Cybersecurity has roots in universities, government research labs, and technology companies, but much of modern hacker culture grew out of a very different scene: teenagers on bulletin boards, testing the limits of newly networked systems and, in many cases, breaking the law along the way. Journalist and author Joseph Menn makes the case that the origin stories of hacking culture hold lessons that matter more than ever, as a new generation enters the field and AI reshapes how defenders find and fix vulnerabilities.
At the 7th annual Open Source Security Summit, Menn sat down with Adrian Sanabria, founder of the Defenders Initiative and host of the Enterprise Security Weekly podcast. Menn wrote "Cult of the Dead Cow," a CyberCanon Hall of Fame book, and was a 2024 Pulitzer Prize co-finalist during his time at The Washington Post.
Many of the people who shaped the beginning of the cybersecurity field are still active today, yet much of its history remains fragmented. Menn explained that hacker history was rarely formally documented, with much of it scattered across old Usenet threads, archives, and personal anecdotes that few people revisit. Without that record, newer practitioners risk repeating old mistakes or revisiting problems the field has already confronted.
"There are a lot of folks coming into cybersecurity now that don't know the history." - Joseph Menn
Menn set out to tell those stories in a way people would find compelling, because they carry more than trivia. Knowing whose shoulders they stand on gives defenders a better understanding of how the field developed, and a stronger foundation for tackling the challenges that come next.
The habits that got young hackers into trouble also helped turn many of them into the industry's most influential defenders. Menn noted that many top security leaders of that generation broke the law as teenagers. Growing up testing limits taught them to think differently from peers who took a more conventional path into the field.
The turning point came when everyone else got online. As AOL and Windows 95 brought parents and grandparents onto the internet, many of those teenagers realized their skills could protect people, a shift Menn described as something they worked out in real time.
"A lot of them kind of morally leveled up. Like, well, we actually know stuff. Maybe we should help people." - Joseph Menn
That shift reshaped the industry. Cult of the Dead Cow members and their circle founded billion-dollar companies; Peiter "Mudge" Zatko went on to become a Defense Advanced Research Projects Agency (DARPA) program manager overseeing cybersecurity research; and the group coined the term "hacktivism," which describes using hacking and other digital tactics to advance political or social causes. Menn suggested that the drive to put technical skill toward the public good matters even more today than it did then. Zatko ran DARPA’s Cyber Fast Track program, designed to make government funding more accessible to independent security researchers and small teams.
The Cult of the Dead Cow owed much of its influence to something simple: its members knew each other. Menn explained that the group stayed small, talked constantly, and shared core values despite coming from different backgrounds. He contrasted that with Anonymous, a looser movement whose participants often did not know one another. Menn argued that its values varied widely, and that some of its denial-of-service attacks suppressed the very speech hacker culture valued. Menn added that nation-state-linked "hacktivist" fronts, he added, have muddied the label even further.
That lesson still applies as the ethos spreads out. Former hackers now work across open source, large companies, human rights groups, and government. Menn said the communities connecting them are harder to spot than they used to be but are still findable in any niche, and they still run on trust built over time.
"If you do good work over time, somebody's going to tap you on the shoulder, and you'll be a part of it." - Joseph Menn
For anyone looking to get involved, the path is the one the Cult of the Dead Cow modeled: show up, do good work, and earn a place in the community.
Questioning assumptions is a valuable and eroding skill, and one that deserves to be praised and taught. Menn argued that as misinformation spreads and the field grows more specialized, critical thinking has become something society depends on, and hackers have it by definition.
"Critical thinking is a piece of national critical infrastructure. And hackers, by definition, are critical thinkers because they're looking at something that was built for one thing and wondering what else they can do with it and how to break it." - Joseph Menn
The security industry needs that critical eye more than ever. Sanabria recalled WhiteHat Security founder and longtime security researcher Jeremiah Grossman asking why the industry wasn't more skeptical of products that promise to fix everything. The evidence both speakers cited suggested that doubt is warranted. At Black Hat in 2011, Mudge, then working for DARPA, cited a federal vulnerability watchlist in which six of 17 tracked vulnerabilities were prevalent in security software. Sanabria found a similar pattern in his own analysis of the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, estimating that close to half of the products listed were security products.
