I started in the Marines on presidential security, then as a rifleman — an 0311, which is how I ended up on the team that pulled a downed Air Force pilot, Scott O'Grady, out of Bosnia in the summer of '95. Counterintelligence came later, and that's where I picked up the thing that's stuck with me ever since: the interesting part of security isn't the lock, it's the person who talks their way past it.
The years since haven't run in a straight line: web engineering, a small security company I started and ran for a few years, consulting, and a long stretch in federal aviation — part of it as an acting ISSM. Somewhere in there I wrote a book on network scanning, mostly to force myself to get the details right. These days I spend most of my time poking at AI systems and building tools like Iago, because the newest and least-understood attack surface turns out to be a plain conversation.
Away from the keyboard I'm usually making something or taking it apart — there's always a half-finished electronics project on the bench. I train jiu-jitsu, read more sci-fi than I should, fall down cold-case rabbit holes, and give a good part of my spare time to animal rescue. Anything with real craft in it or a good mystery behind it, and I'm already in.
The thread through all of it is the same instinct: I don't like being fooled, and I'm not precious about being wrong. This site is where I think out loud about security, unsolved mysteries, and the beliefs I've had to revise. None of it is final.
Baltimore. Reachable at contact@michaelhixon.com.