
Dan Guido.
Co-founder and CEO of Trail of Bits. Writing from Miami.
Latest posts
See all →About me
I co-founded Trail of Bits in 2012. We audit software and build tools to find security bugs. In 2020 we audited Zoom while the world's meetings moved onto it. That same year we audited Voatz, the mobile voting app, and found ways to alter or cancel votes. West Virginia dropped it from elections. In 2025 we placed second in DARPA's AI Cyber Challenge and took home $3M.
I created iVerify. We released its iPhone app in 2019 to check for signs of device compromise and spun out the company in 2023. I also made Algo, an open-source VPN server, after deciding most people don't need a commercial one. The New York Times and Consumer Reports both recommended it.
"We're playing a losing game because of the way the platform is set up. But that doesn't mean we shouldn't try."
At NYU Tandon, I spent four years as the first Hacker in Residence and taught the cybersecurity capstone course for seven. I helped start the OSIRIS Lab. Trail of Bits and I trained cadets at the US military service academies to hack, then turned that material into the public CTF Field Guide.
I sometimes say things in public that get people upset. In 2016 I argued Apple could comply with the FBI's court order to build custom firmware that would unlock the San Bernardino shooter's iPhone. I called the firmware "FBiOS," and the media picked up the term. In 2019 I got myself escorted out of Black Hat for making too much noise about a sponsored talk on a novel encryption scheme. The conference pulled the talk from its website a week later.
"It wasn't until very recently that companies had to consider: what does it look like if we attack our own customers?"
I grew up on Long Island. As a teenager I figured out I could change anyone's grades at my high school. I showed the superintendent. He thanked me, then banned me from the school's computers for most of junior and senior year.
I went to NYU Tandon (then Polytechnic), where I was selected for the federal CyberCorps Scholarship for Service. It paid tuition in exchange for government cybersecurity work, which I did as an NSA intern, first in TAO on the offensive side and then in IAD on the defensive side. TAO is the work that shaped how I think about security. My first job out of school was at the Federal Reserve Bank of New York, and after that I joined iSEC Partners, the security consultancy a generation of notable researchers came up through. CISA put me in the Scholarship for Service Hall of Fame in 2021.
Around eighty people into Trail of Bits, I started feeling out of my depth and went back to school. I'm finishing Harvard Business School's Owner/President Management program in October 2026. Along the way I've ended up lecturing two HBS classes myself, one on AI and one on cybersecurity.
Outside the company, I'm a major benefactor of Pioneer Works in Brooklyn and fund the Hacker Spirit Scholarship at my old high school in Mineola.
Selected milestones
- NSA, Tailored Access Operations
- Federal Reserve Bank of New York
- iSEC Partners
- Co-founded Trail of Bits
- First Hacker in Residence, NYU Tandon
- Competed in DARPA’s Cyber Grand Challenge
- Created Algo VPN
- Launched iVerify
- Started Harvard’s Owner/President Management program
- Second place, DARPA AI Cyber Challenge
- Published the Trail of Bits AI playbook
Writing elsewhere
See all →- 1Password's AI patching benchmark is misleadingWe show why bad instructions and faulty grading make 1Password's headline unfit to guide defenders.
- How we made Trail of Bits AI-native, so farWhere we are after a year of rebuilding the company around AI agents.
- Trail of Bits' Buttercup wins 2nd place in AIxCC ChallengeSecond at DARPA AIxCC, $3M prize. Autonomous bug-finding works.
- The Unconventional Innovator Scholarship
- Mitigating ELUSIVE COMET Zoom remote control attacksAnatomy of the social engineering attempt against me.
Press
See all →- How to Get from AI-Assisted to AI NativeTim O'Reilly's Ai4 keynote draws on our approach to AI adoption at Trail of Bits.
- Cybersecurity experts say AI giants are shutting them out of safety plansAs AI labs turn to METR for oversight, I challenge their framing of cybersecurity failures as AI misalignment.
- AI as an Enterprise Operating SystemTim O'Reilly examines how we rebuilt Trail of Bits around AI.
- How OpenAI's human mistake led to the AI-powered hack on Hugging FaceI discuss the containment failure that let OpenAI's models attack Hugging Face.
- Ordinary Engineers, Not Heroic InventorsTim O'Reilly draws on our experience to explain how companies can put AI to work.
Talks
See all →- 200 Bugs/Week/Engineer: How We Rebuilt Trail of Bits Around AI
- The State of AI/ML Security: Myths vs RealityCutting through the hype on AI/ML security.
- Financial industry exposure to AI-enabled cyberattacksBriefing the CFTC's Technology Advisory Committee on AI threats to financial markets.
- What Blockchain Got RightWhat's worth keeping from a decade of crypto.
- Understanding crypto markets securityBriefing the CFTC TAC on how crypto markets get compromised.
Podcasts
See all →- A Playbook for Going AI NativeThe O'Reilly encore of my [un]prompted talk, plus 40 minutes of audience Q&A.
- Sponsored: Trail of Bits and OpenAI patch the planetI talk with James Wilson about how Patch the Planet helps open-source maintainers.
- Dan Guido, Trail of BitsDerek Hsue got the Trail of Bits story out of me: eight months without revenue, the DAO hack, and hiring for mastery.
- Risky Business #835: WhatsApp private AI inferenceOn private AI inference and our audit of WhatsApp's setup.
- Sponsored: Trail of Bits going all-in on AIOn rebuilding Trail of Bits around AI agents.