnerability research and policy, famously persuading the Pentagon to allow legal hacker penetration testing.

Moussouris coordinated Microsoft’s rapid patch response to Dan Kaminsky’s 2008 DNS flaw, prompting the creation of Microsoft’s own vulnerability research program and later founding bug‑bounty initiatives at HackerOne.

She frequently references the early, curiosity‑driven hacker community, stresses the importance of responsible disclosure, and champions gender equity through the Pay Equity Now Foundation and a Penn State lab named for her mother.

Her work illustrates how structured, government‑sanctioned hacker engagement can strengthen national security while driving diversity and inclusive practices across the cyber‑security industry.

Original Description

In this episode, Ciaran and James sit down with Katie Moussouris, Founder of Luta Security and one of the pioneers of vulnerability research and bug bounties, to discuss how the industry has changed over time. Katie shares her expertise on vulnerability disclosure programmes, researcher protection and equity, and why she still bets on people in an AI-driven world.

Contact:

Have questions or comments? Email us at [e-mail] (mailto:[e-mail])