"The industry has had this amazing capacity to fail upward." - Joseph Menn
Menn's answer was to tackle problems at the root rather than assume that bolting on more tools will make systems safer.
In a black-box security model, customers rely on a product without visibility into how it works under the hood. According to Menn, that approach creates a recurring cycle once attackers obtain the same product and begin testing against it. It works like this:
The product launches: A vendor sells a security product designed to stop threats but keeps its inner workings hidden from customers.
Attackers get a copy: Attackers buy or obtain the same product and test their attacks against it in private.
They find a workaround: Eventually, they discover ways to circumvent the product’s defenses.
The cycle repeats: Customers turn to another black box to close the gap, until attackers find ways to catch up again.
Sanabria added that customers could help vendors improve their products if they could see under the hood, but the typical pitch asks them to trust in a solution’s effectiveness based on faith alone.
When no one outside the vendor can inspect the code directly, flaws can remain hidden for years. Sanabria pointed to Tavis Ormandy's research on Symantec and Norton antivirus, which found that parts of the core decomposer library relied on open source components that had not been updated in at least seven years, leaving known vulnerabilities unaddressed. Some flaws could be triggered simply by sending malicious content for the antivirus engine to scan.
"The whole thing it was designed to stop was the way to compromise it." - Adrian Sanabria
So why don't more vendors open up? Menn pointed to executives, boards, and investors raised on the proprietary model who struggle to see how free code makes money, even though open source "obviously does work." Open code gives a broader community the opportunity to inspect, test, and improve software rather than asking customers to trust security claims at face value.
AI is accelerating the discovery of long-buried flaws across software projects.
"It's this land rush to find the vulnerabilities. So much more is now visible. Decades of technical debt are coming due at the same time." - Joseph Menn
No scale is already visible. Menn pointed to Microsoft’s September 2026 Patch Tuesday release, which listed 974 CVEs, a record for a single Patch Tuesday cycle.
But identifying and remediating vulnerabilities and bugs is only the first step. With so many reports turning out to be trivial, Menn said, triage is more important than ever, and triage requires resources. Anthropic reported more than 10,000 high- or critical-severity vulnerabilities in the first month of Project Glasswing and identified verification, disclosure, and patching as growing bottlenecks as vulnerability discovery accelerates.
That is where well-supported open source communities can have an advantage. Maintainers, contributors, and researchers working in the open can verify, report, and fix issues in parallel. But that advantage depends on having enough active contributors and resources to keep up.
"Maybe Linus's original statement that many eyes make all bugs shallow is now true if AI are the eyes. But still, somebody has to pay for those tokens." - Adrian Sanabria
Closed-source products can carry the same kinds of flaws, but outside defenders generally cannot inspect the source directly, while attacks can still probe or reverse-engineer the software.
The hacker ethos that built cybersecurity is still writing new chapters. Menn closed by noting that the Cult of the Dead Cow was adding new members and building Veilid, a privacy-focused peer-to-peer messaging framework, and that the updated edition of his book covered AI and the role of activists today.
He also expects a turbulent few years as AI uncovers buried bugs, with one potential payoff: more long-standing flaws finally getting patched. Getting there will take the same values that carried the cybersecurity scene in its early days.
"A lot of basic hacking values [will] become more important." - Joseph Menn
Curiosity, skepticism of black boxes, transparency, and communities that share what they know provide a working toolkit for defenders heading into the AI era.
Some of the best ideas in security are decades old, Sanabria noted, and this conversation is packed with them. The replay goes deeper than this recap, with Sanabria's own stories from the hacker group Attrition, accounts of hackers who moved into government roles, and efforts using AI to identify and patch vulnerabilities in open source software. Watch the replay to hear Menn and Sanabria in their own words.